Gen.Variant.Adware.Graftor.171097_1d8554e939

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

smu.exe:568
smu.exe:900
smu.exe:1168
wscript.exe:168
sma.exe:216
sma.exe:624
sma.exe:1340
sma.exe:1920
sma.exe:3196
sma.exe:1100
sma.exe:2116

The Trojan injects its code into the following process(es):

%original file name%.exe:856
%original file name%.exe:224
ins_smk.exe:1968

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:856 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ERSTKPE3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DMWOC8IT\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4CISGD4B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0HCPABK3\desktop.ini (67 bytes)

The process %original file name%.exe:224 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Install_15858\ins_smk.exe (49912 bytes)

The process smu.exe:568 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (411 bytes)

The process smu.exe:900 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\SMW_UpdateTask_Time_3835323735333432352d3437415a556c2a3223346c41.job (968 bytes)
%Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (407 bytes)

The process ins_smk.exe:1968 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (19096 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (3312 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\nsExec.dll (6 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (784 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (34561 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smfi32.dll (23296 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smei32.dll (24832 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smri32.dll (13584 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smoi32.dll (14184 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\System.dll (11 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (58402 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (2392 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25112 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (312459 bytes)
%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\ns5.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\AccDownload.dll (11344 bytes)
%WinDir%\Tasks\SMWPUpd.job (1152 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nss1.tmp (0 bytes)

Registry activity

The process %original file name%.exe:856 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BF 5F C8 B8 0A E3 72 08 36 80 68 DA EF 39 B2 6B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:224 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer" = "2"
"MaxConnectionsPer1_0Server" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 55 AE F0 F9 B7 91 7F FC E8 C9 B4 8D BF 6F 26"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process smu.exe:568 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 54 92 21 8C BC 25 13 EF 64 5B CE 47 18 B7 63"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Rlt" = "Type: REG_QWORD, Length: 8"
"Scf" = "CE 4D AC 17 CB 03 3C C5 64 4C 68 D9 E6 F0 B9 C6"
"Ubl" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs" = "0"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Gcf" = "8A 25 83 83 80 08 64 CD B5 6F 92 2F 7D EB F0 0A"
"Ult" = "Type: REG_QWORD, Length: 8"

The process smu.exe:900 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 5A EE 19 2E C5 62 79 F4 3F E3 17 57 1F 5C 8A"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Rlt" = "Type: REG_QWORD, Length: 8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Scf" = "92 5E 53 FE A9 EB 5F CE F3 17 33 77 E1 4E 15 72"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Wow6432Node\SearchModulePlus\SMUpdPlus\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]
"Spt" = "0E 67 60 5E E3 C9 4E D4 C3 0C 82 C4 22 7A B0 07"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Gcf" = "D9 A5 D4 C7 0B 94 E4 04 31 95 5A 08 A8 9B 13 3E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus\Users\Default]
"Ucf" = "AF 19 06 18 24 A7 78 A7 83 2B E1 77 84 81 A9 3B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

The process smu.exe:1168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B 88 20 AB 2B 84 40 BA 11 5F 66 97 BF 1B 7F 21"

[HKLM\SOFTWARE\SearchModulePlus\SMUpdPlus]
"Scf" = "7D B2 D5 A6 04 0A 0D DB 94 F6 57 C5 B4 8C C5 A8"

The process wscript.exe:168 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE 7A 0F 03 67 6E 9C 69 14 A2 1B D0 10 B0 3A 43"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Common Files\Goobzo\GBUpdatePlus]
"smu.exe" = "Search Module Plus Update Service"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process sma.exe:216 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "98 48 67 84 78 72 60 B7 20 EA 5F CB C1 5D A2 37"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\LocalService\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\LocalService\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\LocalService\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:624 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F F4 93 12 11 C8 A2 4E 47 DC C7 30 38 CB 3C 62"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:1340 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 EC EE DF 60 0D CE B5 D5 5A 02 9A DA AF 83 EA"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sma.exe:1920 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 01 F0 92 C1 5A 5A B5 C7 69 1E 7D A3 35 74 16"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sma.exe:3196 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "43 91 C4 E7 92 F5 E7 D6 A9 CD BC 41 EA E4 C7 4A"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process sma.exe:1100 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 7A F9 FA 2B EA 1D 0B 5C 0B 04 25 36 A4 E3 58"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 05 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process sma.exe:2116 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5B 0D 3B DD 82 F4 FD 23 D2 99 ED 95 67 33 04 37"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoConfigURL"
"ProxyServer"

The process ins_smk.exe:1968 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 54 F5 9D C7 0C 27 BA 8E 24 E1 19 D4 73 54 0E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

Dropped PE files

MD5	File path
9b1ab23b8c06b28da5d8852505045d7f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\Install_15858\ins_smk.exe
6f7d9e111a17fab195efe0bbd3a0442d	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsx3.tmp\AccDownload.dll
a436db0c473a087eb61ff5c53c34ba27	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsx3.tmp\System.dll
814d55f1d293738558501566f4578477	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsx3.tmp\ns5.tmp
14f5984b926208de2aafb55dd9971d4a	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsx3.tmp\nsExec.dll
674d093acd450b620818c72c17dc009a	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll
6cdcbbddb9b7b761e690e2441a4f96a9	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe
faab1d36979d2462dfabbe606a620a93	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\Updater.exe
b86ad120f0d4092825314ec75368e060	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\sma.exe
30514ee11b7a51852ec017ee6593b904	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smci32.dll
99bb4b523809f2cc59f33269e8d9c185	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smei32.dll
2eeaaa5d8269386d5286ca5ea7b61f54	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smfi32.dll
befe4ed1dc653ad1bd9e92dc03115e16	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smi32.exe
36123050ad1e7e55a96b2d20b0404a80	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smoi32.dll
6c90ec4349fbe7e7476c914777515313	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smri32.dll
990db96a37c4387364a586988db47bd9	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smu.exe
1dfb26f2a7ce5e6cb63c6a599df55bbf	c:\Program Files\Common Files\Goobzo\GBUpdatePlus\smw.sys

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of processes by installing the process notifier.

Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls creation and closing of threads by installing the thread notifier.

Using the driver "\??\%Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys" the Trojan controls loading executable images into a memory by installing the Load image notifier.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):

   smu.exe:568
   smu.exe:900
   smu.exe:1168
   wscript.exe:168
   sma.exe:216
   sma.exe:624
   sma.exe:1340
   sma.exe:1920
   sma.exe:3196
   sma.exe:1100
   sma.exe:2116
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\ERSTKPE3\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DMWOC8IT\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4CISGD4B\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\0HCPABK3\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Install_15858\ins_smk.exe (49912 bytes)
   %Documents and Settings%\All Users\Application Data\SearchModulePlus\smhe.js (411 bytes)
   %WinDir%\Tasks\SMW_UpdateTask_Time_3835323735333432352d3437415a556c2a3223346c41.job (968 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\SMUninstall.exe (19096 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\sma.exe (3312 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\nsExec.dll (6 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\SBIEBrowserHelperObject.dll (784 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smci32.dll (34561 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smfi32.dll (23296 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smei32.dll (24832 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smri32.dll (13584 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smoi32.dll (14184 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\System.dll (11 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smu.exe (58402 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smi32.exe (2392 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\Updater.exe (25112 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx2.tmp (312459 bytes)
   %Program Files%\Common Files\Goobzo\GBUpdatePlus\smw.sys (784 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\ns5.tmp (6 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp\AccDownload.dll (11344 bytes)
   %WinDir%\Tasks\SMWPUpd.job (1152 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version: 2.8.0.999
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 2.8.0.999
File Description:
Comments:
Language: English (United States)

Company Name: Product Name: Product Version: 2.8.0.999Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: Internal Name: File Version: 2.8.0.999File Description: Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	669343	669696	4.55153	4bb6ba0695f787f76b937c707ea07cab
.rdata	675840	232174	232448	3.02428	a8dc5b655a4253b16b9225ed1327f6d6
.data	909312	24616	13312	3.01559	2c50f8223b338a8db9e1479b1472ab67
.rsrc	937984	244152	244224	4.40222	91c833019af3a3414f63c9ebdf2a2acd
.reloc	1183744	44368	44544	4.55606	c185638bf457d9a0ce075353148c1da7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId0CN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DhvUiLCZht1Hw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTHRdsGMkr9o5Q==	54.239.168.147
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20796.ashx?e=9g1KGrSSDbFnA3VLGqrT9bObhXqig3vQ/ToTRiVFxVTeyzV7AofXlljJzRxQxlEZaaZ7X0pM2q972Jm jUgJb K9V0GRRES6LOwEGQvh2zV2TxY7/sL 44G r 3F6T7Ye9UEEkdnkZTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05A==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20796.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId61yMTX l/6f1Gg4F6dkBzXUfBgwh1qVrevysBL0IwHwhEolvsKoHiSTZUc6Aooj3S5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcboqKFmkaACc=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20796.ashx?e=Feo0TQZfu6JEiM3QAgk1iYgi1NSnhIRtUrnGyaZ1cKAgzQKqaxF9uzTxsSAVFvckt57skbJUfWVF1v9LxgoeQ9yvhlGeipNVCLrigWdzvFSBhNm8v0ROhLLipWZqHf8IqQ738O45G6msghrXFy3siZmVkUOPn2OtThCloTbvSUnVAezdf3aKUX8KCb00J1/GybHDfry6wqN4aiwGTpWLle7UxJ2OByOdJVFogUCDW95C1hCfF5Qq78TQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5a7srxy/100X021585MfhSh3bXYBh5GayOJOBpub70rLs00SACstm8ARzholYRMjQFBOBxSLKI9g=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20796.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId61yMTX l/6f1Gg4F6dkBzXUfBgwh1qVrROUvSdX2iqnJyMz45O1xrVtQeXCcg/Fhy2/UUM264sa8NVcbx dWxSReJECB10wJoxWgtYjek0x0XbBjJK/aOU=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20796.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId61yMTX l/6f1Gg4F6dkBzXUfBgwh1qVrROUvSdX2iqn4U8uoq4rC8jC8FaAJlN651M0VcwJ5frhGOm3Uf3CmG2WCTXAsULmHJXDEJtsbni JbSzYftBow4Xw1YVyPdjsy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcboqKFmkaACc=	54.239.168.133
hxxp://d1vw44q53d84jx.cloudfront.net/t.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnnGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU	54.239.168.147
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnn31fTgrR12XxM0RSkMVjMOymF904v4t2DvvmEff5Szys2pDIbTJYT5/J/CZZrhHzOQI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiaF8KpepynoFA==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnn31fTgrR12XxM0RSkMVjMOymF904v4t2DabdTvoymw9KK4MgXxLfL0mbYzuTjyH4oXoF8LoF/2KSZWL4xrVwJ Tcdxp90tK97Pw/oEGC9XXA6wiCB0lzNhV gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw=	54.239.168.133
hxxp://d13s98z2lzti92.cloudfront.net/smw9476dp.exe	54.239.168.245
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=hNMAVKhukrzsUPBzNrhZoSFqCkoVULC0EhGH33nPGlEeaFNcfNJ0Dunq2YUwWYcGp2RYIisGWDtlUrzhzYzRp1xRiCJ7LaDq9ASgFozrkSzA43YcNHBP3Yuzb88XdQvFzbBYCuaAtAv9eH8vDyx7/Honl HFURaiQI32H5tXX1UeMZiMaXQ3mwTxIUcsgQ wzdQpwoYb2d0uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45Ih H5dM8082gbd3gkmW/P8y2lP48Q7eS	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaHfpIi4FJmsuCmF904v4t2DhvUiLCZht1Hw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTGCGrpHNYuwVpXZrelYJPLUrmhU/capljenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jnuP82lwxwVk5	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnn31fTgrR12XxM0RSkMVjMOymF904v4t2DZ0d7GEGeHAhiVQeEeICkE1 gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20796.ashx?e=WL9usJOVMsOEyHZoFFyrCIgi1NSnhIRtzV/Chxyj66IgzQKqaxF9uzTxsSAVFvckt57skbJUfWVF1v9LxgoeQ9yvhlGeipNVCLrigWdzvFSBhNm8v0ROhLLipWZqHf8IqQ738O45G6msghrXFy3siZmVkUOPn2OtThCloTbvSUl6p84vT1Zqrte3upwN8WEnBPEhRyyBD7Atar3 MoOYAPOdwOXGhKOjxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsuzTRIAKy2bwBHOGiVhEyNAUE4HFIsoj2A==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=1ZEnpGuz/IS8qFEAMB5m eohQc68x1qUnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jntb0/VHMr7vCQR6/4IivvmQ6Vl8CfCQOa0qDnvMWYrBzLhu0b45kiT9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP3EbLWmTIe6HPSZuizlKZS4vVGidJQzQbwcX153juosly7z014jPGHi9SV3844bx1iSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=1ZEnpGuz/IS8qFEAMB5m eohQc68x1qUnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jntb0/VHMr7vCQR6/4IivvmQ6Vl8CfCQOa0qDnvMWYrBzLhu0b45kiT9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXedTURWNEvv0HQBxTzK/bEJeNU2AyMdjD18IrcehD2XgC2UN26wBWmmzu CJ82QPHPcr4ZRnoqTVQi64oFnc7xUgYTZvL9EToSWMP/TO6/VdV gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBc0mcAV5x9Zq8REA6JJo1yTYsDxCaDUYS4=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaF K90vWg22jgTxIUcsgQ w9JTsKksJzkc9GdOcgDY83FHRy24uRaNd5D1mYH yQN4uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45Ih H5dM8082gbd3gkmW/P8y2lP48Q7eS	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaETVDNBVYCm8jEzQGoF c24WnZlMkE cTWzrf1vX5AkfSSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=wlkQ3WKgYpSE2rQtmh2LBCFqCkoVULC0EhGH33nPGlEeaFNcfNJ0DqkO9/DuORuprIIa1xct7ImZlZFDj59jrb4fsJSgpUeRWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wUwjovawqSslao3jUdNoCSgtGEWvtHszlxMJEYs7ZuS5ps2yEEi8z4WU3OIZZQkkIvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/138tv1FDNuuLGvDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMdF2wYySv2jl	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaFteqZ6txLbCymF904v4t2Dnog6XUlbewcH2RZLt1dnp6UixEX0xfzw4HtieZnm 5lfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXNJnAFecfWavERAOiSaNck2LA8Qmg1GEu	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaHIEYMXrTArcgIcLERiDa7oR PSvW6ggY6bU70LkFPOglTtqlsg8UxwX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YFzSZwBXnH1mrxEQDokmjXJNiwPEJoNRhLg==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaEUAuICjN6dOdCUHeR8YCF3bJ OTVC78tU3Oou6/0cDl ITGL7aiC8Hk2dyYR17VYOC5WBoetiu1UCOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndYd2UWQutiWnmTLxkU5IwOiMgDKZsuVUutGrrh2gDrzw=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaGZkM9Y0jGVT9CUHeR8YCF3f2c56y21dI6CUH303iJt4o2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1UIuuKBZ3O8VIGE2by/RE6EdMmAv7FlhVU=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaEVp nOsv5TlY4G r 3F6T7Gp4nBQBFoDDmrGuxvJf88SSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=/k6kR j50toLjT49fHfOTMUsouUMGEFj/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRrxRGDtTxesq2/Yvk4NwwDb pZnlhr/Xf5JPYxSEah4SDHGXB7YFOPGDSJ/99oiDDxSV52Q9AtHZ4u3oGHN86wOkpZrNsvTHKpXcKSoKf7ImsTIe5wObHey9BKGIpZn1wUSPdqmKrASUuW0z4fDf/CL5icQHUvxQfe2KCefkiIqiSoA1acazRDQ3/hMAj7hCtv2fF1nx0QWILbeTSdCAAmVfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXNJnAFecfWavERAOiSaNck2LA8Qmg1GEu	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaGw5VIziNxXAbPiCC4paVhd8zSuMIYUMvmPdyAxw9rrTY2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1UIuuKBZ3O8VIGE2by/RE6EdMmAv7FlhVU=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=LCnUzM5l8JJBYQAernua8JIgZ/hZkBmvBZdZyFR30QH UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJuC7CJbrKtAdgKkdlz1lRoecfoMYwDyt1jgb6v7cXpPth71QQSR2eRlO8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGnXFGIInstoOr0BKAWjOuRLMDjdhw0cE/d5H pJVz7dHY=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRoY09ECF87Zuss IILilpWF1SqCHr/94rW31vzipeVYvpr maR6b3/MexiezSykY/Z1O8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGnXFGIInstoOr0BKAWjOuRLMDjdhw0cE/d5H pJVz7dHY=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRocVwJfcRD1hSQlC/zd7KOiNj5yJiER ZdFzs5z9K92np5fW7bk4OAJszSeXz WOSe2gfzOh75YrE8lTEsfACFQHDS9grIBe62ECRPbe1n4uFCo1vP TQjTAiIt/nVVNIsTqH4uNI47xgaO7LcxDP9rVhKtWJq6BTOwtTpX/QxZUjjb4jQoSuQY5U1UA3XDfdz2vKjb/PWSCkM43K3xVh7gLWnAnQ5mmjIHdeqQv5mR2zDq G/ip9Gpe8O oC9o3iBtMSIBLLUbZyt2BlybVqjeaIhCHjix9h4 8n3XkYuZ2XjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVQi64oFnc7xUgYTZvL9EToR0yYC/sWWFVQ==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRoVez2xuA6YrxdKm30ZIdZdA/6UnSy/9g5ij9W2jsh ZY4cGjsXTcXKxAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JjlkwUaFySc/6ysA rfm9WUeI9VTThLJ3WHdlFkLrYlp5ky8ZFOSMDojIAymbLlVLrRq64doA688	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRoTp7ys67qImnFAL52sIXt4XOSMm4SbI/lC36 lBzVeTnLb9RQzbrixrw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTGCGrpHNYuwVpXZrelYJPLUrmhU/capljenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jnuP82lwxwVk5	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=QgW8pN5r26ZQhScA1jb3T9hvrckiab6TnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jntb0/VHMr7vCQR6/4IivvmQ6Vl8CfCQOa0qDnvMWYrBzX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPQYtVwkpxW0sTQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5a7srxy/100X021585MfhSh3bXYBh5GayOJOBpub70rLs00SACstm8ARzholYRMjQFBOBxSLKI9g=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=aQQpsP6/AW3r A4x0AgNXQkKiNdCtAY0fR8JhGQq6w6my6t0 u4xzY1hNpWaoDmrUA7dl9owwhIeI9VTThLJ3WHdlFkLrYlp5ky8ZFOSMDojIAymbLlVLqEmwQdahDDEWMnNHFDGURlppntfSkzarwlSZ jhSjr174r1XQZFERLb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO73YWWt VIUUiVtB8erRBUEN8bIP/mOIFyySWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A==	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=aQQpsP6/AW0LjT49fHfOTLRL99D6Mq5n/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRrxRGDtTxesq2/Yvk4NwwDb pZnlhr/Xf5JPYxSEah4SDHGXB7YFOPGDSJ/99oiDDxSV52Q9AtHZ333RAvM0VMCx2KlVs8m8LqSlVGmgAnwDs8HdD6KPa6/vhHB5/UxRfI2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1UIuuKBZ3O8VIGE2by/RE6EdMmAv7FlhVU=	54.239.168.133
hxxp://d1cfk8e4o0c4u2.cloudfront.net/20562.ashx?e=hpY1rXLYst6pJ45fVU/vC5IgZ/hZkBmvpR2TVTgkNkv UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJu3dmSpkOIyZgKkdlz1lRofr/zw3mMKgg0JQd5HxgIXdXSs 69z5tFbQfHq0QVBDfGyD/5jiBcsklpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJGvFEYO1PF6yrb9i Tg3DANv6lmeWGv9d/bSJGWd2CgPQ=	54.239.168.133
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F6Rzamodk0,99999999-9999-4099-8172-b55e6f43c3fd,&v=2.1.9.476&md5=c6ee112206f381f81f04f58e04ddf1bf&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=AC1C6B5A-1E09-4CDB-BEC7-BC2E438F82FB	54.239.168.201
hxxp://pwvz71qp-ur1xo6pn.netdna-ssl.com/wu.ashx?dsid=1&s=F6Rzamodk0,99999999-9999-4099-8172-b55e6f43c3fd,&v=2.1.9.476&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc	198.232.124.192
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F6Rzamodk0,99999999-9999-4099-8172-b55e6f43c3fd,&v=2.1.9.476&md5=03706ddb514c5b80b62c1474723a9ca1&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=AC1C6B5A-1E09-4CDB-BEC7-BC2E438F82FB	54.239.168.201
hxxp://d23ocewf5ttxmu.cloudfront.net/br.ashx?pid={PID}&aid={AID}&ss=0&s=F6Rzamodk0,99999999-9999-4099-8172-b55e6f43c3fd,&v=2.1.9.476&md5=0f1965f7c48852df501c41a8e3675725&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=AC1C6B5A-1E09-4CDB-BEC7-BC2E438F82FB	54.239.168.201

