mzpefinder_pcap_file.YR, WormAutoItGen.YR (Lavasoft MAS)Behaviour: Worm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 630c29d005bc4a0ba94417579f822a04
SHA1: c1fd293b53805ade082fbb8bf06adb01d216e447
SHA256: bd7858c66ed5177909bce55f1d43e2e1f04ce90a71388b8bdb65f8375b23e12f
SSDeep: 1536:rpgpHzb9dZVX9fHMvG0D3XJ47zfaOZrinqe1xM5tEjSDmcrspFI4:VgXdZt9P6D3XJiPZ2nLK5ajwbr n
Size: 86944 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: Windows7Ada SP1 64-bit
Summary: Worm. A program that is primarily replicating on networks or removable drives.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Worm creates the following process(es):
TPAutoConnSvc.exe:1844
7za.exe:1144
7za.exe:1900
%original file name%.exe:1988
EasyDriverPro.exe:2712
The Worm injects its code into the following process(es):
EasyDriverPro.exe:3108
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process 7za.exe:1144 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\Drivers64.db (10277 bytes)
The process 7za.exe:1900 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Program Files% (x86)\Probit Software\Easy Driver Pro\DPSmartScan.exe (1071 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\sqlite3.dll (1047 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\DPLauncher.exe (1223 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.exe (70432 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\DPSchedule.exe (1583 bytes)
The process %original file name%.exe:1988 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso933B.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\EasyDriverPro[1].app (43984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso933B.tmp\EasyDriverPro.exe (47088 bytes)
The process EasyDriverPro.exe:2712 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Easy Driver Pro on the Web.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\LangDLL.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\temp.txt (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\start_install.txt (16 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\edp.ico (1128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G44ROL1L\easydriverpro803d64[1].data (198536 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\file_id.diz (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\Desktop\Easy Driver Pro.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\easydriverpro803d.data (210182 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\7za.exe (15192 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp (4 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.exe (6309 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\English.ini (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USU4CORO\log-install[1].htm (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\nsDialogs.dll (21 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\HomePage.url (53 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\scan.gif (4133 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\easydriverpro803.data (72503 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Easy Driver Pro.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Help.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WDUL1PG1\easydriverpro803[1].data (68646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\log-install[1].htm (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\System.dll (23 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\uninstall.exe (1382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\modern-wizard.bmp (5568 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.chm (17 bytes)
The process EasyDriverPro.exe:3108 makes changes in the file system.
The Worm creates and/or writes to the following file(s):
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\PCInfo.ini (175 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\Devices.ini (33 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\Scan.ini (1669 bytes)
Registry activity
The process TPAutoConnSvc.exe:1844 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:3]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"DelAfterCreate" = "1"
[HKU\.DEFAULT\Printers\DevModes2]
"HP LaserJet Professional M1212nf MFP#:3" = "48 00 50 00 20 00 4C 00 61 00 73 00 65 00 72 00"
The Worm deletes the following registry key(s):
[HKLM\SOFTWARE\ThinPrint\TPPrnUI\HP LaserJet Professional M1212nf MFP#:3]
The process %original file name%.exe:1988 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\31ec1c24\PUPautoinsaller_v1.exe, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\31ec1c24\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\6c88b866\python.dll, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\VMwareDnD\6c88b866\, , \??\C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso933B.tmp\EasyDriverPro.exe,"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
The process EasyDriverPro.exe:2712 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy Driver Pro]
"DisplayIcon" = "%Program Files% (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDecision" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy Driver Pro]
"UninstallString" = "%Program Files% (x86)\Probit Software\Easy Driver Pro\uninstall.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDecision" = "0"
[HKCU\Software\Probit Software\Easy Driver Pro]
"Language" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached]
"{17FE9752-0B5A-4665-84CD-569794602F5C} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF" = "01 00 00 00 00 00 00 00 34 3A D2 8C D0 44 D0 01"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy Driver Pro]
"DisplayVersion" = "8.1.2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDecisionReason" = "1"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy Driver Pro]
"DisplayName" = "Easy Driver Pro"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDecisionReason" = "1"
"WpadNetworkName" = "Network"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDecisionTime" = "D1 C9 62 88 D0 44 D0 01"
[HKCU\Software\Probit Software\Easy Driver Pro]
"srid" = "524&iid=15379358&umi=B48A115F&sst=7c1d0bc99d0398a455df316a762fe350"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy Driver Pro]
"Publisher" = "Probit Software LTD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDecisionTime" = "D1 C9 62 88 D0 44 D0 01"
To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Easy Driver Pro" = "%Program Files% (x86)\Probit Software\Easy Driver Pro\DPLauncher.exe"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EE1E4E39-627C-4D52-9D86-A515AB38A003}]
"WpadDetectedUrl"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-ef-0d-5d]
"WpadDetectedUrl"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
The process EasyDriverPro.exe:3108 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:
[HKCU\Software\Probit Software\Easy Driver Pro]
"BackupPath" = "C:\Users\"%CurrentUserName%"\Documents\Probit Software\Easy Driver Pro\Backup\"
"ScanExecuted" = "1"
"OutdatedDrivers" = "2"
"s_SmartScan" = "1"
"ProxyAddress" = ""
"ProxyPort" = ""
"CloseToTray" = "0"
"ScanAtStartup" = "0"
"DownloadPath" = "C:\Users\"%CurrentUserName%"\Documents\Probit Software\Easy Driver Pro\Drivers\"
"nDownloads" = "3"
"InstallStat" = "0"
"DatabaseDate" = "00 00 00 00 00 5E E4 40"
"ShowRebootMessage" = "1"
"InstallDate" = "02-10-2015"
"LastDatabaseCheck" = "BD 2E 4C 95 A4 87 E4 40"
"ShowAlertMessages" = "1"
"ProxyLogin" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"
[HKCU\Software\Probit Software\Easy Driver Pro]
"UseProxy" = "0"
"TotalDrivers" = "79"
[HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\%Program Files% (x86)\Probit Software\Easy Driver Pro]
"EASYDRIVERPRO.EXE" = "RUNASADMIN ELEVATECREATEPROCESS"
[HKCU\Software\Probit Software\Easy Driver Pro]
"s_Enable" = "0"
"ShowUpdateWindow" = "0"
"ForceUpdate" = "0"
"s_SmartMode" = "2"
"UpdateWindowShown" = "0"
"s_Mode" = "0"
"ShowSRPMessage" = "1"
"LastUpdate" = "BD 2E 4C 95 A4 87 E4 40"
"ProxyPassword" = ""
"LastScan" = "57 06 9A 95 A4 87 E4 40"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Worm deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"
Dropped PE files
MD5 | File path |
---|---|
0fc259e6896fe75041a73569729c7bd9 | c:\Program Files (x86)\Probit Software\Easy Driver Pro\DPLauncher.exe |
1e55c00bbaa22ce55f2277d8fac658e1 | c:\Program Files (x86)\Probit Software\Easy Driver Pro\DPSchedule.exe |
14e43874f258d2c0890830d438753035 | c:\Program Files (x86)\Probit Software\Easy Driver Pro\DPSmartScan.exe |
7832760791a58c947c7f902673dc449c | c:\Program Files (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.exe |
0f66e8e2340569fb17e774dac2010e31 | c:\Program Files (x86)\Probit Software\Easy Driver Pro\sqlite3.dll |
be98f09ebe4efc38c6b3fd193b762ea8 | c:\Program Files (x86)\Probit Software\Easy Driver Pro\uninstall.exe |
19746a029c39d9d1c3ce2b7976dbd107 | c:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\EasyDriverPro[1].app |
19746a029c39d9d1c3ce2b7976dbd107 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso933B.tmp\EasyDriverPro.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
TPAutoConnSvc.exe:1844
7za.exe:1144
7za.exe:1900
%original file name%.exe:1988
EasyDriverPro.exe:2712 - Delete the original Worm file.