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /20796.ashx?e=9g1KGrSSDbFnA3VLGqrT9bObhXqig3vQ/ToTRiVFxVTeyzV7AofXlljJzRxQxlEZaaZ7X0pM2q972Jm jUgJb K9V0GRRES6LOwEGQvh2zV2TxY7/sL 44G r 3F6T7Ye9UEEkdnkZTvMZjEVVmTm 4 SQMoieQ8Lxp8HLogowR591rTzu05A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FiPAfpfFqdD9aHmmMCC6MfKH_aHqtnYSnvfG1fPumYbBVkPuu3sUFQ==

....

GET /20796.ashx?e=Feo0TQZfu6JEiM3QAgk1iYgi1NSnhIRtUrnGyaZ1cKAgzQKqaxF9uzTxsSAVFvckt57skbJUfWVF1v9LxgoeQ9yvhlGeipNVCLrigWdzvFSBhNm8v0ROhLLipWZqHf8IqQ738O45G6msghrXFy3siZmVkUOPn2OtThCloTbvSUnVAezdf3aKUX8KCb00J1/GybHDfry6wqN4aiwGTpWLle7UxJ2OByOdJVFogUCDW95C1hCfF5Qq78TQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5a7srxy/100X021585MfhSh3bXYBh5GayOJOBpub70rLs00SACstm8ARzholYRMjQFBOBxSLKI9g= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: nkD0Isp2BN0-UGd5Z8R5lZ4tzcbkECoh6QOU99x-2VKA-mUvvH2enw==

....

GET /20796.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId61yMTX l/6f1Gg4F6dkBzXUfBgwh1qVrROUvSdX2iqn4U8uoq4rC8jC8FaAJlN651M0VcwJ5frhGOm3Uf3CmG2WCTXAsULmHJXDEJtsbni JbSzYftBow4Xw1YVyPdjsy5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcboqKFmkaACc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

X-Cache: Miss from cloudfront

Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)

X-Amz-Cf-Id: h5Z6O0u8VIQkGoBSC4Q7A1Ad_r62PsYzlsH5eMN2_c6Pmz96ksiqIA==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:29 GMT..X-Cache: Miss from cloudfront..Via: 1.1 de7a549023f0ea5ae15f58d27aeb67c7.cloudfront.net (CloudFront)..X-Amz-Cf-Id: h5Z6O0u8VIQkGoBSC4Q7A1Ad_r62PsYzlsH5eMN2_c6Pmz96ksiqIA==..

GET /wu.ashx?dsid=1&s=F6Rzamodk0,99999999-9999-4099-8172-b55e6f43c3fd,&v=2.1.9.476&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&usetmd5=&bmd5=&hpp=1&spp=1&ntp=1&ubrand=sc HTTP/1.0

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)

Host: pwvz71qp-ur1xo6pn.netdna-ssl.com

Pragma: no-cache

HTTP/1.1 200 OK

Date: Sat, 01 Aug 2015 09:10:54 GMT

Content-Type: text/html; charset=utf-8

Content-Length: 2116

Connection: close

Cache-Control: private,no-cache, no-store

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

X-Cache: MISS

nsdNk3N9fwki7WO0x/PmV059ZA8m9otC1FCGA/Cj/r3W3CMpsxneR914EjR10FRfrH5gQQR JrjrIHSztX1P2K5/r4jJMDmQgNzoyUXTe9SHqPgtpm8fS2EkkS4iefErsX1aCGk0zwLZfmns5M1XlJ8H63G9M/heHNcjnMr9gZJTP7tftKsoSAnml4MtSD7A7tORlwKzpkaC2AljdjdZUK9kAIfnRcMO86sLXOLqLo0ZHNvSvEwcQsuzMcvBqGUQRVQgM2UyyimfNPtdxZxq6F5xRAy1mNufH7VllG1vbD0SEWKASIPL9s0hNleME8bUQHjkEaFv5xCOTYyWyvGrcAj7gYM8PnmflwnilWn1G7N5XRApqt5aJkP JTO0kLsZz5ZCD6Y3Fw23zOpLZNLVVts7c4QeMc/ZpT0U964NK6KkZRNY3RgxIlJj831twDpDQKazVxTAlVka7tVfg WoDGvY SATLLPoyjfU LDziLJ KoNU2gBwiRJM1IIYTfPJFaXQIN6xs/M5ZDpu1B 9LWHGEK9FTnQ oUsjYzQ4zO6WB/Dj0xTRe3lgS2xYnXI0YcEhRRZ7yGbjXmEYN2kOAncoUS9XBKuXzePzW1se2c4xklKexBcDvxJjcEbcFGrfc/ODf6gAk3xpCBBXMPnCRTbxFNr6pcg/G1c7ztUvSqP dDywxCk24ri3JLejRGkhgf1B9zPtlw3xpvXduGXgoBYvNvXDbd9TXe 0zp9KV3yDw0QUPF18yRbALRIlwGIMN/Nb6ZjbX4KVlj1AX7TmOgkiu1l O3VpbVx7F7VPLWuuuaeWax8wXrFGF8xDzxgTLoGK3 x/TxvxmKWbP7ELbGTsS e/M6LjHPODzP1u9BBZBvr7Ucp /yoXWopBZ1KYZwdrmKJJgAJWI3hYUL6 3fRsmVN3SHIyuHQSXmNjeNAd yfFLsPEg TIRrPdCKs85WdvFfSjBDO5HEsyoD43TBeYk/Y/mSIbXuhpyXOn3vAshxxyaXiYcxEeGsUKWU9gq24HC1O8ngo5 ZmeF/TcXtlM6K0Lo2GfTB8WaAafBJSSyHmuL7gFUFnHeoIqQFNOBhVCKrtt3M15wccJF3HA8ENn3ntAipW76juRGOa83ivZgsO2hBGLS34VPy 4qdo12nyBoTz60af8MvmkqUKAv8V5NvYTaatRv8vu4b9hoxooebNf846wuEZRMNQg8IxM2oX0wSPmt N9UGqIrV2JqWzKZOCJvq0i4ppE6z1 oGoXlrqL2yQASZst/oWFiVfiVxst5GMfjHcfGv9rJnP4yE7NDaJDYfBmnxMH2Knsmse2MBA956NCo50IpbyEH4yQMAsH2ub89JiICOjHpDAheuNBug AkiX5ErBhDcwOthUs0M61EubPTD8l/7TRDOBFr3nryVT/ITZ7fm3CgvuQ4RESV5l Yt3AQVtDNMn35 CnH1i70GMHy1mhV9rozEchpJ1sI3XjS55SdkwAqL7LAKNJZaHCu4Dvf92Z6eoB/j6hDPuSs2sydQu8IAZZkau2

<<< skipped >>>

POST /br.ashx?pid={PID}&aid={AID}&ss=0&s=F6Rzamodk0,99999999-9999-4099-8172-b55e6f43c3fd,&v=2.1.9.476&md5=03706ddb514c5b80b62c1474723a9ca1&mid=A0A7AiA9A7AAA1AiA7ieA1A91J7L773DiLAiiAA13D1J&uid=AC1C6B5A-1E09-4CDB-BEC7-BC2E438F82FB HTTP/1.0

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.0)

Host: d23ocewf5ttxmu.cloudfront.net

Content-Length: 2302

Connection: Keep-Alive

Pragma: no-cache

d=noFdkUVdx3Ym7WsoTHJYhYxZEnrOwSbZ21PY8bIh4OiaGT/eYmYL ZwWuyF7Axr0Xy40nDMh2ov9 dn4S I 8Kbb15EvuyXNOgycQwcgvr29IpsltWejDKtbWZcMuxiysqjDKicdLat/k427QX5N3IBzgrOOb7VF0 ZYGnWcY/EiQVAjgJ/RBjRV7B5PQgQDUrw65sEkef7arKeYomLqdKwaFPyYZPt7r8pDDqelT/wBrVUAPNLg9lQx 8Q2QEquju8MPiSfP2QBxEIKUz9 zTuEd57IwZ yUXhm U0hNXM7x4Al0KQ7Fop55mqApA3w2xG7PVZRUbnkISXZnPyazl4tx/IhAsMVrf2itXHqZXlOSY63DHKyVkV9lCspQWTmtWFQuOlk3YEo2dPikaCy8uWjoGSB94BiCYTAV6hN2idMaBOmsuLu5xztmqQ4tV496oUx3AXmeC0UryTiJUFO6i rvLz5MhHHERZWB1e1fsPi8RQxumhJYhkiGhBR3sZfQXzoRIc0sP2kzIa2eFNevqtZLsDQjkBVdWBIV oFydPwynrrNB1pwLaaPEdBVm/QHZuRCPb/0yAXmAs5Sr uco4HdlZa53SfkQ2ZLbbvi5rti0G0q0VUZ5wgNKSkBb1y9DtgYJiDlikm2EZQrV6 wsbwh17XksDLU9 t3h2ey5iUr9xO61CHTgSi/uhCQdD5QAw3ixM4/VCWTgpf5FOFrSBkzdw6PDWUP2K0h9hHL/H3vp hpWYBvJE2SlKrJYOtoX69NVp0RZgL62Szvosapv7hQiY88ZimIDhym4ITOJGcAGrHvuFvGghnzdeRkD vwiE4/gCdFzSZl92Z1nVeOYVyZsB46T6LmvwSw8BWt7N TbcfqWYkMUSvXKt47OXUfoQfLbXQv3x MkeQZHgvH2/k1aUvRwyLZEs8AfIhotjrXV0QDjsJF6FH JEMQjhIrGWIFSRHtaiT6vV088NIXyJrNdJsfu5fSqog mJwJfhdbwhoOgjQd072rD1xTC WQysD5c50SsLR/n/bUCM8DY4fm pcoQb1rmiD 3k1L/4DXq0flQa0dH

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:11:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e89c67951b2bc58773e3664c08702f34.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lVUB20I-QLx7XowN9BH5dTdNfIeeLf_VD7qdVmAoGD3HpYEJSTtX7g==

GET /smw9476dp.exe HTTP/1.1

Range: bytes=0-249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 0-249999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: mPzbUigjH9LQ3qA4L2wSMUd7phR3gh5WlEm7jj7rHkzkapW12uw7sA==

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L.....oS.................\...........2.......p....@...................................=......................................s..........XB............<.(............................................................p...............................text....[.......\.................. ..`.rdata.......p.......`..............@..@.data................r..............@....ndata...`...@...........................rsrc...XB.......D...v..............@..@........................................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H.....6B..H.P.u..u..u....r@..B...SV.5.6B..E.WP.u....r@..e...E..E.P.u....r@..}..e....Lp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Tp@..E...E.P.E.P.u....r@..u....E..9}...w....~X.te.v4..Dp@....E.tU.}.j.W.E......E.......@p@..vXW..Hp@..u..5<p@.W...E..E.h ...Pj.h..B.W...r@..u.W...u....E.P.u...\r@._^3.[.....L$...7B...Si.....VW.T.....tO.q.3.;5.7B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5.7B.r._^[...U..QQ.U.SV.