- Delete or disinfect the following files created/modified by the Worm:
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\Drivers64.db (10277 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\DPSmartScan.exe (1071 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\sqlite3.dll (1047 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\DPLauncher.exe (1223 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.exe (70432 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\DPSchedule.exe (1583 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso933B.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\EasyDriverPro[1].app (43984 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nso933B.tmp\EasyDriverPro.exe (47088 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\inetc.dll (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Easy Driver Pro on the Web.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\LangDLL.dll (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\temp.txt (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\start_install.txt (16 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\edp.ico (1128 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G44ROL1L\easydriverpro803d64[1].data (198536 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\file_id.diz (520 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\nsExec.dll (14 bytes)
C:\Users\"%CurrentUserName%"\Desktop\Easy Driver Pro.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\md5dll.dll (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\easydriverpro803d.data (210182 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\7za.exe (15192 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\English.ini (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USU4CORO\log-install[1].htm (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\nsDialogs.dll (21 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\HomePage.url (53 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\scan.gif (4133 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Uninstall.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\easydriverpro803.data (72503 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Easy Driver Pro.lnk (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Help.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WDUL1PG1\easydriverpro803[1].data (68646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH2TVRCI\log-install[1].htm (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\System.dll (23 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\uninstall.exe (1382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsj9BA4.tmp\modern-wizard.bmp (5568 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\EasyDriverPro.chm (17 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\PCInfo.ini (175 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\Devices.ini (33 bytes)
%Program Files% (x86)\Probit Software\Easy Driver Pro\Base\Scan.ini (1669 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Easy Driver Pro" = "%Program Files% (x86)\Probit Software\Easy Driver Pro\DPLauncher.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version: 8.1.2
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 8.1.2.7
File Description:
Comments:
Language: English (United States)
Company Name: Product Name: Product Version: 8.1.2Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 8.1.2.7File Description: Comments: Language: English (United States)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 36864 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 229376 | 37104 | 37376 | 4.77025 | b0e6875162682eba810fbf8942519c8e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://d86zdumh4pwme.cloudfront.net/publishers/3/524/EasyDriverPro.app | |
hxxp://www.easydriverpro.com/easyinstallprolib/easyinstallprolog/log-install.php?ins=524&ver=8.1.2.7&st=1&umi=B48A115F | 54.83.206.183 |
hxxp://d86zdumh4pwme.cloudfront.net/easydriverpro803.data | |
hxxp://d86zdumh4pwme.cloudfront.net/easydriverpro803d64.data | |
hxxp://www.easydriverpro.com/easyinstallprolib/easyinstallprolog/log-install.php?ins=524&ver=8.1.2.7&st=100&umi=B48A115F&iid=15379358&comp=0 | 54.83.206.183 |
hxxp://www.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350 | 54.83.206.183 |
hxxp://www.easydriverpro.com/css/template.css | 54.83.206.183 |
hxxp://www.easydriverpro.com/css/style.css | 54.83.206.183 |
hxxp://pagead46.l.doubleclick.net/pagead/show_ads.js | |
hxxp://www.easydriverpro.com/images/header_bkg.gif | 54.83.206.183 |
hxxp://www-google-analytics.l.google.com/ga.js | |
hxxp://pagead46.l.doubleclick.net/pagead/js/r20150205/r20141212/show_ads_impl.js | |
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js | |
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1414896808&utmhn=www.easydriverpro.com&utmcs=utf-8&utmsr=1916x902&utmvp=1900x805&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy Driver Pro - Welcome&utmhid=1303542799&utmr=-&utmp=/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&utmht=1423531572420&utmac=UA-15244178-1&utmcc=__utma=234048906.299294506.1423531572.1423531572.1423531572.1;+__utmz=234048906.1423531572.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1021910407&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~ | |
hxxp://www.gstatic.com/pub-config/ca-pub-4844330334866922.js | 173.194.113.215 |
hxxp://pagead46.l.doubleclick.net/pagead/html/r20150205/r20141212/zrt_lookup.html | |
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-4844330334866922&output=html&h=280&slotname=4127509192&adk=2253242122&w=336&lmt=1423531572&flash=0&url=http://www.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&dt=1423531572346&bpp=15&bdt=311&shv=r20150205&cbv=r20141212&saldr=sa&correlator=6344100717591&frm=20&ga_vid=299294506.1423531572&ga_sid=1423531572&ga_hid=1303542799&ga_fc=1&u_tz=120&u_his=1&u_java=1&u_h=902&u_w=1916&u_ah=858&u_aw=1916&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=14&adx=1078&ady=160&biw=1900&bih=805&eid=317150304&oid=3&rx=0&eae=0&fc=24&docm=10&brdim=0,53,-4,-4,1916,,1924,866,1916,805&vis=1&rsz=0|0||&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=rGf91JyaTN&p=http://www.easydriverpro.com&dtd=423 | |
hxxp://pagead46.l.doubleclick.net/pagead/osd.js | |
hxxp://pagead46.l.doubleclick.net/pagead/js/r20150205/r20141212/expansion_embed.js | |
hxxp://a749.dsw4.akamai.net/connect/xd_arbiter/DU1Ia251o0y.js?version=41 | |
hxxp://pagead46.l.doubleclick.net/pagead/ads?client=ca-pub-4844330334866922&output=html&h=280&slotname=4127509192&adk=2253242122&w=336&lmt=1423531573&flash=0&url=http://www.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&dt=1423531572361&bpp=3&bdt=325&shv=r20150205&cbv=r20141212&saldr=sa&prev_slotnames=4127509192&correlator=6344100717591&frm=20&ga_vid=299294506.1423531572&ga_sid=1423531572&ga_hid=1303542799&ga_fc=1&u_tz=120&u_his=1&u_java=1&u_h=902&u_w=1916&u_ah=858&u_aw=1916&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=14&adx=1078&ady=456&biw=1900&bih=805&eid=317150304,828064101&oid=3&rx=0&eae=0&fc=24&docm=10&brdim=0,53,-4,-4,1916,,1924,866,1916,805&vis=1&rsz=0|0||&abl=CS&ppjl=f&pfx=0&fu=0&bc=1&ifi=2&xpc=KXefdQTk8l&p=http://www.easydriverpro.com&dtd=700 | |
hxxp://star.c10r.facebook.com/plugins/like.php?app_id=&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f2ba2ea09592a76&domain=www.easydriverpro.com&origin=http%3A%2F%2Fwww.easydriverpro.com%2Ff1eee2263e06481&relation=parent.parent&container_width=524&href=https://www.facebook.com/EasyDriverPro&locale=en_US&sdk=joey&send=false&show_faces=true&width=450 | |