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=500000-749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 500000-749999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: QyblNBH-D-bK7wMb88MlFhlfSHlkakZGgHPcNIHVyitEAEuUsE08FQ==

.8.h?./;...g/..t..`......FM!......J.g..3.o.a...."z..{...]...&.......$...I6.G..\.9......o.&". .'_zr4....Y...pe[p....Moc..4./M........z..U\j4......{|^.d.7.'....38...9.....$]o...../...Y]........,.X.<=.....5. G..1W..j...7...!x.$.~...B.....W.4...\...B*.1.....{..?\.../P(9.........6..*...?=*.....64ILl.x....!.._.aF!...*.6..s>.(...Zh.L.*..~NqP(..4!....V=.....A..:P./;......@......D.x...5.(...._::..Gp.....*.\Mzj...pD.'..`w...........#EJA.7{............\.9..%W.0.n../Y.......f..g...'A..v.........!k....n..X...b....BB.......(7.......tz.....C..L.>....=..........$....9..=.Z....wP.Z..|...3.2..@\k..$K.3.m.....T...i~...<...J.&!M{s.....@..f!.0...........x2I"..........{.yk..9...D0..rR..a=...&0..).(.TaQm....j%..*$A.........& T#....N^>.bn.>.....:U.[B......<S.e..3`j..3....y..fD.....-Ok.........~........'....,).!..d_.L?S..!|`.....U.L.......;.q....:.......;.......dy...o7.z{0].hG...^.5..,q....9... ."...g..Z..zP. .....TH......4.W....*...~H.r. ...6.{.F0u$.u....@r,.....R..L.....N..p{.c~m...f;..........!~m.........`.X.x.S.5.."..f>g>....8-..(R.......}.GK..s.tr...;7.f.s...v.Zk....A...q.'{..dQ.~..W)E....K.|9.ky....h.@..(...i..J0uJ-.....<.n.QrheL.."L1_k...Z...^O..?..#.N../7.R...p.q..U9.b./F..jy$=G... .S..X...e..M...^.....JF.....@D..>.....{...@..:..v......S....=....t\<vd.N...[...H...8@.xr.S...l.......(..>.~q....\Z.}.f7.qTe...|.....=<.u.7. QG....pK.5.C......r.r.......`.j..j#.,.O...d@tS%Q.N....o#......A.g.3.O0.p}....#...K...=.6.c...T$Gv....!...(3.`:g<.B.o.c.-[. .T~`.\..........:%.J&Wd.....N.F.....!?j...M.

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=1000000-1249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 1000000-1249999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gVWeYBk5enPsU3HWfFhat-F_Rxn5O8v2cppKXL2QlK7URm-7rxL-kw==

.4... ..]..E.....X.>$....q....%.N...u.k..p4........!...t..[.R....I.B......X.Hbx.;F.>v`.H.#.I..;E..L.Q.eN.. ..h=.j.M..sJ...Bq..;a.......L.....f.r.}....st n..~5rL.5.<Z....Z..).X.R....K.t..E...f.?.....nT.k....2M....X;....s.$Q...6Z..R..3.cY.>..-..@...Xbo..-.....x6.1R.O.796..7...g`....T....."..;.<..KV.!Y.d.z..(.........hi"O.....@..J...x_)p.:..jk.N..5OWM..[......S:'.m$.....'.1Be......X.L.H'>..~...a.tk...VQ.. .K'.(.Fp%..v..`.:..K.=..hp.5.....M..) .I.K..S.Z.9.x.U7z..M. m..FA....c....yo..b...1.9#1. H..L....c.b....qj.....>.....C..N.).A$..;...}.I...p.r.H...(.s]|0...[..(.8r..<^5a...A.....j]...c.... R..$(.f2u..Cx-..`.C.|B$N:.}.F.`b.d..o0P.r...f..3...............JoM9..$...Y:.......1..............O6...E O#.K6{.?$-....wU...L....R.L.k.|...5BH8...HK.>....&.`..;.kE.bt..w ...".OS.|..^.6Oa....o=......$...j\.M..B.O).').....&...4..1.~..X.......lM...[.....<]. ...o...j.p.w2.U.w...a..!....x.kW..".. .]:.....${s......qz..........(.h.z........k..}.[.T1...K...X.{(x...y...<.........t..[.~h..eM...*.v..M...f.Cx.u..1.ÛC>....o....~.\. .E..~.h.........o....WE.=...6N...[....22.{s..J..nx:..i.M[.....c. .._. .F.......ASZ.i,....tQ.`.......Q'......h..e.?53...H.9=...._......m......P.I...0}.S...\...F3".(...'..8F.....8.).._........v.6P..1..6...i.......'..............,8...;.e~...Y><V.......K{u'..h*.o.&..L......jb.....'...|M...iY..Jw....@T..`..|..........A.D.a.x...q.T.1A.`..S.jc.W..>"v.].dK...(..{d..V..D<.R0a.C.. .K...... .n4..l@..~>.8.^.o...W.....I..?4..I.d.SS/....m!.......9..R..U..H..."...9..|...m....F.

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=1500000-1749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

Content-Range: bytes 1500000-1749999/3973864

X-Cache: Miss from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: FiJ3ooe7WZmLVL-XTAacUtuLUp2zTBD3g3x_6AIsyL0VZn2BiJqpPg==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:29 GMT..Content-Range: bytes 1500000-1749999/3973864..X-Cache: Miss from cloudfront..Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)..X-Amz-Cf-Id: FiJ3ooe7WZmLVL-XTAacUtuLUp2zTBD3g3x_6AIsyL0VZn2BiJqpPg==...[........_T....8rxU....6........b.:...%p`..W.4]......Ev.=D..g..H..#...67{..K6.}.6..Q6..z....T.._....1L....s... *...D;..0F..R.x.T.7k....G.Xc..;.)......^..Wh..]...cU...O....c..[~.Y.1 ........ \...c..[..M..K.....qx.~...P..j.._]."U..ve&...5.tc..h..r[..."...S.d...D7f:.[.....-..{..........c....R..'D..B......=E......E..L..pI.....=4.........y_.V....{....^2$...n.......L.c.p.....y[(..ZKMGG..@..T........Q...)A0o8.........i=7..0....peS........2.sx..?L....e {f..r..(gz.w(C...K>....W.....s..!.<$..w.MR..%`j...l...Q@K..|".Q............K.....~&.Kj6w...q...G...~.DT4.E..........~.....Pp Q.U...S.......4...-.V..n...k...X..%g.E.R.].._W..M..-.k.PX...z.-3..........L`.{V......)...N0.K..A...H"pN]%.......d.`..c-G}.Z.B....e......M..Z.o....T.y.`..j.t...G......f.j....L.....?{.....-.....I,....=....G..a.......K4.......P^.%...i..N1..Y..V...,\.W.o....,A....[O'...:.e!....J.......#.U......i....}>!!.iJB9j.........8.6VD.*x..H...>S<...W.>.9.9(2.F.9..]7..)Gx.S...[.......O.

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=2250000-2499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:21 GMT

Age: 2109

Content-Range: bytes 2250000-2499999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Jwhg1rFQjANH0GNWNQ8OU8caYazb3a3xdjy_sBrRQzwttwfmFIEEnQ==

..5...N.au....H...E.....Z..a..;...h.<.P.{....S.0.....;...*.(d~O.t._.S.D.....*F.`q.b.../~<.X..T........'.{.f..0..*.lD.<...NR.B'.2?.#.|CJ>Py..{$.k..{.'..L|..,.\).>..Y.{.~_.*P:?BO>.:JN....z[..g...}....SX.L.Z..j.........}x.8...r....V.........>_..e!V....W .. VQ...t....Mb;.yV.U....=.`C........G..n.p..y4....^.|.@.%..3....z..$.p..reu<?..W.......9...}..F.....u.. ..u....qwI.%{.{.....B8.I.....u.....\.h:Wz.i..... ..M6..>..<.#N#SyQJ....,.'..!T.....m..25..7......~y.....h.>....i...).........3'_......oc....'.o.-.......D.R.U'.......[.K.;...........n,.^.|vFw$.B....y..^Lt.....M.........E.Qb|S..I.-.o.}od.X.c.8y....wls...j.....\.?Q<n.;..n.h"j\.j...<7.......^&4?!p#g..&..>c.^......n)E...F....v.3O......t.!6;[O.>R?Q...V...._.dk[..X.....'4./Vc........k"B3x@W....\.........m..Y.US.......W\>.G.........Ty.dR.w....m...o!...-...V.X...0o.[9./*.,...%.&.CX..H6=.......t...,kk/.A.f.jqbu.w..j....q| ...#N.....$.9E1b#6...O.. ..G.....................bc."...K"....hb.......@.(..v..E.%.! .(........}.^...]`...}.~...@.....3vU........`.......qi...cy.O.S...H..d..*...../....QC4s.;.C......c[-'A(.T|...(..I.@.S.p".4}....P.pXE.B.,@7.@Ox[M?........p-.4.1..K..w.}....5g.....W8......X..(..-...f.PP.>....=>YN.U0.*..8...F4.. .Y.-j...#.).....w...STn8..e..z...@>....\."...H.d6.~FP...).K..d.*'.>..?|\...J1Y....ZYG.....[.....F1.-q)......[5..R.f.j....../...rD..~...`.W..;.2k0./....._p.E..?..".N.HS).._.1~.T.....0.HEr...v-.8..*.................HT.t.<.:taC......U.,.."....I.......<...>j1.?.........q...U.....--...b

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=2500000-2749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:21 GMT

Age: 2109

Content-Range: bytes 2500000-2749999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zcnu0L_U5OskgZxUtqlI3YMZvggZUfzNMx9J-jsbUE5ZxMerX5mBrg==

.N...&'$....d.../..._d......S...N..... ..zd.~..(.H..~.|...;y.^.?.Y>).0..]....L..7F.h.y.(...|r.r.-#a..P....J..\....4..s.....A...$?.g.....B.;2.8.58.....F(n.%....*MLn.....d...9.v..zk.N.c.R..........N.}..l...].U.0...*..C.n.'..e..:7..7......d..A...^..l.[E...$.E|....f.o .Tb....2..U(............(yZ7..b0.@...4Y...d;... .O.......[....(}.-Q.....].LC.....Ln;....\..R...............J..j}V.-:....`T..=5.8.2.u...V.G.*.F.1*....h.h}..$...T(.SC.......{<.]...WK...,.c.(.......?4vA......=k@j.O26Hr)S..%......<...K.. E..VI........WG.1<.../....Am)...:...HP......kl...<...r..Ll$o./....w..r.K.o.5.z.k..0C...N..N...Z.k]...7.)h..".}.o...A....#.{/.........QR.Qb..n....d0..?./.. W.Z..^..hW...........J.0.t..M..I.|...i...Xw3....l/).......a..K.......6..48T..O.....7.7..{,1{....b./.....&Q.1Xu...._.?.\%..W....M..c...<...W..SX:.Gp...3.ED...q..=m..G$.A.!M?.a..Za..Z....&...R..Dy.`Y>...b.pr`..[.....6.Uo..T..... ..,..a$S..j.ZR\rZz.?......F.....'.....l..Q.w.....(.j...]w.]..5mAg..G..L.....p.W1......1k..C.^..4..S..@`........M.[.......jG......0.~-....\|5|.C.R.m..s.......Y.\....R1....$k... ..Yh.......@a..-r......4.....:85........e....m.F....(..6..s..........n..B.....O.b;..........Q.....oc..?u#.j......2b.U1..N....x...3.T@...<..v3..<.. .T.....]..*.....]..z.Jp.6...%...?..X8.p...E.z.B.........Pd\.....K...B......AN.|r...z2......,....>.U..@]*..l..D.|._9?n..X...."t.x.T..<.....z.....]....qB.-#B..3....%....]....../h...Z..k..........Z....b.5.$V*..i.`1...*..U.......n.~..Ilfy\.?.......&..fU,.....-........c\. ..$ .X.'...ky..j3[k........,...

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=2750000-2999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:21 GMT

Age: 2110

Content-Range: bytes 2750000-2999999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -AyTjR1TBqmKWVvc8K3R4-S_GcOxC3zNIlw_3sMANGwBpByyeaTy2A==

......$L3..@...@ *.*.|......E=v.wVz...}.....E...c..,..Z..........<...-y...7.B...E.`.....L... ..m....O...Y.).P.w.....F..WB.5#..}6a?...C.f....4..mm.....m.S.../.Nr/........-.".....b..n:..fL........l.f5m.....(I......x.....oT.wv.C.......{....O..O....Gp.\..../.$...9xy...o..._...5.A.X...ev4.#d...h.F..mi....T......V.......T..9h.Tw............!./vh.i......AU.!PBW.e....... ...U.AST,..5..^.SK.O....,..tH..&9r....> ../.wa%Z.$.q.y.5?n....T?........."..}.c.9c?Q..*=.-.KQSS .K..h...}.".6..!....}.G....!V....q.m$b.........*.A...eiW...g%.h.#. .3z.)...m..b.`..#..h.\.x. #.K...=.l..I....t.K......2.k%......A.S.(:...[3.T.j.....J.7......@Z.P..[.RB....... ...-X........2.T8./.a.k...S.....0...."S`..R...Y{......#.` ...9..qv.,_.........:..P.c....m.W..#.J.b..:g.......A.$..Q.G...:..f.U...[....."D.......v..A..u..]...AT..w)...h..V.....@p.J....r.).j...Q b.K..7~...6......kc..._...|.L1...l...z. .[.(......|..gO..XeEMb.Ma.".."."&......h...9..y.....[?...u.....EN..M76.......k..<.5b......f8...L...D ..|..K.i...........<-..(......*BW..[-....<.q.U{........Z../.!j.why8.~.........~.'.E.@F.i._..e.......AN..Q..._..~.$.~...-.J....'.....Z;.....@.}..o.h...I..G.S..49......4.B.%W......#....p0k.|{c...QB$=...:.:........$_.tW.X1....Z<.z.F....."...Y...5......&.V.y..i[..N'.z..A.D..'E8.|$p...K.......#....0..sM._....=..mz.A..BWl.a.|..>...k<.O..9G..Y.I.....?...[.......).0.:.z.w$......,'s...,O....;u..L~e.......9*Nb.....6....d...R.#d....K.b~c.1...s.i.........q*E..g..k.z...xB.q...H...M.%#R.....n.c.=.x\!.).}U.[..X_..6..W.W..........C....Mn.x..K&/..T..[7

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=3250000-3499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 31 Jul 2015 15:47:17 GMT

Content-Range: bytes 3250000-3499999/3973864

Age: 2108

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BWhEm0DJxKsxhaXSbrhezf-Klu4jkjfiFNJyYSFg_ZYGRvx4U77ekQ==

g.u..u..f...{.l%....&.9V..D.........]wu.h..I.!4.E.To.&.H@2]..3........{ &c.e.\Q..9T.K..[...jy....V[..j..`....c..%.:....D..sP......d..7xv../..Hn.......F.L.9.......&....[. z...p.../Y.....L......)L.C.\B.L(.?.D..So.;.7.._M...FJ...wj...RiT..K..A...x......},.........e...@X...ot9I .....!&.Lq7..PS...`.....%..O.5_mITP.......?.x6Xh\.n~a.w\.&.mo......[.(&j.....,1~....H.......nU.].....U..h...o}.F(....((wj....\m...]t".\.]@..].#.!....Tw..TO../.V o.......L.;.VAaH.<...u...=H....`.....Ox8x:........A.$...-...'t.....#...O...,..Eb.....]..qd...yOv.=d'f.....J.V.....D....2Y....es..by..j.(..X.;z.`$Y.}..M&=...jNL.}{a......'.........c..R.....'...58..\^Y....e@(.S. t:.................Ao..f...7P..]?..-{......m. )h.A.<....r........ ..%..~..5.v. .LT..".;..I....z.X@L...3..\.....@K...y.H.t..l.w....p..%...h.....}.,.0<K.FI.&.....X..qc.f%.Y.......l%/U....D.8....$.X...H=..?.G.`U.0U.....p].X.B.h:..F3.N.ODK......P,.%......?.~...:.Ll.%,q....8x....;j I/..,.U......|...luh1S.._....q`G.Z y....%........d........^.q..c....}.gOq izp...w..\T.c.....}......A....9....r.a@7....LFm..S.../....UsC.....:R.\G....s...?.hF......7..;g...*T.X.U...*..n..UU..p.cY?}y8.<..8..5.).Bi.....b.......x.......j.;......a?o.....7...{.n.9....[..H.(....N.......3..b.........#?...h2c........EO..E...<..../..=../.Vc.L.:..gg{..L.8.a._2.C.....PFyQ..s....M....An.~LO@.......gL......5.N..b..R0[N.P.2.m.....??...}.o..-.....~>......]xwz_........&a...m.2...h..z.....(2......,u2.*.M..... n.u....a............_.{..WB...|.i....gh46Y.Z,.a...Y.O.......ce/..{...<..l...|.uG....M..1..Ie..

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=3500000-3749999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 31 Jul 2015 15:47:17 GMT

Content-Range: bytes 3500000-3749999/3973864

Age: 2108

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: adiNsx2KlketcdAECLEfhz-qhOFs2Y61IOsWMsK2v-YtA_uU8LyT5g==

..a.....8%..............J...........*.......'...P.....C....l......p....|.4.c ..6.V....[9/|=..j.VNr....!.f^..............`....R.]....,2F~.....w9.]61..|..,Wu...77.,.ft#..~......!&N.|..mv..z.-.Io..{=.0.....,Ky.I.F.^h.......t..l..l.=,..n.X.-c.N...6?...5M.m...l.$l...h1.Q-.....3. cg.Vm...3..i1....t..H..(....Y0..P...{..M..!KBaq.,n....09.J............0....C.,....s...V.1.5.6...D...D........A`s.-.._Q^a.....C5.~.x..e^>d.$.,'r...0#.-6q..<......h.HMR.4.4]...,..x...L...V.!6..T<..D.B..-._q!!Ib.'..&C....K...[kl..C...*M*...h......../. -Y...g.UU..0..k:a....x.....<.c..........Z...fO.G..O}..8]K..........b..(..C...\....b....."..a......fF...iI."..^/.KO..2.d..?} 9.Q..^L%..#..k.`p}Y_M./....j'..h..............#..5Y.M..H-.Iu..^...#..I.*.i..2Xqx%.#..;.mZ..$.-*|.9L...f.`..;o...8..*.f./!i)T...O.Fj..NM....?ji..3gHp...(.@4.i.U.|........rG.(<d......2.........@..v|.2r....=vGXH.D..-v|..]r...?BYi......}..m....w....`KI.'...p/...q....N1.c..D.N.o......v...&%l.Y.".d..EUk......E....}......I19m&[".....~l.<.7..<.....m.........<.c..z".1........]p..tZ........?.n.x....eI....;)......,u..2...'...y.dY`xf.U...%.O&.V.D..(...V#E12....D.^jA..$Dk.T.e.>hL1..'tb3M..c,D.H=...cTsY..U_j_b...4.q.}lIh.u..3 ..a;[8.!<.....M..R.;_.:.....lr...Q..=...G.e.;O.x=F...[; ...d....d..=.t...../&.!..9\..A.=.../.A..R@_..Z"S.K. ..g....c..;!.Y.v.N..\............w.#S:..*t........T.E(.......(..Tv7..3|..b....g.|p!.....VY#.Nt.jC;)[.. ....%.q.....~L.O..pG.I...$.... 4....".....{.....H1...p..,...Q!.E..g..Q..4.8.$Y..rZQR.c.........d.L>., .....x.d...V.Pjk.U..H...

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=3750000-3973863

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 223864

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Fri, 31 Jul 2015 15:47:17 GMT

Content-Range: bytes 3750000-3973863/3973864

Age: 2108

X-Cache: Hit from cloudfront

Via: 1.1 6a9941488f8c4d7cfc9d159decc6f1d1.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ldH4rpK9sRr61dHzXCJ6LHTZMFhXQN5lOcSpruqVi2FCnVKt0NbPUw==

S....V..j...#P.....&..'.......6;.|a=...|.n:.O.<......9KOn.C_......,..1...f...m..Z......hy....E..{.q.O.A.X.`{......._.=N%.Y.R.g...K2~..q.{..:.9.<...i..00.?..4WW..L.4.&.K.1.-..L...!S.fL...i.."..R.u..........O.o.D..x...k......a...wh.h4.`.Q...."0B'.}.'.... )..:.x>H.g..~@... . ...OIj.9j_g........0.......(.s7..."..{.h4.T."...5.$r,:.i..D..%..a......OC....~k>...B.E..AdaN..S|s.iI........fi.Abp.Y.N'.c.7.9.....'.&[.......Iy.?..6..(.:.6.......4(c^oQ;.1....PRE......pn..j."ku...0...].A......),...e....HK&..N^e......Y...F-..N....k..Lh*...`....L...kU..qc....V..w...1.../.......?.<.}5j.Xyn.....)G..g....WImj.m.....H......'~.NU.Z..R.^.....)...|.V...d...M..k{.*....8......C..K.OS&q3/#.).n........_..6.t.h.j..Ob..V.gr.v r..X.2.W.^A `y..rr.pn..9'.w........._l..u#.s.w...;P...tlEf..G...g...~.I..k.../.;..|...H..s...6r.......>w...5%t.X.....9<]b......4A..,....Fhb.J..|-.}........F.C^.k...6.a..........y.@l.._..L.8.#U.........RWc3doi.zT... ."CJW...5..F.n......hN C.Z.5.%@...b|..T....o.$.b.p......X....%..yiq..6~G........Bk...E..=(...6T.<..M....9@%.yj1..}O..S.).....M...U.T.W.w:<4..aO.]....EO..*PVbz...........|..^.G. ..2...|.,.y..@.............*a.......7..YM..- ....d.....{.n.Y..Z.I.*/.u...$......4.*_L...k86.`.s.!.........7..H.' .*...T67ik2..E...x...R...×..1..5E.-..x......\J{...M!/..2s...._..J..W.dm......S..4Y.ak..V....'FK0...4...>PD6-......dn..x.F.8k. A.[..l....V..o..oH.t....Z..P.x...^..>........8......m.F?j..;.....Gb(...c.. .....q...Os.([.g=.2...^/..lV.aE.lJ..I...|...D.9....:'.Y........Z.....U...!}.".].. l.N....[

<<< skipped >>>

GET /t.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId0CN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DhvUiLCZht1Hw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTHRdsGMkr9o5Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:27 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GPS5zpVszOWAcKgy2l5q1I18fq9dH9rbCKSOpkgH81eAmQ6IkI6Z_g==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:27 GMT..X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: GPS5zpVszOWAcKgy2l5q1I18fq9dH9rbCKSOpkgH81eAmQ6IkI6Z_g==..abfgshdgfjhsk....

GET /t.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId0CN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DhvUiLCZht1Hw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTHRdsGMkr9o5Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:28 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: XhUdXgUKDnKkMo398YMHSMrTLvrVaqqmoPCHBtIeEadGB_eHQz8uig==

abfgshdgfjhsk....

GET /t.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId0CN9h bV19VSl3u293svNWe4QpoO1WcaCmF904v4t2DhvUiLCZht1Hw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTHRdsGMkr9o5Q== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:28 GMT

X-Cache: Miss from cloudfront

Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kdsxMigh8lCpYBQH6l2k_kKGbo4n51hWv4mKJt7M4x0ZknGCjZ-UtA==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:28 GMT..X-Cache: Miss from cloudfront..Via: 1.1 e13dc20cb35881b25fb296fb0383f55c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: kdsxMigh8lCpYBQH6l2k_kKGbo4n51hWv4mKJt7M4x0ZknGCjZ-UtA==..abfgshdgfjhsk..

GET /smw9476dp.exe HTTP/1.1

Range: bytes=250000-499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 250000-499999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: tHhn9zNavWyUdjUMqWV89o9xkDihAuFX4bAPWXA77fn76qTsfrILYA==

....qS..4..e....7..*.`5....X..JW..1..Y.....~oMH.h^I..4.D... SqS..........'.6..../..w'.~...g.Z..k9(FT.D*\..9..v.wUwddjAY....,.5.......<..6o.tS.....1n........%......v.).}..}.q.k.7H...V.D..HhD..t.e..NZ.yD."..^.s}....y.S......J/\5(.....E...1B8O.7g'...G#...d.....b....f...\...6......-..CU.qPz.C.......D...B}n]6.w}....W.E..h<...s .S.exKL.......$.v7..|....m.....8.......f[n.[.y...t.(2......7...;^9.Q....3S.Z..........r....|.;,...O 7`-O.t......7.-3M.94n.Ry...A.U%......`.....`(..q..i...69as^.$J.5.T.............gXy$zV.0..e.~.,B.hN.k...<.a.....@...d.Ps...@.......t.2....U...N?...~./...K.Z.....j.1.5c..R}@J....).:......^.s......D......P;y...`.L..y~r...x..V.f....Xi..J..-Fp...1...............k'y.~..m1....V..E._.L.}c....0,.....V.K5. .....f..K.ba.V...P.I@.jU?o......x.A....h.pV.I.".T....bV.?...Rs.E].H.....`....sr.9 Z'.z.=. .d.`.......0....[..P..T.7V..ROo.j...?.....>.F.D...v.?....~Qu.FI..8.ej.m~..."E..Z........ik...ssj..`.'.F..j..........8...Ad...(nn....(.*.F..s.-...4M.......$F..*..H....5'/.=....pAn..J..B.A..l)..[......h..s7j..4.\y....V...F...2cf....f'..c..\...,... `.....6}.jB.....h...^!...>......D.V..J...G....i<...3..G..H.*.....n.....X.8f..Cw....Y.UV\..,NUV0[............g.1....: .].....}g...... ..........AZv ......P..y.s.Uca.F ...8....@.y.{.....K.p.S.G.......O.jy.ej..A....Jj...,m.4..,Q8J..q..H..L...`..X./......b`._L.5:.f.4Dz.:>. ..#X...e....O..o...^.\..........g-...........2.....q..j.......|.b(6._...&O.......h..~.V..K................D...~.u..t.Y5.^]%/...0.X......A.vp4...uJ..6.h.u..>..2....6Q...A.1R......H....U

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=750000-999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 750000-999999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zMsv_oNaDfxILtjgQr-RrOZHGiwKaV7Ew3q9z_GGGfedPHWUTfSoXA==

j.%...Q.....t...U.yx6_U..\C0.i=.W8.....x.e|.....u..P......._...7..m..g.....m.#...E..JD......{.@..wU{......,K2knQ.Z1..q3{.IVL..PB).3.................me........".q...v..jqm.....,e....Z-.:...}a.v.........BV[3....6v.....U.<a5q.....:......A..!...{.k......W..U..L%..Z..cGUgs7..t... H......I..I......FN..&L..#...B..hWg9,....r.i*E.r.u.._...^.._...B3..../....R......X..i.B...<.0...DT]...}......iA..]**{..U...C)|?B....$....GK..|...Cr"...IV'..^........W.5./...'.m`..'..LI#.Us.0n.s:Hw..Ed?3...V.O.zIC..1...XT.i...\fA.&...XC.!..S_%2=..i0K....f...6...;..`..].`....$Z.^.....r!.Y.. $....Yjg......r"G....V.hk&....Z..).&b.$.[ <&..z`n.V............t.....(.c.W...`9..7&...]..=.X..461......}*...][..a.7.a.L.......S.N...M-..........Y4.......I.$C..O]..f....#.....p.....f0.8...p.Y=OP.$..nC'.:.B.....>..P..p5...D....~.2....@:..C...=..yc...s,....d..\..6.......L...}.>/...I...ab.......M........\d.G.7\.[.....k..[u.>..?t.......z..a.s.2..:Ys/}..Y....P,...//..OP...g......n(w2..*Y.....)...<......jL]p%q ..=.I.%.=M@..<....dI.|.s[..6...O.9.....%..tqZr/O .gL.)...u..O.A..CiF.gw.t3.....i.R......#....^]..Q?A.U-*........O....`T.....tj,h...a...z.j1....Xr;..\(..Y6...n....,4.Hm.B.|.,..PxU...A*...o..[?...XsjnKK.*cD....)dOQ..!.}....N.....u.i.-......W...3...T.y'd."....(....<..ww....y[L....[...J.>.O9.....)...!p...ic.f..J.M....@[.../...HC"..c.....m.. ..o.g..l..........E.....^....].^..r)% .-).j .I).SZ.c. .wtI.q..&.0....o.&......{..t..,..[2.\... x....[..".D..>W.'...c.!H.....j...ODo....w~...a1..V......mJN..J......@ .pj...3U;z,6.C.~.......9Z.