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d0f6af77d86ba3d | |
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= | |
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= | |
hxxp://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl | 64.18.20.10 |
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo= | |
hxxp://a1158.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O | |
hxxp://www.public-trust.com/CRL/Omniroot2025.crl | 64.18.20.10 |
hxxp://gs1.wac.v2cdn.net/PublicSureServerSV.crl | |
hxxp://update1.smartpcupdate.com/rpc/sendinstall?partner=ProbitSoftware&build=8.1.2 | 173.192.91.180 |
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl | |
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?924f477917498068 | |
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= | |
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= | |
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= | |
hxxp://e6845.ce.akamaiedge.net/pca3.crl | |
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= | |
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= | |
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= | |
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= | |
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | 88.221.132.166 |
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?924f477917498068 | 88.221.132.177 |
hxxp://www.facebook.com/plugins/like.php?app_id=&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f2ba2ea09592a76&domain=www.easydriverpro.com&origin=http%3A%2F%2Fwww.easydriverpro.com%2Ff1eee2263e06481&relation=parent.parent&container_width=524&href=https://www.facebook.com/EasyDriverPro&locale=en_US&sdk=joey&send=false&show_faces=true&width=450 | 31.13.91.2 |
hxxp://connect.facebook.net/en_US/all.js | 23.64.223.139 |
hxxp://pagead2.googlesyndication.com/pagead/js/r20150205/r20141212/show_ads_impl.js | 173.194.113.217 |
hxxp://pagead2.googlesyndication.com/pagead/show_ads.js | 173.194.113.217 |
hxxp://download.easydriverpro.com/easydriverpro803.data | 54.230.200.240 |
hxxp://crl.omniroot.com/PublicSureServerSV.crl | 93.184.220.20 |
hxxp://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41 | 88.221.132.184 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= | 23.43.139.27 |
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= | 108.162.232.207 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= | 23.43.139.27 |
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1414896808&utmhn=www.easydriverpro.com&utmcs=utf-8&utmsr=1916x902&utmvp=1900x805&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy Driver Pro - Welcome&utmhid=1303542799&utmr=-&utmp=/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&utmht=1423531572420&utmac=UA-15244178-1&utmcc=__utma=234048906.299294506.1423531572.1423531572.1423531572.1;+__utmz=234048906.1423531572.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1021910407&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~ | 173.194.113.199 |
hxxp://vassg141.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O | 88.221.132.182 |
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4844330334866922&output=html&h=280&slotname=4127509192&adk=2253242122&w=336&lmt=1423531573&flash=0&url=http://www.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&dt=1423531572361&bpp=3&bdt=325&shv=r20150205&cbv=r20141212&saldr=sa&prev_slotnames=4127509192&correlator=6344100717591&frm=20&ga_vid=299294506.1423531572&ga_sid=1423531572&ga_hid=1303542799&ga_fc=1&u_tz=120&u_his=1&u_java=1&u_h=902&u_w=1916&u_ah=858&u_aw=1916&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=14&adx=1078&ady=456&biw=1900&bih=805&eid=317150304,828064101&oid=3&rx=0&eae=0&fc=24&docm=10&brdim=0,53,-4,-4,1916,,1924,866,1916,805&vis=1&rsz=0|0||&abl=CS&ppjl=f&pfx=0&fu=0&bc=1&ifi=2&xpc=KXefdQTk8l&p=http://www.easydriverpro.com&dtd=700 | 173.194.113.217 |
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl | 88.221.132.166 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= | 23.43.139.27 |
hxxp://www.google-analytics.com/ga.js | 173.194.113.199 |
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl | 88.221.132.166 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= | 23.43.139.27 |
hxxp://download.easydriverpro.com/publishers/3/524/EasyDriverPro.app | 54.230.200.240 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= | 93.184.220.29 |
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl | 88.221.132.166 |
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo= | 93.184.220.20 |
hxxp://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4844330334866922&output=html&h=280&slotname=4127509192&adk=2253242122&w=336&lmt=1423531572&flash=0&url=http://www.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&dt=1423531572346&bpp=15&bdt=311&shv=r20150205&cbv=r20141212&saldr=sa&correlator=6344100717591&frm=20&ga_vid=299294506.1423531572&ga_sid=1423531572&ga_hid=1303542799&ga_fc=1&u_tz=120&u_his=1&u_java=1&u_h=902&u_w=1916&u_ah=858&u_aw=1916&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=14&adx=1078&ady=160&biw=1900&bih=805&eid=317150304&oid=3&rx=0&eae=0&fc=24&docm=10&brdim=0,53,-4,-4,1916,,1924,866,1916,805&vis=1&rsz=0|0||&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=rGf91JyaTN&p=http://www.easydriverpro.com&dtd=423 | 173.194.113.217 |
hxxp://googleads.g.doubleclick.net/pagead/html/r20150205/r20141212/zrt_lookup.html | 173.194.113.217 |
hxxp://pagead2.googlesyndication.com/pagead/js/r20150205/r20141212/expansion_embed.js | 173.194.113.217 |
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d0f6af77d86ba3d | 88.221.132.177 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= | 23.43.139.27 |
hxxp://download.easydriverpro.com/easydriverpro803d64.data | 54.230.200.240 |
hxxp://pagead2.googlesyndication.com/pagead/osd.js | 173.194.113.217 |
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl | 64.18.20.10 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= | 93.184.220.29 |
hxxp://crl.verisign.com/pca3.crl | 23.43.133.163 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= | 23.43.139.27 |
fbstatic-a.akamaihd.net | 88.221.132.169 |
s-static.ak.facebook.com | 23.64.210.110 |
ieonline.microsoft.com | 204.79.197.200 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /pub-config/ca-pub-4844330334866922.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.gstatic.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: text/javascript
Last-Modified: Fri, 08 Aug 2014 12:20:44 GMT
Date: Tue, 10 Feb 2015 01:26:11 GMT
Expires: Tue, 10 Feb 2015 13:26:11 GMT
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: sffe
Content-Length: 109
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=43200
Age: 0
Alternate-Protocol: 80:quic,p=0.02
...........H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kbabbll`llbaffid....^.T\..........d...S.Zk...t..l...HTTP/1.1 200 OK..Vary: Accept-Encoding..Content-Type: text/javascript..Last-Modified: Fri, 08 Aug 2014 12:20:44 GMT..Date: Tue, 10 Feb 2015 01:26:11 GMT..Expires: Tue, 10 Feb 2015 13:26:11 GMT..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: sffe..Content-Length: 109..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=43200..Age: 0..Alternate-Protocol: 80:quic,p=0.02.............H..O.I.O,..K.O..K.LW.U(..K./..&YS.P]......[P..kbabbll`llbaffid....^.T\..........d...S.Zk...t..l.....
GET /pca3.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.verisign.com
HTTP/1.1 200 OK
Server: Apache
ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"
Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT
Date: Tue, 10 Feb 2015 01:31:30 GMT
Content-Length: 933
Connection: keep-alive
Content-Type: application/pkix-crl
0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..141210000000Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2....{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N....* ....010207212031Z0!..N....-.1Gq.@...C..040401175251Z0!..Y......w`G........070411175657Z0!..Z`..H.@B....Z.*q..080403172017Z0!..l....I...Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ....>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r../=l..?...9..V0..@Tk......fn?....0.A.HTTP/1.1 200 OK..Server: Apache..ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT..Date: Tue, 10 Feb 2015 01:31:30 GMT..Content-Length: 933..Connection: keep-alive..Content-Type: application/pkix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority..141210000000Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.
<<< skipped >>>
GET /plugins/like.php?app_id=&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f2ba2ea09592a76&domain=VVV.easydriverpro.com&origin=http%3A%2F%2FVVV.easydriverpro.com%2Ff1eee2263e06481&relation=parent.parent&container_width=524&href=https://VVV.facebook.com/EasyDriverPro&locale=en_US&sdk=joey&send=false&show_faces=true&width=450 HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.facebook.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 302 Found
Location: hXXps://VVV.facebook.com/plugins/like.php?app_id&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f2ba2ea09592a76&domain=VVV.easydriverpro.com&origin=http%3A%2F%2FVVV.easydriverpro.com%2Ff1eee2263e06481&relation=parent.parent&container_width=524&href=https://VVV.facebook.com/EasyDriverPro&locale=en_US&sdk=joey&send=false&show_faces=true&width=450
X-Content-Type-Options: nosniff
X-UA-Compatible: IE=edge
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
X-FB-Debug: wrvtCBQm7KLPAruvwGwfqaz3POGDygc40VW2R9KL5HV71Dj936bVHG3bwKqd5Xe9NtwGvidHYpgFB4Q4SBhlrg==
Date: Tue, 10 Feb 2015 01:26:12 GMT
Connection: keep-alive
Content-Length: 0
HTTP/1.1 302 Found..Location: hXXps://VVV.facebook.com/plugins/like.php?app_id&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f2ba2ea09592a76&domain%3DVVV.easydriverpro.com&origin=http%3A%2F%2FVVV.easydriverpro.com%2Ff1eee2263e06481&relation=parent.parent&container_width=524&href=https://VVV.facebook.com/EasyDriverPro&locale=en_US&sdk=joey&send=false&show_faces=true&width=450..X-Content-Type-Options: nosniff..X-UA-Compatible: IE=edge..Vary: Accept-Encoding..Content-Type: text/html; charset=utf-8..X-FB-Debug: wrvtCBQm7KLPAruvwGwfqaz3POGDygc40VW2R9KL5HV71Dj936bVHG3bwKqd5Xe9NtwGvidHYpgFB4Q4SBhlrg==..Date: Tue, 10 Feb 2015 01:26:12 GMT..Connection: keep-alive..Content-Length: 0..
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=454896, public, no-transform, must-revalidate
Last-Modified: Sun, 8 Feb 2015 07:48:42 GMT
Expires: Sun, 15 Feb 2015 07:48:42 GMT
Date: Tue, 10 Feb 2015 01:31:39 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..20150208074842Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......A..2.....:...:......20150208074842Z....20150215074842Z0...*.H.............B./.h...c....(&....9.-.}......z.....'..T-."6.b..lni`B.....X.M\m.V....Z...S..:.H7^L.@.r..."o..If=....m..Y.6p.4`*..V..M...H..OL}.]7c..N..H.........Z.h$c.C.m...Z3.e.. ....\'..4..}.nP...UF.]*I.._.5........|.0.2..O..j....Tu...h........./....t..N..Sb&...Q.h[..1?...#0...0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{(..t....2.Vf.....&;6).i*FK....W@....F....jnb.w._p.E.6.|.mk....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H......