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=1250000-1499999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 1250000-1499999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: B8eNIrtvpxWagBHTOVdhOrier-3XmxE2CX7L60mCXf7KXeORPcK2uA==

.C.Q..'....._L."9 ..v..Z.y...1.............'..MZ.a!".. ..B...#.......ab.~M.i......r.>M..{_.\.v..4R.. T.x$.ai....*.BX6-.....6...)......#..?.k-....L...KF..............._.......A.H..B...P..[...~..?........;.j=.t..o?.].v..3...s..^>.FV.8.H.R.&,.}.lb....Ew./....e#n.6..@..-\.$#.........q.Cl.WRqP..h..7~c?.x.GS.lp%.!VcG...}]X.C.8Ut......e.C^...u.....W...d..z....H.4s.j.fq@0.c..R...r...<xf.6........R3...r_..J. ..y$..a"....r^.S..i5.\aD.t..Q.gk2%a...F..:.e.`...... ?.v.7{.e..f=.9.h^:^U...q..R....I...ueHA.p-.m*.k!.a........y....q.I......./......q.V....f!....M.j..............L.#.6$./.mu0..5o/....Y..#.@9.....-!d..<.\..z.....N._6...../.e....V......._.Z.5W..H.Eb...w..v.9.A..n.$x.`d.t.r.....t.Zjb....,......;..:cd_C.I....sJ..a}.$.z....F.....(C0....7a...... bp7.."j..j..1....e.q.3.....a.M...k..N.....rO.P..C.>..Q.;.....t..,...U..2ogp....M{)sod....'8..M3b..... f].d..Ae,......J.~rYX..&xqC........oo.g.Ll>.)...1Y!...6b...K.X.yk4.].....E4.r>31F.>..'$/o.,-JH&Ca..@..1..M.^B9... .....cv.UA..).D,....p.'.R..w............8.7....B..w..<..............RA....,UU...|.:.kc...l$...T.F....|..Z.oD....s.).....I..a...2...5)L.....L.Y.(....U[..xL...Y...]....=q.U.|5~..B.b..u../...#...vxZ...T.c.....2.L.........{..Z-.s.....X.av..M~F........^.....r..7.M.....;[........k.-*...m....A.7..n.WaSq.....f.ii.w... `....WODp).......].$1.z..y^..ZY.....I. ....Y..oL/...X~..q........f..8..A...y.~.....`_..!.yb.M.O..a.T...p..N..N.........h$.$.[j....v............G.:Ya.W........ .'F;Z..3....~..W4..A...b%b.....:H..x..h.UY8..X1.....".8.J...l.a...M...5....1

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=1750000-1999999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 08:35:18 GMT

Age: 2110

Content-Range: bytes 1750000-1999999/3973864

X-Cache: Hit from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zFF5ky21XHb75WhPEzmJ7hU-bLahfCk6RiVYHJMMxt9MUa2V9yY9uQ==

.nj.m.P..V..%/...x..c.....h..x..$..8.^g..V...\.{..#2..?....#..^.FL.9....@........n..X..Rf#O.....=5.9.(..i....T....Cv..-..u..i...CP..-..xk.T...m.,..V...........3.?T.....w....".....p A......3e..P.e....^.v.|.]D...D...E.... {....pC.aO.^sz:U..}..!.,.Z,....4k..l ..>....K......@..l..5..-s.==..8p..;..4..!....Jr@3..]..........%.E.P.k#.e.....n ..E....1Xs6......\S.,.....#g..n......Y.K.,4.y(...0...5............&.......<..n*w..j.1a.>/...m.B..O.....ED.Pk..F.....z....#bC.>;...t^...a..9....&.......G...R................k..IW.C..iD...j.pp3...q.=....."'........O.[....y....N.).....5..!..b..,.R..7'..2.A.[...F........E..c....u.*S)j..x ..T,...G.X...}Dd-?.Z..dm.e.......d4|.e-".}..1.r]{..L..&.. .D...%^........`...s.. ./-..QSl....VA....O 1.x..T......_......*.W.....3!...3...JS..WZ.0..H..`9i........x.1M...x.c......]6......t].1.tRX.....Y.A.r.,...`iZ..|~.x...B....98...}......g...6.......'....x>H6.|...Ko.q...-.....L.1q..=........d.L..53.x.>..;L..|B9.o....z..4...u0.l.g.<.w~.w...g..w.."......U.... .<.x@d......fxx.MQ./..F.). M\...H...>.<|!.d.AR... ......:.6.p.{v.-...9.......FI.fV....^d_`v..}....-.$.2..T.|b..7..Z.....A]@g..a.,.PDe7.............hu.......J.........*S...Q0m.d...>..o4g.>b.bo.K.-`....%.......>..z..O..}g....".rp.B>s..MAw.l.......s.c.....<a.U...G....\..t.s.e"...|q..N.Z..cW".......=.....yL.l..[..^...;Q...|(..l....8.4"......R...8=.>..B....B.~..b.Oq.@<9D....h`...WE"..~8.s.@..oy.W..`.j....u.:R.y..... .....&.o....".Z `).L.k..Y......c...R3h..Y./...\$.c}.<.....y.....0.r.E(..`hU*.[.}.q.[!..

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=2000000-2249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

Content-Range: bytes 2000000-2249999/3973864

X-Cache: Miss from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: d3vm0PPAHuvabp6iWA4XrDnSgg4Z8Ua_y9IcgDgQt9pKKR78EtXw5A==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:29 GMT..Content-Range: bytes 2000000-2249999/3973864..X-Cache: Miss from cloudfront..Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)..X-Amz-Cf-Id: d3vm0PPAHuvabp6iWA4XrDnSgg4Z8Ua_y9IcgDgQt9pKKR78EtXw5A==..E{...........D..2. A.z.Y.a.>.8..U"*..>.v.[.].K..(....K...O....0.*`.`8.Y.P...u5..c.K..1jJ.y.p[..p.9O1.y..EV..d.ds.....O..6..0.......@m.*.@ Z...J..@.x...t..hD..A.~...%..h...X..p_.V....@.n*..n..,....HG)....6...{..S..ys...#C4...&3.<...Q. ..qk7.....A...I.#..Z...1.4r..e".&.E...l.a]&.ld.kMt]`...n..\....s._.;.......MfI.....1....S......^j...s.P.......#.......W.....{.....'...*......8.QZ...w.q....a8.5..d...;....?..#...-...P....5......^j...y..I.z......W...i.[y..........F.[NO*.1..J.3...n..h.]....[........7..e`..3.}...(...;.......o..@,...6n...e Us..@[...#..Yw.e..9...$....~HN.......lZi...H.~d..O...k.....jk.}.@#...e.4.M}...V......u...s..N2.H[6.?.^......gB.;.... r.C..m.I.&...P...E.$...`t..j*..t_....L......l...1....>.|....d...dL.^.....Re&~.^.k..Y...xz..A/...].(.o....N.j..&d.<.... .7..D...rA....Y....p.|.....U.......o..z.....#.xN...e.yr.Xto.d(.9..n.....6%m..[)b.......L.Lc8F..~..J.......u...=........u..*...@.p.?....h...K..Wh[.Q6Axt.;......}......2..pv..sf.&

<<< skipped >>>

GET /smw9476dp.exe HTTP/1.1

Range: bytes=3000000-3249999

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1)

Host: d13s98z2lzti92.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 206 Partial Content

Content-Type: application/octet-stream

Content-Length: 250000

Connection: keep-alive

Cache-Control: public, max-age=3600, s-maxage=3600

Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT

Accept-Ranges: bytes

ETag: "7057cf8b2271d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:31 GMT

Content-Range: bytes 3000000-3249999/3973864

X-Cache: Miss from cloudfront

Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: vY4Ag6n4B1oTTPUm3cSDq_nrZOb5ccJKe0LDH6czcYiwxi9wJSmxlA==

HTTP/1.1 206 Partial Content..Content-Type: application/octet-stream..Content-Length: 250000..Connection: keep-alive..Cache-Control: public, max-age=3600, s-maxage=3600..Last-Modified: Tue, 07 Apr 2015 11:03:58 GMT..Accept-Ranges: bytes..ETag: "7057cf8b2271d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:31 GMT..Content-Range: bytes 3000000-3249999/3973864..X-Cache: Miss from cloudfront..Via: 1.1 761f19bc2f5721b0be0a41147e1e925f.cloudfront.net (CloudFront)..X-Amz-Cf-Id: vY4Ag6n4B1oTTPUm3cSDq_nrZOb5ccJKe0LDH6czcYiwxi9wJSmxlA==........BUPE.-4...N.(.....i.n.t.......hU"...@".*d..:...<(d-...4G2-..:..%y..cyIA...J...<.....TU.#.T.,c..\5....D..M":...Pk.H.... ..ol6$.7....k.3B.f (!.a7.....f..6C\.2eU....w.N.........1C..nQ.9F.]g/....&....$...ra .Acr0.>,.... XB.q...!,....F2..^y....R`.n1n....Q..!Q..f9tnZ..E........../7@.......#,F......M._.W.n;l.....[......'...N....j..}Hk.|...z.G"akK......6..J........x..Kj...\...Q.j.a...4.i>^..........fZ........C|.,eA......._.m....>V,..|8.......T....~.............y.7\-.]<Yx ..#..b..(....m..d...@JWw..J7.:........n.6...........o?Mu...-...h.Plh.....Q.....%..L.9....|.6^.;.].8.i..vn.h<,.{........1....X.H.8....m.w..5c...ur..!.....B......J.......8j.z'.D.".....:.b0.S...(*.3N..".p..t.....3c..!...<..Y.U............7G.(.......uyl..:..O{.-..~.[=.f.V....Z.?.I..2...m.C4...H...g.8........ ..\..A..f...m..W....?..,L.....!..r.!m.!.D.T......i](.C....a,.v{........^......s..n..".3....|..r.?n...........E.a.6.Xq..F5.(%D....9...'.....A.].8..b]...j....zt...

<<< skipped >>>

GET /t.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnnGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:28 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Z_emjyBom2af60oPSca1R-GuB2TtPFGfobUdPc2lk6nXmPqVPFTKcA==

abfgshdgfjhsk....

GET /t.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnnGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:28 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8iJO4HAASgXe4F-kPMIgfRyZbfJ56hPs3C537CVlB16BwmgMuLwzPQ==

abfgshdgfjhsk....

GET /t.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnnGxrTqW15vZAdYLC6Fwg82dCUHeR8YCF3BQ8MIYMfS0tAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JoXwql6nKegU HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1vw44q53d84jx.cloudfront.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

Content-Length: 13

Connection: keep-alive

Cache-Control: private,no-cache, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 2.0.50727

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:28 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 9fGCTiKhOJ1EvoUMW3fNThpEjdMINwvvh3SIQLEVL4VHDvOlcnUoKA==

abfgshdgfjhskHTTP/1.1 200 OK..Content-Type: text/html; charset=utf-8..Content-Length: 13..Connection: keep-alive..Cache-Control: private,no-cache, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 2.0.50727..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:28 GMT..X-Cache: Miss from cloudfront..Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 9fGCTiKhOJ1EvoUMW3fNThpEjdMINwvvh3SIQLEVL4VHDvOlcnUoKA==..abfgshdgfjhsk..

GET /20562.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnn31fTgrR12XxM0RSkMVjMOymF904v4t2DvvmEff5Szys2pDIbTJYT5/J/CZZrhHzOQI4IYW7BlwKG/8 ILd4bihRW JECizii0o6CnERxfiaF8KpepynoFA== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: UOZudYxX9FXngbsJ68vnpqHFmDyKnME1B_7GM390H1jTm78qKs1YZA==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaHfpIi4FJmsuCmF904v4t2DhvUiLCZht1Hw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTGCGrpHNYuwVpXZrelYJPLUrmhU/capljenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jnuP82lwxwVk5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: w94XBmJHVZFRlUqlELQWIS63IrzvO15NCMRzpjokAyId9X9MFqtsow==

....

GET /20562.ashx?e=1ZEnpGuz/IS8qFEAMB5m eohQc68x1qUnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jntb0/VHMr7vCQR6/4IivvmQ6Vl8CfCQOa0qDnvMWYrBzLhu0b45kiT9DzSREg8dBLdCUHeR8YCF3e0ze47pQVOJ6ui3jv/3sP3EbLWmTIe6HPSZuizlKZS4vVGidJQzQbwcX153juosly7z014jPGHi9SV3844bx1iSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: xJYiM7XPcuVNYEhn39LoJ5MaqmMJD-R0vv2t9POezQmukjOx1M2dFQ==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaF K90vWg22jgTxIUcsgQ w9JTsKksJzkc9GdOcgDY83FHRy24uRaNd5D1mYH yQN4uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45Ih H5dM8082gbd3gkmW/P8y2lP48Q7eS HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1lR9_0Lt0sT-fiOZPnYIferq2vAm1O_vOIFSs8jB-_NAiNO6rwGhiA==

....

GET /20562.ashx?e=wlkQ3WKgYpSE2rQtmh2LBCFqCkoVULC0EhGH33nPGlEeaFNcfNJ0DqkO9/DuORuprIIa1xct7ImZlZFDj59jrb4fsJSgpUeRWLazpewXw1jSN3ZRr1JhaATxIUcsgQ wUwjovawqSslao3jUdNoCSgtGEWvtHszlxMJEYs7ZuS5ps2yEEi8z4WU3OIZZQkkIvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/138tv1FDNuuLGvDVXG8fnVsUkXiRAgddMCaMVoLWI3pNMdF2wYySv2jl HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: f3RvSXx6mn4oxxvd0LLJxZvFAp8aL8a9A10q6YG65g6j5O4iwD2VkQ==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaHIEYMXrTArcgIcLERiDa7oR PSvW6ggY6bU70LkFPOglTtqlsg8UxwX6ABQ4xl C6XAmRABUbmSYRA5W RLpwIoLj8WN7CI8VJWpTUhdoetbAQhJgQ701LudQlG124a8hFOTAwlw8YFzSZwBXnH1mrxEQDokmjXJNiwPEJoNRhLg== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: z6E9CukD3SVVZoAzFf9ybRVqCBinut8axRf0ozhRBGKBBE05xnnlmA==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaGZkM9Y0jGVT9CUHeR8YCF3f2c56y21dI6CUH303iJt4o2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1UIuuKBZ3O8VIGE2by/RE6EdMmAv7FlhVU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: K93zK97U3NXIXKSifj444megbtdcEiyIZn9GksLULTTEcEIroa7Szw==

....

GET /20562.ashx?e=/k6kR j50toLjT49fHfOTMUsouUMGEFj/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRrxRGDtTxesq2/Yvk4NwwDb pZnlhr/Xf5JPYxSEah4SDHGXB7YFOPGDSJ/99oiDDxSV52Q9AtHZ4u3oGHN86wOkpZrNsvTHKpXcKSoKf7ImsTIe5wObHey9BKGIpZn1wUSPdqmKrASUuW0z4fDf/CL5icQHUvxQfe2KCefkiIqiSoA1acazRDQ3/hMAj7hCtv2fF1nx0QWILbeTSdCAAmVfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXNJnAFecfWavERAOiSaNck2LA8Qmg1GEu HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 8qAzkNZm8_VMhEIasqiPNPpMQjmM99CwXLeqLV_hXeICPJXUF6WEkw==

....

GET /20562.ashx?e=LCnUzM5l8JJBYQAernua8JIgZ/hZkBmvBZdZyFR30QH UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJuC7CJbrKtAdgKkdlz1lRoecfoMYwDyt1jgb6v7cXpPth71QQSR2eRlO8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGnXFGIInstoOr0BKAWjOuRLMDjdhw0cE/d5H pJVz7dHY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: aeEaGW0TVFNbDPfk38jhEmk8DWJXxprmHznMusNqiHvVzab1YNAOaA==

....