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1697
content-transfer-encoding: binary
Cache-Control: max-age=431220, public, no-transform, must-revalidate
Last-Modified: Sun, 8 Feb 2015 01:18:30 GMT
Expires: Sun, 15 Feb 2015 01:18:30 GMT
Date: Tue, 10 Feb 2015 01:31:30 GMT
Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCSP Responder..20150208011830Z0s0q0I0... ........?.@..w.........Y.!......Q...==d6|h.[x....7..`..........cV.!.....20150208011830Z....20150215011830Z0...*.H..............Y.i... .omtQr."......[*l<Y..1.:...K.3..mR..&M....}......T...........G9..&.....a..s....an6)|1..q...Ay.7`."..4........7...B.d... .fy...@.g...W....1W..\.....O[.c-k..'.O..?...d..W.o.n........X.k....z..@u..B ....~.....K....&...'5n....Sl.r5.Y|.....Ny...;.!..4B....0...0...0..{.........[..I|.....Zm..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140428000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 2004 CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>.....%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l.....f..;]s!.\"v...|....].@.....K7m2...N......-S.I......5n...G7. ..W....n..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....<..6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%..0... .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E....0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.symcb.com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>q..i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..wo......E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|..........k
<<< skipped >>>
GET /CRL/Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com
HTTP/1.1 200 OK
Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 04 Feb 2015 20:30:01 GMT
ETag: "2015b-6ca-50e490d4402ee"
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Connection: Keep-Alive
Date: Tue, 10 Feb 2015 01:27:54 GMT
Content-Length: 1738
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..150204200915Z..150505201415Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'....141112202254Z0....'....100217174732Z0....'#...100303201301Z0....'!...100312202204Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z..0.0...U........0...*.H.............Xb.F.M4hYy.h~...2.... .. ~.A4...F...gyQ.....:_..g.|
<<< skipped >>>
GET /thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350 HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.easydriverpro.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 Feb 2015 01:27:57 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache/2.2.15 (CentOS)
Set-Cookie: PHPSESSID=9plslcodkrdkt0b2obpi40tb87; path=/
Set-Cookie: AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684950193DFB88BE41987C7E156D7F91AC9932BE17ABC54889040364137740AF66719939B1ACEB47879F9029F784CC65A8;PATH=/
X-Powered-By: PHP/5.3.3
transfer-encoding: chunked
Connection: keep-alive
1ab7...<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "hXXp://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">...<html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en-GB">...<head>....<meta http-equiv="Content-Type" content="application/xhtml xml; charset=utf-8" />....<meta http-equiv="content-type" content="text/html;charset=utf-8" />....<title>Easy Driver Pro - Welcome</title>....<meta name="keywords" content="easy driver pro, pc drivers, printer drivers, mouse "/>....<meta name="description" content="Automatically Update PC Drivers with Easy Driver Pro" />....<link rel="stylesheet" href="./css/style.css" type="text/css" />....<link rel="stylesheet" href="./css/template.css" type="text/css" />.. <link rel="shortcut icon" href=".//favicon.ico" />........<script language="javascript" type="text/javascript">....function GoToDownloadPage(strPageUrl)....{.....window.location.href='./' strPageUrl;....}....</script>...... .... <script type="text/javascript">.. var _gaq = _gaq || [];.. _gaq.push(['_setAccount', 'UA-15244178-1']);.. _gaq.push(['_setDomainName', 'easydriverpro.com']);.. _gaq.push(['_setAllowLinker', true]);.. _gaq.push(['_trackPageview']);.. (function() {.. var ga = document.createElement('script'); ga.type = 'text/
<<< skipped >>>
GET /css/template.css HTTP/1.1
Accept: text/css
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.easydriverpro.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=9plslcodkrdkt0b2obpi40tb87; AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684950193DFB88BE41987C7E156D7F91AC9932BE17ABC54889040364137740AF66719939B1ACEB47879F9029F784CC65A8
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Tue, 10 Feb 2015 01:27:57 GMT
ETag: "24239-2e2-4f20b0ddd1f80"
Last-Modified: Mon, 10 Feb 2014 10:46:38 GMT
Server: Apache/2.2.15 (CentOS)
Content-Length: 738
Connection: keep-alive
#main_template .{. margin: 0 auto;. width: 100%;. background: #fff;.}..#title.{. background: #fff;. padding: 20px;.}..#title h1.{. margin: 0;. color: #003366;. font-size: 26px;.}..#content-container.{. float: left;. width: 100%;. background: #fff repeat-y 100% 0;.}..#content.{. clear: left;. float: left;. width: 524px;. padding-left: 19px;. margin: 0px;. display: inline;. color: #333333;. line-height: 140%;.}..#content h2.{. color: #003366;.}..#right_column.{. float: right;. width: 346px;. margin: 0px 6px 0px 50px;. display: inline;.}..#sub_title h2 .{. color: #006600;.}..#sub_title h3 .{. color: #006600;.}..#submit_template.{. margin-left: 370px;.}HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Type: text/css..Date: Tue, 10 Feb 2015 01:27:57 GMT..ETag: "24239-2e2-4f20b0ddd1f80"..Last-Modified: Mon, 10 Feb 2014 10:46:38 GMT..Server: Apache/2.2.15 (CentOS)..Content-Length: 738..Connection: keep-alive..#main_template .{. margin: 0 auto;. width: 100%;. background: #fff;.}..#title.{. background: #fff;. padding: 20px;.}..#title h1.{. margin: 0;. color: #003366;. font-size: 26px;.}..#content-container.{. float: left;. width: 100%;. background: #fff repeat-y 100% 0;.}..#content.{. clear: left;. float: left;. width: 524px;. padding-left: 19px;. margin: 0px;. display: inline;. color: #333333;. line-height: 140%;.}..#content h2.{. color: #003366;.}..#right_column.{. float: right;.
<<< skipped >>>
GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 05 May 2014 05:04:34 GMT
If-None-Match: "87fbb3811f68cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT
Accept-Ranges: bytes
ETag: "9a9a44d511bd01:0"
Server: Microsoft-IIS/8.0
VTag: 43863145100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 550
Cache-Control: max-age=900
Date: Tue, 10 Feb 2015 01:26:43 GMT
Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......10... .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q>.ln...z..L.......5.5s@d.q.('..e...Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az......@..l....
GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 24 May 2014 05:04:51 GMT
If-None-Match: "96bfbfb1d77cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT
Accept-Ranges: bytes
ETag: "88c4768d3f2ad01:0"
Server: Microsoft-IIS/8.5
VTag: 279245755100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Tue, 10 Feb 2015 01:26:43 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M........z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{.s...@....f.|7z.. ......>..Q...(......._....UM.EN.@.K\]#..Y.*.......T. .C.....A'..5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Qw......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........
GET /pki/crl/products/WinPCA.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 07 May 2014 05:04:02 GMT
If-None-Match: "a413fc3b169cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT
Accept-Ranges: bytes
ETag: "d2e35dc7e31cd01:0"
Server: Microsoft-IIS/8.0
VTag: 279876544500000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 561
Cache-Control: max-age=854
Date: Tue, 10 Feb 2015 01:26:43 GMT
Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p............<.J0... .....7.......0...U......30... .....7......150320224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c.{.m@Q.M.p...g.^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo...._...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.].....uki~......
GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 01 Jul 2014 05:04:34 GMT
If-None-Match: "924558f3e994cf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT
Accept-Ranges: bytes
ETag: "75565c7ac03ad01:0"
Server: Microsoft-IIS/8.5
VTag: 438743915800000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 554
Cache-Control: max-age=900
Date: Tue, 10 Feb 2015 01:26:44 GMT
Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Y0... .....7......150427174215Z0...*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp..j....lo....4........T9j...S.7Q.@.W..@.. ...M....z....Q...{u. .W..HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT..Accept-Ranges: bytes..ETag: "75565c7ac03ad01:0"..Server: Microsoft-IIS/8.5..VTag: 438743915800000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 554..Cache-Control: max-age=900..Date: Tue, 10 Feb 2015 01:26:44 GMT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......Y0... .....7......150427174215Z0...*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp..j....lo....4........T9j...S.7Q.@.W..
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1762
content-transfer-encoding: binary
Cache-Control: max-age=472229, public, no-transform, must-revalidate
Last-Modified: Sun, 8 Feb 2015 12:38:43 GMT
Expires: Sun, 15 Feb 2015 12:38:43 GMT
Date: Tue, 10 Feb 2015 01:31:42 GMT
Connection: keep-alive
0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..20150208123843Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V.......K3.....20150208123843Z....20150215123843Z0...*.H.............f...%/.`vA..Xt.U!._..f.1.~.'.7H..S.. *...VS.i.^.Oy..8.p....X....83c...>.s|.:...(.i!......9..n 1.. p....$1s.....(Wq.<...*V.r.*..(..S.8...y.4.A3..'.gQ..f..n..">.h.....}`...t.TP...n4..q"...,..6o.X.0Ojs.]....`.e.*D..j;.w-:m.N...)X.....A.1T5z.d?...y.`.0.......K....0...0...0...........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...141202000000Z..151216235959Z0..1.0...
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=508936
Content-Type: application/ocsp-response
Date: Tue, 10 Feb 2015 01:26:13 GMT
Etag: "54d9366f-1d7"
Expires: Mon, 16 Feb 2015 13:26:13 GMT
Last-Modified: Mon, 09 Feb 2015 22:36:31 GMT
Server: ECS (ams/D1DC)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...20150209200000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ...._.M.[........?;....20150209200000Z....20150216200000Z0...*.H.............?rk..!N....ow.E.R........AX%..G.`..'..U..&.[NQ.\.......S.......3>w7}E.s.`.fj.Y.t..B,........x....D.m.R.........a9....X....B...........w..S...7....OC.[._.....(....(.I......6.H..&.8L..p16 ..lT.W.......c..A.O...xTd..#.(..........4............*(.rW.9...E.H........
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=511264
Content-Type: application/ocsp-response
Date: Tue, 10 Feb 2015 01:26:13 GMT
Etag: "54d92efa-1d7"
Expires: Mon, 16 Feb 2015 13:26:13 GMT
Last-Modified: Mon, 09 Feb 2015 22:04:42 GMT
Server: ECS (ams/49CA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......P.s..)...... ..y.H....20150209215000Z0s0q0I0... .........H...{....*.....04....P.s..)...... ..y.H.....p.x.f..7.L.%o. ....20150209215000Z....20150216220500Z0...*.H.............N.j.0.L\Q.4R.....O..y.b..3....`...q... ...t..b...t2."...C8..fM...A..9..P..5.-...i...q..ac.cL.....u.......9.....g.....@......A...Sf...g.w.n..$...e...l.>M$.......p.Yt....7.F6..@D...(.....\uQ.P7CK.'&.....1dkx\.nIj...BQ?\......Y.~..(X...:..........6dN.X...Z..xHTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=511264..Content-Type: application/ocsp-response..Date: Tue, 10 Feb 2015 01:26:13 GMT..Etag: "54d92efa-1d7"..Expires: Mon, 16 Feb 2015 13:26:13 GMT..Last-Modified: Mon, 09 Feb 2015 22:04:42 GMT..Server: ECS (ams/49CA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0......P.s..)...... ..y.H....20150209215000Z0s0q0I0... .........H...{....*.....04....P.s..)...... ..y.H.....p.x.f..7.L.%o. ....20150209215000Z....20150216220500Z0...*.H.............N.j.0.L\Q.4R.....O..y.b..3....`...q... ...t..b...t2."...C8..fM...A..9..P..5.-...i...q..ac.cL.....u.......9.....g.....@......A...Sf...g.w.n..$...e...l.>M$.......p.Yt....7.F6..@D...(.....\uQ.P7CK.'&.....1dkx\.nIj...BQ?\......Y.~..(X...:..........6dN.X...Z..x..
<<< skipped >>>
GET /easyinstallprolib/easyinstallprolog/log-install.php?ins=524&ver=8.1.2.7&st=1&umi=B48A115F HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: VVV.easydriverpro.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 Feb 2015 01:25:14 GMT
Server: Apache/2.2.15 (CentOS)
Set-Cookie: AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684DABEB6E5563F6C10267F9816C2F56470E7BD4FF83069C4D7AAFD9C8A214D03F955F611B22F1DA928EC16720AAFB46A0;PATH=/
X-Powered-By: PHP/5.3.3
Content-Length: 16
Connection: keep-alive
15379358....HTTP/1.1 200 OK..Cache-control: no-cache="set-cookie"..Content-Type: text/html; charset=UTF-8..Date: Tue, 10 Feb 2015 01:25:14 GMT..Server: Apache/2.2.15 (CentOS)..Set-Cookie: AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684DABEB6E5563F6C10267F9816C2F56470E7BD4FF83069C4D7AAFD9C8A214D03F955F611B22F1DA928EC16720AAFB46A0;PATH=/..X-Powered-By: PHP/5.3.3..Content-Length: 16..Connection: keep-alive..15379358........
GET /easyinstallprolib/easyinstallprolog/log-install.php?ins=524&ver=8.1.2.7&st=100&umi=B48A115F&iid=15379358&comp=0 HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: VVV.easydriverpro.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684DABEB6E5563F6C10267F9816C2F56470E7BD4FF83069C4D7AAFD9C8A214D03F955F611B22F1DA928EC16720AAFB46A0
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 Feb 2015 01:25:24 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 8
Connection: keep-alive
....HTTP/1.1 200 OK..Content-Type: text/html; charset=UTF-8..Date: Tue, 10 Feb 2015 01:25:24 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 8..Connection: keep-alive..
GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d0f6af77d86ba3d HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 05 Dec 2013 22:47:50 GMT
If-None-Match: "0af536cf2ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com
HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: application/octet-stream
Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT
Accept-Ranges: bytes
ETag: "0b2464b1797cf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 6408
Date: Tue, 10 Feb 2015 01:26:12 GMT
Connection: keep-alive
MSCF............,...................O.......'#.........D.z .disallowedcert.stl....2..'#CK...8T...g........g.k..".....mlI."d..m...P$"....e.J........z.....\..........9g.9....~.........Q.Q......Q..DL.8.C.PS.K0.!P.0........#.DY.8.....V.....$.C....a.0...........`......;.S.....0#...m... ..`0...?.!vR?.....d....`......_@..}....$...i..OR'..$....K..'Z....o.g..*.Vc.....[nY e./.EJ...B.Y.......Ag......!....9......u..!..1Yy.......r...Ss^@...M.Dtl\....i.k....3...B.Z.:.p.N....*......x,...ah/..].[....GB..T..$A....SY..t.E5R..R...9!....*.*68V....1... ...Q{...".Op@L.2M...1;xd{.C.u?..e.U.=f.nx.........y.G..0.......\L .'.^....$......N=..m...UjrZs...J.I.C....;......q_..e......?.T..2..bw....E.L.{...S...~.<.........-.Q..|.l. .1..6r....[}!J..,...naPk.U.... ..{@LH..W....>.Sq...8.5.,.z..0.jL.S..........]...yW_...Y.1..h.7...9{.....I......g.Y.,1...i8n.6..........4.]...........=........^..n.K7...c.g).Z. .0..$7.ys.p...B.5.].f...|(3!.|..P...j..^..j....#(...@...As..*.O..i..u....9..S.Y.n..HXW...F ..i...:.......!.] r......D..*ld.b.>>:Pp.....5:1 o=..5.'..4.......hO....{.V.rx..V...%.}..u...6Wv-..".iV.b..B0.Q..,...E.Dy...x..5....?Z.$L..1.....4...=.....g!....%..:..c..j..v~....._R.6.......;.#.Y*p..J.4.#'..Vo...g^K...J....._.^..u...)....&/.....q....o......4.....S...,q.....p.8IIe.....d|.3{)...M.0.X...4.."..P.......Hk.... ]!.!... ..#.x..<..X.........'.E(<b[.......#.. ....XiLl|..=.....&P.@H.J.oo...a...x B....l.....@.P......!8..@...q2..;.......mm....>~............j%..>.X.,V...J...C ....*..Z.8- RKGW...0./Z.__..)7g_'{.......pr......;.
<<< skipped >>>
GET /PublicSureServerSV.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.omniroot.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=864000
Content-Type: application/x-pkcs7-crl
Date: Tue, 10 Feb 2015 01:26:14 GMT
Etag: "2b002b-472b3-21577a40"
Expires: Fri, 20 Feb 2015 01:26:14 GMT
Last-Modified: Mon, 09 Feb 2015 22:17:05 GMT
Server: ECS (ams/D1C3)
X-Cache: HIT
X-Cntnt-Length: 291507
Content-Length: 291507
0..r.0..q....0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybertrust Public SureServer SV CA..150209214805Z..150219214805Z0..p.0......... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I..101116165848Z0.........,U./...101116173007Z0.........,U.h...101116172944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0.........,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..101116195619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0.........-..4...110315204303Z0........../P....120206141831Z0..........I..@..120124180322Z0..........JP....110222182509Z0..........Jf/Y..120213142815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0..........YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu...120220131416Z0..........^..^..111007192320Z0..........`.w...120213144727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0..........hlG...120213145015Z0..........h.....120130140408Z0............j...120110213653Z0...........}....110406160143Z0............$...110401005006Z0................110401005536Z0............W...120308151704Z0.............h..120228141105Z0................110314145902Z0............`...110322142311Z0................110322142551Z0............lb..120110213802Z0.............0..130201130700Z0............OB..110321165802Z0.............o..110321172720Z0...........g.:..120221183148Z0...........Ud...110516131110Z0............h5..120229174140Z0................1202
<<< skipped >>>
GET /rpc/sendinstall?partner=ProbitSoftware&build=8.1.2 HTTP/1.1
Content-Type: text/html
Host: update1.smartpcupdate.com
Accept: text/html, */*
User-Agent: Mozilla/3.0 (compatible; Indy Library)
HTTP/1.1 200 OK
Server: nginx/1.5.5
Date: Tue, 10 Feb 2015 01:26:17 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.5.20
12..{"ok":1,"error":0}..0..
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=587666, public, no-transform, must-revalidate
Last-Modified: Mon, 9 Feb 2015 20:44:25 GMT
Expires: Mon, 16 Feb 2015 20:44:25 GMT
Date: Tue, 10 Feb 2015 01:31:32 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..20150209204425Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5.......l$.%t...............20150209204425Z....20150216204425Z0...*.H..............'.^.M......_.(.~....b^:.[&...z.^.W.<'g.[..N..Y.k...i....U.Kc-.:B....]#...l.^..S0K.OV.. ..D/&.E?./...~.z....~.E.YA....c.4...~.t.$..X.s......X@.......sx......... .^.....7.t...*T.=1.3..I...n..m.i9.6l.....!..r..;..8..V...._......t..YE.^9.7...*&_.a......dM.......#0...0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{(..t....2.Vf.....&;6).i*FK....W@....F....jnb.w._p.E.6.|.mk....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...