GET /20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRocVwJfcRD1hSQlC/zd7KOiNj5yJiER ZdFzs5z9K92np5fW7bk4OAJszSeXz WOSe2gfzOh75YrE8lTEsfACFQHDS9grIBe62ECRPbe1n4uFCo1vP TQjTAiIt/nVVNIsTqH4uNI47xgaO7LcxDP9rVhKtWJq6BTOwtTpX/QxZUjjb4jQoSuQY5U1UA3XDfdz2vKjb/PWSCkM43K3xVh7gLWnAnQ5mmjIHdeqQv5mR2zDq G/ip9Gpe8O oC9o3iBtMSIBLLUbZyt2BlybVqjeaIhCHjix9h4 8n3XkYuZ2XjZpz1sPcxp1I3nypnKAJJwSlVcxDMMid7CGwBqpnIsOpo/lEjpeAlBzFcuANGYcs6QVPVP6/3bDcr4ZRnoqTVQi64oFnc7xUgYTZvL9EToR0yYC/sWWFVQ== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: lslO1UHYBsQzB1LBqQh2Ry1d8rA6Z7alrpds7Mr7g-mGqTg9R-mYaQ==

....

GET /20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRoTp7ys67qImnFAL52sIXt4XOSMm4SbI/lC36 lBzVeTnLb9RQzbrixrw1VxvH51bFJF4kQIHXTAmjFaC1iN6TTGCGrpHNYuwVpXZrelYJPLUrmhU/capljenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jnuP82lwxwVk5 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: a638R6LrxNFcw0uPmLoYXF5RsWChrok_mO7Yz-si-BwYUvit_09MRw==

....

GET /20562.ashx?e=aQQpsP6/AW3r A4x0AgNXQkKiNdCtAY0fR8JhGQq6w6my6t0 u4xzY1hNpWaoDmrUA7dl9owwhIeI9VTThLJ3WHdlFkLrYlp5ky8ZFOSMDojIAymbLlVLqEmwQdahDDEWMnNHFDGURlppntfSkzarwlSZ jhSjr174r1XQZFERLb/7 kcvPCjjpeJfJMiPTs0JQd5HxgIXd/dqaEYXgO73YWWt VIUUiVtB8erRBUEN8bIP/mOIFyySWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: -bOU92WFUaJyocM2csZ-VrHI3iFiTN6qsNg5FntNzsT6vB_O1_ndSg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:30 GMT..X-Cache: Miss from cloudfront..Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: -bOU92WFUaJyocM2csZ-VrHI3iFiTN6qsNg5FntNzsT6vB_O1_ndSg==......

GET /20562.ashx?e=hpY1rXLYst6pJ45fVU/vC5IgZ/hZkBmvpR2TVTgkNkv UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJu3dmSpkOIyZgKkdlz1lRofr/zw3mMKgg0JQd5HxgIXdXSs 69z5tFbQfHq0QVBDfGyD/5jiBcsklpIg/vGiFhQGw7w7bWmjz7d9KaLD84/d0InrHGn4CTEJJ99zQJTqVYgO0yHAHEsYAqi 8bJ4kL0puLqbigJGvFEYO1PF6yrb9i Tg3DANv6lmeWGv9d/bSJGWd2CgPQ= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:19 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZqSFdni1oYuPuzmq8nWQNsRg9rqouBx2wonJbMzyL5o0UgEyPgtVnw==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:21:19 GMT..X-Cache: Miss from cloudfront..Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: ZqSFdni1oYuPuzmq8nWQNsRg9rqouBx2wonJbMzyL5o0UgEyPgtVnw==..

GET /20796.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId61yMTX l/6f1Gg4F6dkBzXUfBgwh1qVrevysBL0IwHwhEolvsKoHiSTZUc6Aooj3S5MYXZwv0Sa2 GUfuos17apw1GQ93goy8ou0ipnPyAcboqKFmkaACc= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: GyZbTzq4FgwZEbgJ2U7bn5HbtIrhCMk7sFOnpSgPbN5WEbrLjWVy2A==

....

GET /20796.ashx?e=984e31dVhw2IItTUp4SEbVK5xsmmdXCgIM0CqmsRfbtxTYwWxYG9WM2wWArmgLQL/Xh/Lw8se/x9ExtN21tId61yMTX l/6f1Gg4F6dkBzXUfBgwh1qVrROUvSdX2iqnJyMz45O1xrVtQeXCcg/Fhy2/UUM264sa8NVcbx dWxSReJECB10wJoxWgtYjek0x0XbBjJK/aOU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:28 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7bPfLFbgq6u1oL8ukELTXzpApvls63VGz4YZUFLd1KLa-kbC_YMbNg==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:28 GMT..X-Cache: Miss from cloudfront..Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 7bPfLFbgq6u1oL8ukELTXzpApvls63VGz4YZUFLd1KLa-kbC_YMbNg==......

GET /20796.ashx?e=WL9usJOVMsOEyHZoFFyrCIgi1NSnhIRtzV/Chxyj66IgzQKqaxF9uzTxsSAVFvckt57skbJUfWVF1v9LxgoeQ9yvhlGeipNVCLrigWdzvFSBhNm8v0ROhLLipWZqHf8IqQ738O45G6msghrXFy3siZmVkUOPn2OtThCloTbvSUl6p84vT1Zqrte3upwN8WEnBPEhRyyBD7Atar3 MoOYAPOdwOXGhKOjxNB9hPvytbqj4mEVVTCsv8oowH443v5LVMzzGZXi flruyvHL/XTRfTbXnzkx FKHdtdgGHkZrI4k4Gm5vvSsuzTRIAKy2bwBHOGiVhEyNAUE4HFIsoj2A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: RolI_J8V5dcwY2mxriMkVa2gptTJLLvCtGC3X9OZp13RYeoSSugpxQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..Server: Microsoft-IIS/7.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:21:14 GMT..X-Cache: Miss from cloudfront..Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: RolI_J8V5dcwY2mxriMkVa2gptTJLLvCtGC3X9OZp13RYeoSSugpxQ==..

GET /20562.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnn31fTgrR12XxM0RSkMVjMOymF904v4t2DabdTvoymw9KK4MgXxLfL0mbYzuTjyH4oXoF8LoF/2KSZWL4xrVwJ Tcdxp90tK97Pw/oEGC9XXA6wiCB0lzNhV gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 6lNFTO2m1uYhtAfaMlQCLlmSUlsDFqkY_qDdYYBoRC9jMKQzM9dzWw==

....

GET /20562.ashx?e=hNMAVKhukrzsUPBzNrhZoSFqCkoVULC0EhGH33nPGlEeaFNcfNJ0Dunq2YUwWYcGp2RYIisGWDtlUrzhzYzRp1xRiCJ7LaDq9ASgFozrkSzA43YcNHBP3Yuzb88XdQvFzbBYCuaAtAv9eH8vDyx7/Honl HFURaiQI32H5tXX1UeMZiMaXQ3mwTxIUcsgQ wzdQpwoYb2d0uTGF2cL9EmtvhlH7qLNe2qcNRkPd4KMvKLtIqZz8gHAuCtKRlIVo2d3 uKF6e7H0PCo jLvL970WABgPsiU45Ih H5dM8082gbd3gkmW/P8y2lP48Q7eS HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:14 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: SJ2ZWykfYion2CUWc9sqYXhDls3TsWvEto-rwvUm5XyWpJC7kviV_w==

....

GET /20562.ashx?e=yhrBLBbZM9ULjT49fHfOTMUsouUMGEFj/Dn8i7qp5mAHqUQ0J3/4ExTjoJMNpFu8dgDmh3IR/ta4K/dUih2JNrjE5q6KYAnn31fTgrR12XxM0RSkMVjMOymF904v4t2DZ0d7GEGeHAhiVQeEeICkE1 gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFmOdeW8Cm Pw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pUdNKRJ4JdETp78RSokArBdjFLUqZWDzAYvK4L-fcz3MWqiQUOBJYQ==

....

GET /20562.ashx?e=1ZEnpGuz/IS8qFEAMB5m eohQc68x1qUnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jntb0/VHMr7vCQR6/4IivvmQ6Vl8CfCQOa0qDnvMWYrBzLhu0b45kiT9T0skxmwV AvCKQhXfcYgO0JQd5HxgIXedTURWNEvv0HQBxTzK/bEJeNU2AyMdjD18IrcehD2XgC2UN26wBWmmzu CJ82QPHPcr4ZRnoqTVQi64oFnc7xUgYTZvL9EToSWMP/TO6/VdV gAUOMZfgulwJkQAVG5kmEQOVvkS6cCKC4/FjewiPFSVqU1IXaHrWwEISYEO9NS7nUJRtduGvIRTkwMJcPGBc0mcAV5x9Zq8REA6JJo1yTYsDxCaDUYS4= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 98pOeG5IEazhMm_exHOhkxrO7OiX48pIWX5Qq3jeEM7UIK6XphPtpA==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaETVDNBVYCm8jEzQGoF c24WnZlMkE cTWzrf1vX5AkfSSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:29 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Wwv2aJMj6j3a2epjRZa07SfaGM_Ak6rNwtC_o7okhR4bWEH2irRjCA==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaFteqZ6txLbCymF904v4t2Dnog6XUlbewcH2RZLt1dnp6UixEX0xfzw4HtieZnm 5lfoAFDjGX4LpcCZEAFRuZJhEDlb5EunAiguPxY3sIjxUlalNSF2h61sBCEmBDvTUu51CUbXbhryEU5MDCXDxgXNJnAFecfWavERAOiSaNck2LA8Qmg1GEu HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: gMHzPSQU0LLL8SLbBo_y-dWOf3StRX8G0lnSxxSJNYthLw7gubyPRQ==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaEUAuICjN6dOdCUHeR8YCF3bJ OTVC78tU3Oou6/0cDl ITGL7aiC8Hk2dyYR17VYOC5WBoetiu1UCOCGFuwZcChv/PiC3eG4oUVviRAos4otKOgpxEcX4mOWTBRoXJJz/rKwD6t b1ZR4j1VNOEsndYd2UWQutiWnmTLxkU5IwOiMgDKZsuVUutGrrh2gDrzw= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 1efxfEqeQf33_9ggg0DyZaciFlJHMnu_Qar_7yczN1vn54vwwjwH7w==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaEVp nOsv5TlY4G r 3F6T7Gp4nBQBFoDDmrGuxvJf88SSWkiD 8aIWFAbDvDttaaPPt30posPzj93QiescafgJMQkn33NAlOpViA7TIcAcSxgCqL7xsniQvSm4upuKAka8URg7U8XrKtv2L5ODcMA2/qWZ5Ya/139tIkZZ3YKA9A== HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: k3tj3Es-wRkxgL6EQ89Arma0IAM1GqgAjLET0-1mqzc72WRYhYnCSQ==

....

GET /20562.ashx?e=rU8wGwYGlBSSIGf4WZAZrwWXWchUd9EB/lCDRYG1zoqEh7ps0SQ7EYzpbjeDHyvNqJDnlUORNKJFgAYD7IlOOSIfh XTPNPNoG3d4JJlvz JaMFDSAS9NUEt4u7lqt3sq6UdGbdlf3mNrz qY3apibguwiW6yrQHYCpHZc9ZUaGw5VIziNxXAbPiCC4paVhd8zSuMIYUMvmPdyAxw9rrTY2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1UIuuKBZ3O8VIGE2by/RE6EdMmAv7FlhVU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:15 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 7VqU4zvTrCe99SuoyRMDq_4h9ojQnUWqhBvHa97r-Ek-VstH_OLuGA==

....

GET /20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRoY09ECF87Zuss IILilpWF1SqCHr/94rW31vzipeVYvpr maR6b3/MexiezSykY/Z1O8xmMRVWZOb7j5JAyiJ5DwvGnwcuiCjBHn3WtPO7TkPk55LBQN29raE2JuypHmFWVSvOHNjNGnXFGIInstoOr0BKAWjOuRLMDjdhw0cE/d5H pJVz7dHY= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: PBRowSUuX3_5Z-TnWN6rM0JdE4w4QmJKSbBk92RmfcHbwRxUqMXGXQ==

....

GET /20562.ashx?e=lOCrbsNL2zX5PxLbQh95wJIgZ/hZkBmv0SqX9cxKIX3 UINFgbXOioSHumzRJDsRjOluN4MfK82okOeVQ5E0okWABgPsiU45Ih H5dM8082gbd3gkmW/P4lowUNIBL01QS3i7uWq3eyrpR0Zt2V/eY2vP6pjdqmJsW6hfxoB1BlgKkdlz1lRoVez2xuA6YrxdKm30ZIdZdA/6UnSy/9g5ij9W2jsh ZY4cGjsXTcXKxAjghhbsGXAob/z4gt3huKFFb4kQKLOKLSjoKcRHF JjlkwUaFySc/6ysA rfm9WUeI9VTThLJ3WHdlFkLrYlp5ky8ZFOSMDojIAymbLlVLrRq64doA688 HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:21:16 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZdY1xJMUcvpHnNJWIa1OfSfGS-ZLFl2RsPyG6e3pTecc4vqcH_VNfg==

....

GET /20562.ashx?e=QgW8pN5r26ZQhScA1jb3T9hvrckiab6TnvZi s3jtzH3VPP0BYZZ/JwQnkcbjmdiLntfO9v5CwenNguChnjFYzt M28QGSS9N6C2eClTp77KbbFcYG jntb0/VHMr7vCQR6/4IivvmQ6Vl8CfCQOa0qDnvMWYrBzX4l9XCm/Va/aaY YTEt5Uvbfo/lsLEXHKYX3Ti/i3YPQYtVwkpxW0sTQfYT78rW6o JhFVUwrL/KKMB ON7 S1TM8xmV4vn5a7srxy/100X021585MfhSh3bXYBh5GayOJOBpub70rLs00SACstm8ARzholYRMjQFBOBxSLKI9g= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:30 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: ZQgdPAEmmRxFLWYIjMnHX1pg5NqjcXde6gRTaQdKiweHhR-Xq1dD_g==

....

GET /20562.ashx?e=aQQpsP6/AW0LjT49fHfOTLRL99D6Mq5n/Dn8i7qp5mB38psj3UbutFu0ICSu0QOYghmiZJc6KBe9Kbi6m4oCRrxRGDtTxesq2/Yvk4NwwDb pZnlhr/Xf5JPYxSEah4SDHGXB7YFOPGDSJ/99oiDDxSV52Q9AtHZ333RAvM0VMCx2KlVs8m8LqSlVGmgAnwDs8HdD6KPa6/vhHB5/UxRfI2ac9bD3MadSN58qZygCScEpVXMQzDInewhsAaqZyLDqaP5RI6XgJQcxXLgDRmHLOkFT1T v92w3K GUZ6Kk1UIuuKBZ3O8VIGE2by/RE6EdMmAv7FlhVU= HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.1)

Host: d1cfk8e4o0c4u2.cloudfront.net

HTTP/1.1 200 OK

Content-Length: 0

Connection: keep-alive

Cache-Control: private, no-store

Server: Microsoft-IIS/8.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Sat, 01 Aug 2015 09:10:31 GMT

X-Cache: Miss from cloudfront

Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4GKtn8y5_jtpYv3yoVL6rVfGDqcWLIwTPlSKhnFIc__U4JQGfvqMMQ==

HTTP/1.1 200 OK..Content-Length: 0..Connection: keep-alive..Cache-Control: private, no-store..Server: Microsoft-IIS/8.5..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: Sat, 01 Aug 2015 09:10:31 GMT..X-Cache: Miss from cloudfront..Via: 1.1 1f3fb60768611bd03244cf06312d5a9c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 4GKtn8y5_jtpYv3yoVL6rVfGDqcWLIwTPlSKhnFIc__U4JQGfvqMMQ==..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_856:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

D$@j.Xf

D$@j.Xf

OtSSh

OtSSh

VQSSh

VQSSh

PSSSSSSh

PSSSSSSh

t!SSh

t!SSh

PSSSSh

PSSSSh

j.Yf;

j.Yf;

_tcPVj@

_tcPVj@

.PjRW

.PjRW

broken pipe

broken pipe

inappropriate io control operation

inappropriate io control operation

not supported

not supported

operation in progress

operation in progress

operation not permitted

operation not permitted

operation not supported

operation not supported

operation would block

operation would block

protocol not supported

protocol not supported

function not supported

function not supported

operation canceled

operation canceled

address_family_not_supported

address_family_not_supported

operation_in_progress

operation_in_progress

operation_not_supported

operation_not_supported

protocol_not_supported

protocol_not_supported

operation_would_block

operation_would_block

address family not supported

address family not supported

operator

operator

GetProcessWindowStation

GetProcessWindowStation

dbghelp.dll

dbghelp.dll

%Y-%m-%dT%H:%M:%SZ

%Y-%m-%dT%H:%M:%SZ

1.3.6.1.4.1.311.2.1.12

1.3.6.1.4.1.311.2.1.12

Cannot put the trigger ID: %x

Cannot put the trigger ID: %x

{X-hX-hX-XX-XXXXXX}

{X-hX-hX-XX-XXXXXX}

Host Name: %s

Host Name: %s

Domain Name: %s

Domain Name: %s

DHCP scope name: %s

DHCP scope name: %s

GetNetworkParams failed with error: %d

GetNetworkParams failed with error: %d

WinHttpGetIEProxyConfigForCurrentUser failed with the following error number:

WinHttpGetIEProxyConfigForCurrentUser failed with the following error number:

ERROR_WINHTTP_INTERNAL_ERROR

ERROR_WINHTTP_INTERNAL_ERROR

AutoConfigURL (MyProxyConfig.lpszAutoConfigUrl) is:

AutoConfigURL (MyProxyConfig.lpszAutoConfigUrl) is:

AutoConfigURL (MyProxyConfig.lpszProxy) is:

AutoConfigURL (MyProxyConfig.lpszProxy) is:

AutoConfigURL (is:

AutoConfigURL (is:

550e832f-a497-4eb7-bb40-8cc856f6d152

550e832f-a497-4eb7-bb40-8cc856f6d152

RegCreateKeyTransactedW

RegCreateKeyTransactedW

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

RegDeleteKeyExW

C:\BUILDS\Build_STUB\Installer\Release_YTDK\YTDKi.pdb

C:\BUILDS\Build_STUB\Installer\Release_YTDK\YTDKi.pdb

GetProcessHeap

GetProcessHeap

KERNEL32.dll

KERNEL32.dll

EnumThreadWindows

EnumThreadWindows

EnumChildWindows

EnumChildWindows

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjectsEx

GetKeyboardLayoutList

GetKeyboardLayoutList

USER32.dll

USER32.dll

WS2_32.dll

WS2_32.dll

GDI32.dll

GDI32.dll

RegOpenKeyExW

RegOpenKeyExW

RegEnumKeyW

RegEnumKeyW

RegCloseKey

RegCloseKey

RegCreateKeyExW

RegCreateKeyExW

RegDeleteKeyW

RegDeleteKeyW

RegQueryInfoKeyW

RegQueryInfoKeyW

RegEnumKeyExW

RegEnumKeyExW

RegOpenKeyW

RegOpenKeyW

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

ADVAPI32.dll

ADVAPI32.dll

ShellExecuteExW

ShellExecuteExW

ShellExecuteW

ShellExecuteW

SHELL32.dll

SHELL32.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

OLEACC.dll

OLEACC.dll

COMCTL32.dll

COMCTL32.dll

PSAPI.DLL

PSAPI.DLL

CryptMsgClose

CryptMsgClose

CertGetNameStringW

CertGetNameStringW

CertFreeCertificateContext

CertFreeCertificateContext

CertFindCertificateInStore

CertFindCertificateInStore

CertCloseStore

CertCloseStore

CryptMsgGetParam

CryptMsgGetParam

CRYPT32.dll

CRYPT32.dll

VERSION.dll

VERSION.dll

GetExtendedTcpTable

GetExtendedTcpTable

IPHLPAPI.DLL

IPHLPAPI.DLL

WinHttpGetIEProxyConfigForCurrentUser

WinHttpGetIEProxyConfigForCurrentUser

WINHTTP.dll

WINHTTP.dll

SHFileOperationW

SHFileOperationW

RPCRT4.dll

RPCRT4.dll

HttpSendRequestExW

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestW

HttpAddRequestHeadersW

HttpAddRequestHeadersW

HttpQueryInfoW

HttpQueryInfoW

HttpOpenRequestW

HttpOpenRequestW

HttpEndRequestW

HttpEndRequestW

WININET.dll

WININET.dll

GetCPInfo

GetCPInfo

zcÁ

zcÁ

.?AVChromeBrowserWindow@@

.?AVChromeBrowserWindow@@

.?AVFirefoxBrowserWindow@@

.?AVFirefoxBrowserWindow@@

.?AVOperaBrowserWindow@@

.?AVOperaBrowserWindow@@

.?AVCHttpFileDownload@@

.?AVCHttpFileDownload@@

.?AVCHttpAsync@@

.?AVCHttpAsync@@

.?AVCHttpDownload@@

.?AVCHttpDownload@@

.?AVCHttp@@

.?AVCHttp@@

222222222

222222222

55555.ccc

55555.ccc

22222222

22222222

22222222222

22222222222

2222222222

2222222222

222222222222

222222222222

))aaaaaaaaaaaaa555555.7.??.cccccccAAAAAAAAAAAAA

))aaaaaaaaaaaaa555555.7.??.cccccccAAAAAAAAAAAAA

2222222

2222222

..ccc

..ccc

5.77..Lc7cEEcc7AAATE

5.77..Lc7cEEcc7AAATE

|444|44|4

|444|44|4

||||4|444

||||4|444

MM.LJ

MM.LJ

MMM)MMBMBMBB???BBB??..?....L7.LLLEEEEEATAT

MMM)MMBMBMBB???BBB??..?....L7.LLLEEEEEATAT

CMIC.CF?

CMIC.CF?

@@,,@@,@@@@

@@,,@@,@@@@

**,,,,@,,@@,,

**,,,,@,,@@,,

MMMMMBB???.BB?.7??.7.7LL7.7ELLELL7ETAETTTTT

MMMMMBB???.BB?.7??.7.7LL7.7ELLELL7ETAETTTTT

@@,,@,,,,

@@,,@,,,,

MMBB???B?.......777.?.LLLLLLLETT

MMBB???B?.......777.?.LLLLLLLETT

,,@,,,*,,,*

,,@,,,*,,,*

.hsdy>

.hsdy>

,,,,*,,***

,,,,*,,***

,,,@@,**,,,

,,,@@,**,,,

MBMBBBBBB??????.B??.7c.77.LELL7LEEEL7E

MBMBBBBBB??????.B??.7c.77.LELL7LEEEL7E

,,****,*

,,****,*

MBMB??BBB???????...??777..LLEL7LAEEcAAATT

MBMB??BBB???????...??777..LLEL7LAEEcAAATT

,**,,****

,**,,****

B???...7.7.777LLLL7ELAAAAAATAA

B???...7.7.777LLLL7ELAAAAAATAA

BB?.??.....?..LLLELEAAcEAEET

BB?.??.....?..LLLELEAAcEAEET

# #

# #

B??BBMBB???BB....7777L7.LAATTELE

B??BBMBB???BB....7777L7.LAATTELE

111111111

111111111

11111111111

11111111111

BBMB?BB????...777.LLLL7LLAET

BBMB?BB????...777.LLLL7LLAET

BB?.?.BBB???...LL7.77LLEEEEELTTTT

BB?.?.BBB???...LL7.77LLEEEEELTTTT

RRVVw%%X

RRVVw%%X

# #1111

# #1111

BB??..77.7777.777EAEELELET

BB??..77.7777.777EAEELELET

1111111

1111111

11111111

11111111

B??BB??..?..7..7L..LLLL

B??BB??..?..7..7L..LLLL

B??B?.B?......?..7.LL7LL

B??B?.B?......?..7.LL7LL

B??.?......LLL..

B??.?......LLL..

BB.....77.7LLL..LLEE

BB.....77.7LLL..LLEE

MBB??????.7.77.777L

MBB??????.7.77.777L

MMBMMB..????....777.LEEE

MMBMMB..????....777.LEEE

??7.7.LLLL7LETL

??7.7.LLLL7LETL

8888888

8888888

BB.BB?........L77L

BB.BB?........L77L

BMMB?B?....777.7.7.EEL

BMMB?B?....777.7.7.EEL

BBB.?B.77.......ETEE

BBB.?B.77.......ETEE

BB.BB........7LLETTT

BB.BB........7LLETTT

88888888

88888888

B???BB..BB?..7LLLT

B???BB..BB?..7LLLT

BB.??BB..BB..7777L

BB.??BB..BB..7777L

B???????BB.?...LLLL7

B???????BB.?...LLLL7

BMB..BB.7.ELLLL77L

BMB..BB.7.ELLLL77L

BBB??BB.?.LLLL77.

BBB??BB.?.LLLL77.

888888888

888888888

MBB?....B...cLLLLLLT

MBB?....B...cLLLLLLT

___&_&&&

___&_&&&

__&&____&

__&&____&

____&___&&

____&___&&

____&__&_&

____&__&_&

BM?.BBB?....777L

BM?.BBB?....777L

&&____&__&&__&&____

&&____&__&&__&&____

_&_&&_&&

_&_&&_&&

.njm4tyyxwwwwxyytm3k.

.njm4tyyxwwwwxyytm3k.

\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author udif}{\operator Edith}{\creatim\yr2013\mo10\dy22\hr16\min58}{\revtim\yr2014\mo8\dy24\hr14\min26}{\version5}{\edmins16}{\nofpages4}

\mbrkBinSub0\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author udif}{\operator Edith}{\creatim\yr2013\mo10\dy22\hr16\min58}{\revtim\yr2014\mo8\dy24\hr14\min26}{\version5}{\edmins16}{\nofpages4}

{\nofwords2316}{\nofchars13206}{\nofcharsws15492}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1440\margb1440\gutter0\ltrsect

{\nofwords2316}{\nofchars13206}{\nofcharsws15492}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1440\margb1440\gutter0\ltrsect

The following license and terms of use (jointly: "Terms of Use") govern your access and use of the YTDownloader.com website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and

The following license and terms of use (jointly: "Terms of Use") govern your access and use of the YTDownloader.com website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and

ll Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, tools and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally b

ll Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, tools and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally b

ive websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of Use limit our liability and that we do not provide warranties for YTDownloader or contents. It also limits your remedies.}{\rtlch\fcs1

ive websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of Use limit our liability and that we do not provide warranties for YTDownloader or contents. It also limits your remedies.}{\rtlch\fcs1

lely for your private and personal purposes and always in accordance with the Terms and Use and the applicable law. Any other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons

lely for your private and personal purposes and always in accordance with the Terms and Use and the applicable law. Any other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons

is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or otherwise act in a way that interferes with other users\rquote

is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or otherwise act in a way that interferes with other users\rquote

verse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents or materials on or received via YTDownloader without our prior written consent. You also agree to not remove, obscure, or alter any copyrig

verse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents or materials on or received via YTDownloader without our prior written consent. You also agree to not remove, obscure, or alter any copyrig

TDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update the YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exerc

TDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update the YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exerc

\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 HYPERLINK "mailto:}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\~}{\field{\*\fldinst {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 HYPERLINK "mailto:}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect

\f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect

the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own discretion and at your own ri

the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own discretion and at your own ri

\par }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid1449721\charrsid1449721 YTDownloader includes certain marks, graphics, logos, page headers,

\par }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid1449721\charrsid1449721 YTDownloader includes certain marks, graphics, logos, page headers,

, licensors, suppliers and their respective directors, employees, agents a}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid3632102 nd shareholders (jointly: the "}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

, licensors, suppliers and their respective directors, employees, agents a}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\cf1\insrsid3632102 nd shareholders (jointly: the "}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

s to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warranties and liability regarding the accuracy, completeness, security, reliability, timelin

s to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warranties and liability regarding the accuracy, completeness, security, reliability, timelin

ss, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties, so the above exclusions in whole or in part may not apply to you in your country or j

ss, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties, so the above exclusions in whole or in part may not apply to you in your country or j

nder applicable law, in no event shall the Goobzo parties be liable for any damage whatsoever including but not limited to any direct, indirect, consequential, special, exemplary, punitive or incidental damages (including but not limited to damages for lo

nder applicable law, in no event shall the Goobzo parties be liable for any damage whatsoever including but not limited to any direct, indirect, consequential, special, exemplary, punitive or incidental damages (including but not limited to damages for lo

s of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, contract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointl

s of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, contract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointl

urisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your country or jurisdiction and in such case the aggregate liability of the Goobzo parties shall

urisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your country or jurisdiction and in such case the aggregate liability of the Goobzo parties shall

responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses caused by such member.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses caused by such member.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

You may create links to this Site from other websites in as much as it is clear that we do not endorse you or your activity, business, products or services and that you and us are not affiliated in any way.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

You may create links to this Site from other websites in as much as it is clear that we do not endorse you or your activity, business, products or services and that you and us are not affiliated in any way.\line }{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102\charrsid3632102 support@ytdownloader.com}{\rtlch\fcs1 \af1\afs20 \ltrch\fcs0 \f31507\fs20\insrsid3632102 " }}{\fldrslt {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect\linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sectrsid8879180\sftnbj {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\cs18\f31507\fs20\ul\cf2\insrsid3632102\charrsid16527760 support@ytdownloader.com}}}\sectd \ltrsect\linex0\headery708\footery708\colsx708\endnhere\sectlinegrid360\sectdefaultcl\sectrsid8879180\sftnbj {\rtlch\fcs1 \af1\afs20 \ltrch\fcs0

\sbasedon0 \snext17 \sunhideused \styrsid5573618 Normal (Web);}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \spriority0 \styrsid5573618 apple-converted-space;}{\*\cs19 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf2

\sbasedon0 \snext17 \sunhideused \styrsid5573618 Normal (Web);}{\*\cs18 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \sbasedon10 \spriority0 \styrsid5573618 apple-converted-space;}{\*\cs19 \additive \rtlch\fcs1 \af0 \ltrch\fcs0 \ul\cf2

\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Edith}{\operator Edith}{\creatim\yr2014\mo3\dy24\hr8\min26}{\revtim\yr2014\mo10\dy27\hr12}{\version22}{\edmins1585}{\nofpages3}{\nofwords2318}

\msmallFrac0\mdispDef1\mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Edith}{\operator Edith}{\creatim\yr2014\mo3\dy24\hr8\min26}{\revtim\yr2014\mo10\dy27\hr12}{\version22}{\edmins1585}{\nofpages3}{\nofwords2318}

{\nofchars13216}{\nofcharsws15503}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt568\margb1440\gutter0\ltrsect

{\nofchars13216}{\nofcharsws15503}{\vern57437}}{\*\xmlnstbl {\xmlns1 hXXp://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1800\margr1800\margt568\margb1440\gutter0\ltrsect

\b\f40\fs16\insrsid11944020\charrsid14186020 \line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid14186020 1. Acceptance of Terms of Use\line The following license and terms of use (jointly: "Terms of Use") go}{\rtlch\fcs1

\b\f40\fs16\insrsid11944020\charrsid14186020 \line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid14186020 1. Acceptance of Terms of Use\line The following license and terms of use (jointly: "Terms of Use") go}{\rtlch\fcs1

website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and all Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, t

website ("Site") and your download, install, access and use of the YTDownloader Browser Application and Add-On ("YTDownloader Add-On") and all Site and YTDownloader Add-On contained or displayed information, and any and all available editions, add-ins, t

ols and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally binding agreement between you, ("you", "visitor" and/or "user"), and Goobzo Ltd. and its affiliates and subsidiaries

ols and documentations, either jointly or separately (collectively and separately known as "YTDownloader"). The Terms of Use are a legally binding agreement between you, ("you", "visitor" and/or "user"), and Goobzo Ltd. and its affiliates and subsidiaries

r or parts thereof at our sole discretion and without liability. The products and services described on YTDownloader (and their respective websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of U

r or parts thereof at our sole discretion and without liability. The products and services described on YTDownloader (and their respective websites) are each subject to their respective terms and conditions or agreements. Please note that these Terms of U

ny other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or o

ny other use is prohibited. The use of any software or automated system to extract data from YTDownloader.com or the YTDownloader Add-Ons is strictly prohibited. You will not disrupt the functioning of the YTDownloader.com or the YTDownloader Add-Ons or o

py, modify, adapt, distribute, transmit, translate, display or otherwise exploit YTDownloader and you shall not try to reverse engineer, reverse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents

py, modify, adapt, distribute, transmit, translate, display or otherwise exploit YTDownloader and you shall not try to reverse engineer, reverse assemble, reverse compile, decompile, disassemble, translate or otherwise alter any executable code, contents

ith or through the Site. We reserve all rights not expressly granted in and to the Site. We reserve the right to terminate your access to YTDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update th

ith or through the Site. We reserve all rights not expressly granted in and to the Site. We reserve the right to terminate your access to YTDownloader temporarily or permanently, with or without notice to you, and are not obligated to support or update th

YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exercise our right to modify or terminate access to the YTDownloader service. Unless explicitly stated otherwise, any new

YTDownloader service. You acknowledge and agree that YTDownloader will not be liable to you or any third party in the event that we exercise our right to modify or terminate access to the YTDownloader service. Unless explicitly stated otherwise, any new

support@ytdownloader.com}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3606027 " }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3886136 {\*\datafield

support@ytdownloader.com}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3606027 " }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid3886136 {\*\datafield

0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid3606027\charrsid2648633 support@ytdownloader.com}}}\sectd \ltrsect

0000a5ab0000}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid3606027\charrsid2648633 support@ytdownloader.com}}}\sectd \ltrsect

looking statements made on the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own di

looking statements made on the Site are based on our best judgment but are subject to a number of uncertainties as well as events beyond our control. You understand and agree that your access and use of the Site and its contents is entirely at your own di

\f40\fs16\cf1\insrsid11944020\charrsid14186020 . Trademarks\line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid425254 YTDownloader includes certain mark

\f40\fs16\cf1\insrsid11944020\charrsid14186020 . Trademarks\line }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid425254 YTDownloader includes certain mark

and personal use only with no warranties whatsoever. Goobzo, its affiliates, partners, licensors, suppliers and their respective directors, employees, agents and shareholders (jointly: the " Goobzo parties") do not assume any liability whatsoever and disc

and personal use only with no warranties whatsoever. Goobzo, its affiliates, partners, licensors, suppliers and their respective directors, employees, agents and shareholders (jointly: the " Goobzo parties") do not assume any liability whatsoever and disc

loader and included services and contents, including, without limitation, warranties as to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warrant

loader and included services and contents, including, without limitation, warranties as to accuracy, performance, merchantability, fitness for a particular purpose, and non-infringement. The Goobzo parties, jointly and severally, also disclaim any warrant

es and liability regarding the accuracy, completeness, security, reliability, timeliness, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties,

es and liability regarding the accuracy, completeness, security, reliability, timeliness, and performance of the YTDownloader, services and contents. Some countries and jurisdictions do not allow the exclusion or disclaimer of certain terms or warranties,

, exemplary, punitive or incidental damages (including but not limited to damages for loss of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, co

, exemplary, punitive or incidental damages (including but not limited to damages for loss of income or profits, business interruption, loss of business information, loss of goodwill or reputation, and the like) whether such claim is based on warranty, co

tract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointly or separately, have been advised of the possibility of such damages or loss. Such limitation of liability shall also apply whether the damages arise from use, misuse

tract, tort (including negligence), or otherwise, and even if the Goobzo parties, jointly or separately, have been advised of the possibility of such damages or loss. Such limitation of liability shall also apply whether the damages arise from use, misuse

t of personal injury or death arising from the negligence of Goobzo. Some countries and jurisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your cou

t of personal injury or death arising from the negligence of Goobzo. Some countries and jurisdictions do not allow the exclusion or disclaimer or limitation of liability of certain types of damages, so the above exclusions may not apply to you in your cou

While these limitations of liability provisions use the Goobzo parties definition, the responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses ca

While these limitations of liability provisions use the Goobzo parties definition, the responsibilities and liabilities are not on a joint and several basis (i.e. each member of the Goobzo parties shall be solely responsible for the damages and losses ca

\par 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid14186020 . Links to this Site\line You may create links to this Site from other websites in a

\par 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020 1}{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\cf1\insrsid11944020\charrsid14186020 . Links to this Site\line You may create links to this Site from other websites in a

Failure or delay of Goobzo exercise any right, power or remedy under or to require or enforce strict performance by you of any provision of th

Failure or delay of Goobzo exercise any right, power or remedy under or to require or enforce strict performance by you of any provision of th

\ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 HYPERLINK "mailto:support@YTDownloader.com" }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 {\*\datafield

\ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 HYPERLINK "mailto:support@YTDownloader.com" }{\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \f40\fs16\insrsid11944020\charrsid413544 {\*\datafield

0000a5ab00000066000100d9}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid11944020\charrsid413544 support@YTDownloader.com}}}\sectd \ltrsect

0000a5ab00000066000100d9}}}{\fldrslt {\rtlch\fcs1 \af40\afs16 \ltrch\fcs0 \cs19\f40\fs16\ul\cf2\insrsid11944020\charrsid413544 support@YTDownloader.com}}}\sectd \ltrsect

\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Top of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Bottom of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Normal (Web);\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Acronym;

\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Top of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Bottom of Form;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 Normal (Web);\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Acronym;

\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Keyboard;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Preformatted;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Sample;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Typewriter;

\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Keyboard;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Preformatted;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Sample;\lsdsemihidden1 \lsdunhideused1 \lsdlocked0 HTML Typewriter;

?/?6?

?/?6?

9":(:,:0:4:

9":(:,:0:4:

3#3'3 3/333

3#3'3 3/333

8 8$8(8,8084888

8 8$8(8,8084888

5 5$5(5,5

5 5$5(5,5

2$2,242

2$2,242

2 2

2 2

4 4@4`4|4

4 4@4`4|4

>(>4>\>

>(>4>\>

mscoree.dll

mscoree.dll

- floating point support not loaded

- floating point support not loaded

- CRT not initialized

- CRT not initialized

- Attempt to initialize the CRT more than once.

- Attempt to initialize the CRT more than once.

portuguese-brazilian

portuguese-brazilian

USER32.DLL

USER32.DLL

Invalid parameter or key doesn't exist.

Invalid parameter or key doesn't exist.

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

Floating point (%%e, %%f, %%g, and %%G) is not supported by the WTL::CString class.

The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.

The flag CR_INST_STORE_ZIP_ARCHIVES should be used with CR_INST_DONT_SEND_REPORT flag.

%s %s Error Report

%s %s Error Report

CrashSender.exe is not found in the specified path.

CrashSender.exe is not found in the specified path.

crashrpt_lang.ini

crashrpt_lang.ini

l%s\CrashRpt\UnsentCrashReports\%s_%s

l%s\CrashRpt\UnsentCrashReports\%s_%s

Couldn't create crash report directory.

Couldn't create crash report directory.

Couldn't set C exception handlers for main execution thread.

Couldn't set C exception handlers for main execution thread.

Couldn't launch CrashSender.exe process.

Couldn't launch CrashSender.exe process.

%s-tmp

%s-tmp

Local\CrashRptEvent_%s_2

Local\CrashRptEvent_%s_2

The operation was cancelled by client.

The operation was cancelled by client.

Error launching CrashSender.exe

Error launching CrashSender.exe

%s has stopped working

%s has stopped working

Invalid registry key or invalid destination file is specified.

Invalid registry key or invalid destination file is specified.

HKEY_LOCAL_MACHINE\

HKEY_LOCAL_MACHINE\

HKEY_CURRENT_USER\

HKEY_CURRENT_USER\

Empty subkey is not allowed.

Empty subkey is not allowed.

The registry key coudn't be open.

The registry key coudn't be open.

Local\CrashRptEvent_%s

Local\CrashRptEvent_%s

%s\%s_%s\%s

%s\%s_%s\%s

%u.%u.%u.%u

%u.%u.%u.%u

chrome.exe

chrome.exe

iexplore.exe

iexplore.exe

firefox.exe

firefox.exe

safari.exe

safari.exe

opera.exe

opera.exe

explorer.exe

explorer.exe

chrome

chrome

firefox

firefox

opera

opera

@Google Chrome

@Google Chrome

Chrome_WidgetWin_1

Chrome_WidgetWin_1

chrome://settings-frame/#syi516

chrome://settings-frame/#syi516

ChromeGetUrl::Initialize ReRun

ChromeGetUrl::Initialize ReRun

ChromeGetUrl Done

ChromeGetUrl Done

ChromeGetUrl::BuildChromeHandles found window class name: %s

ChromeGetUrl::BuildChromeHandles found window class name: %s

ChromeGetUrl::BuildChromeHandles HWNDS: %s

ChromeGetUrl::BuildChromeHandles HWNDS: %s

ChromeGetUrl::BuildChromeHandles Could not find Chrome windows, exiting..

ChromeGetUrl::BuildChromeHandles Could not find Chrome windows, exiting..

%d secs

%d secs

Name - %s

Name - %s

Value - %s

Value - %s

https

https

URL: %s changed to: %s

URL: %s changed to: %s

Adding URL:

Adding URL:

Adding URL: %s

Adding URL: %s

@Firefox

@Firefox

FirefoxBrowserWindow Found button window, 0x%x

FirefoxBrowserWindow Found button window, 0x%x

FirefoxBrowserWindow Found browser window, 0x%x

FirefoxBrowserWindow Found browser window, 0x%x

IE9BrowserWindow Found button window, 0x%x

IE9BrowserWindow Found button window, 0x%x

IE9BrowserWindow Found browser window, 0x%x

IE9BrowserWindow Found browser window, 0x%x

@Opera

@Opera

OperaBrowserWindow Found button window, 0x%x

OperaBrowserWindow Found button window, 0x%x

OperaBrowserWindow Found browser window, 0x%x

OperaBrowserWindow Found browser window, 0x%x

SafariBrowserWindow Found button window, 0x%x

SafariBrowserWindow Found button window, 0x%x

SafariBrowserWindow Found browser window, 0x%x

SafariBrowserWindow Found browser window, 0x%x

ESOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

ESOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy

GetModule failed. Err=%d

GetModule failed. Err=%d

OpenProcess failed. Err=%d

OpenProcess failed. Err=%d

JCertGetNameString failed.

JCertGetNameString failed.

CryptDecodeObject failed with %x

CryptDecodeObject failed with %x

CryptQueryObject failed with %x

CryptQueryObject failed with %x

CryptMsgGetParam failed with %x

CryptMsgGetParam failed with %x

Program Name : %s

Program Name : %s

Publisher Link : %s

Publisher Link : %s

MoreInfo Link : %s

MoreInfo Link : %s

CertFindCertificateInStore failed with %x

CertFindCertificateInStore failed with %x

CBOT_Condition::IsToInstall Return %d

CBOT_Condition::IsToInstall Return %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CEventsThread::AddEvent] ___Error invalid event handle %d

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::AddEvent] ___Warning event handle already exists %d

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::CreateNamedEvent] ___Error CreateEvent. LE: %d. Try OpenEvent...

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] ___Error OpenEvent: LE: %d

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::CreateNamedEvent] OpenEvent. LE: %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::SetTimeoutResolution] From: %d -> To: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Cleanup] Closing Handle: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::Cleanup] ___Error CloseHandle(0x%p) failed: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::AlertEvent] ___Error Not found Event: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error Invalid Event Entry: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::AlertEvent] ___Error SetEvent failed: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::SetGlobalEvent] Event: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Not found Event: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::SetGlobalEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::RemoveEvent] Event: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] ___Error Not found Event: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error Invalid Event Entry: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::RemoveEvent] ___Error CloseHandle failed: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::ResetEvent] Event: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] ___Error Not found Event: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error Invalid Event Entry: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::ResetEvent] ___Error ResetEvent failed: %d

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::WaitEvent] TID=%X

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::WaitForMultipleEvents] TID=%X

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] ___Error MsgWaitForMultipleObjectsEx. LE: %d

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Timeout: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::WaitForMultipleEvents] Released on Signaled: %d ms

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Start] ___Error - Failed to create thread: %X

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Start - Leave] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::Stop - Enter] TID=%X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Stop - Leave] TID=%X

[CEventsThread::Work] TID=%X

[CEventsThread::Work] TID=%X

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] WAIT_ABANDONED - %d

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::Work] TID=%X - Exit !!!

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::CallProcessTimeoutRoutines] ___Error Invalid Event Entry: %d, Timeout: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Index: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

[CEventsThread::CallProcessEventRoutines] ___Error Invalid Event Entry: %d

Your %s is almost ready for use.

Your %s is almost ready for use.

Click YES on the next screen to allow %s to complete integration.

Click YES on the next screen to allow %s to complete integration.

wevtapi.dll

wevtapi.dll

%SystemRoot%\System32\Winevt\Logs\Application.evtx

%SystemRoot%\System32\Winevt\Logs\Application.evtx

Event / System[EventID = %d] /Provider[@Name='MsiInstaller']

Event / System[EventID = %d] /Provider[@Name='MsiInstaller']

EvtRender failed with %d

EvtRender failed with %d

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

%ddd

%ddd

SB_TASK_%d

SB_TASK_%d

CreateTask: Query IExecAction failed

CreateTask: Query IExecAction failed

RUNONCE_%d

RUNONCE_%d

PT%dS

PT%dS