<<< skipped >>>
GET /pagead/html/r20150205/r20141212/zrt_lookup.html HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: googleads.g.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4
HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
ETag: 8281997907193036559
Date: Thu, 05 Feb 2015 13:37:32 GMT
Expires: Thu, 19 Feb 2015 13:37:32 GMT
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 5099
X-XSS-Protection: 1; mode=block
Age: 388119
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=1209600
...........;.w...... z}.UT..~..(.n.~l.6.t..^`sd[....mB....f$..@.{?.9......f<..q{...?....Yc....#..S.z.)..^[.yIp....Hr......2..<.q....s.H.(..'....^LS..<]J....2?....#k...|......ic...4c.^......v!.qC...E....s..Ga.0.oc.g..}.{.....2_.1.8 ...{u..jx.......i.'.....<.....(.\.......4....(..l...."GA..$^.=...x$;.q.O.M....i,.r.]...............38X........E.a....$...}A.A.....Ix......FF.l..x.0...BZK(.....N......a. 2.<-e>W.U....en>...8.X.......}....g/.....Etky..]..fMI.G7.%.iM...i...].i..9^A.w...yz.I......h6.....-.....T.i.(....8I.p~.q.T.Y#...?.|....M.>=...j..4.... J....;.s..G].9..G....T......'N......e......P.UL*m.A.......4:....x.(.........p.u.Ij!x..c..4...A.\D...mY.<_d}g.....6..1l;...0hY}.^.c...O..<..dle.0n<l...Q.MI.@.6[& j.y..Jt.....Q.7.....J..~M|.I...n...%M.....FtF.u.....$...})......#N.~..h.........6......._...8.mcx!....21.G.g.hyZ...x..V j......x.IWro..Z#...lP.\^.}...S..H...).[F..&..2......=0........v[..z.8.c... ......k....6..."x.@k.......D.&..*g.J=.K..@.....4...R..o.T......D`..)..P1.NP7......1p.....2@..*"...N....GTQ......g.Y<.@X....u2....U ...=...$..M....3..Y..X1#ZI...V..B.-......4....1w7..@..=...)(y.....l...ka.M...pohU.:CZa..!:..s..6...*[z...........#.....n...1.........i..._>....N.Ac.....4..>.'.:......s.w6...^..?.....-H.F.,o..;]ZxD.^.=.A;...I...4..2@.....P@.4....D};..W['...O.>!......6g..a....n.`j..d...........=..........T~^.,..k.....Z.$.TXR......H..".y....}.s.>.....k...0O..x.5...K.vTa9.8..._..h.....I..*|^..E.p.....a...h._..V3...\P./.... ....Q.E..$..E8^r%.2....$..|x.,./..h..O.BGf.
<<< skipped >>>
GET /pagead/ads?client=ca-pub-4844330334866922&output=html&h=280&slotname=4127509192&adk=2253242122&w=336&lmt=1423531572&flash=0&url=http://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&dt=1423531572346&bpp=15&bdt=311&shv=r20150205&cbv=r20141212&saldr=sa&correlator=6344100717591&frm=20&ga_vid=299294506.1423531572&ga_sid=1423531572&ga_hid=1303542799&ga_fc=1&u_tz=120&u_his=1&u_java=1&u_h=902&u_w=1916&u_ah=858&u_aw=1916&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=14&adx=1078&ady=160&biw=1900&bih=805&eid=317150304&oid=3&rx=0&eae=0&fc=24&docm=10&brdim=0,53,-4,-4,1916,,1924,866,1916,805&vis=1&rsz=0|0||&abl=CS&ppjl=u&srr=1&fu=0&bc=1&ifi=1&xpc=rGf91JyaTN&p=http://VVV.easydriverpro.com&dtd=423 HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: googleads.g.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4
HTTP/1.1 403 Forbidden
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Tue, 10 Feb 2015 01:26:12 GMT
Server: cafe
Cache-Control: private
Content-Length: 82
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.02
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`...`......\.[...HTTP/1.1 403 Forbidden..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Date: Tue, 10 Feb 2015 01:26:12 GMT..Server: cafe..Cache-Control: private..Content-Length: 82..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`...`......\.[.......
GET /pagead/ads?client=ca-pub-4844330334866922&output=html&h=280&slotname=4127509192&adk=2253242122&w=336&lmt=1423531573&flash=0&url=http://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&dt=1423531572361&bpp=3&bdt=325&shv=r20150205&cbv=r20141212&saldr=sa&prev_slotnames=4127509192&correlator=6344100717591&frm=20&ga_vid=299294506.1423531572&ga_sid=1423531572&ga_hid=1303542799&ga_fc=1&u_tz=120&u_his=1&u_java=1&u_h=902&u_w=1916&u_ah=858&u_aw=1916&u_cd=24&u_nplug=0&u_nmime=0&dff=times new roman&dfs=14&adx=1078&ady=456&biw=1900&bih=805&eid=317150304,828064101&oid=3&rx=0&eae=0&fc=24&docm=10&brdim=0,53,-4,-4,1916,,1924,866,1916,805&vis=1&rsz=0|0||&abl=CS&ppjl=f&pfx=0&fu=0&bc=1&ifi=2&xpc=KXefdQTk8l&p=http://VVV.easydriverpro.com&dtd=700 HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: googleads.g.doubleclick.net
DNT: 1
Connection: Keep-Alive
Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4
HTTP/1.1 403 Forbidden
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Date: Tue, 10 Feb 2015 01:26:12 GMT
Server: cafe
Cache-Control: private
Content-Length: 82
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.02
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`...`......\.[...HTTP/1.1 403 Forbidden..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Date: Tue, 10 Feb 2015 01:26:12 GMT..Server: cafe..Cache-Control: private..Content-Length: 82..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`...`......\.[.....
GET /easydriverpro803.data HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: download.easydriverpro.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 1367400
Connection: keep-alive
Date: Sat, 27 Dec 2014 03:35:05 GMT
x-amz-meta-cb-modifiedtime: Tue, 07 Jan 2014 06:53:47 GMT
Last-Modified: Wed, 26 Feb 2014 07:45:19 GMT
ETag: "9ac344cb3c8cb7f422f00aeed040ed46"
Accept-Ranges: bytes
Server: AmazonS3
Age: 20660
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 8XpmQh4Mxc8adKiUdXW5dTnt6A10GQfJpLe7wja6oaKRtin7Z6CNTQ==
7z..'......m$.......$.......<(...&......k.u....{.:.....Rd....<-WG.-.....o%..P..[.R..|=LuM...s....q/p_.%o.......j.....['.a.a.!=#/.._....D..<e.Q%(....0...W...2......!....2...aN.t......>....1.2Y.....S.....M@A..C...G<.7.^..^.%\rX...6.8c.o..d#.7L.4).....t.^...XN....l.$.....J.5a$.L......qIc.@..@4.R.o....V....}!.......w......JU.....`....*7...h.P....R_.]l....D.'.n...u,1M8P.|..}%..Hv/...g...SS....1..(.@.h.Z......j..:!......Z.j3'.*\.8C.u.S.!...{......}.$r\Z.....bG.}v92.4..Z...f......9.B..E......b.l.... <.1.$|......)..Y!.'.....T.3.y.#.O.z...vJ.44.m..&A.NP.s...".......9...........q]G1....nm...Z....-....2.d.........A..........Q....~.2>>=:Q.Z.-......9.//W.......V...5...0T.a.G/eId.^..=A\V.....0%..!.L.@..u.mr..*.x,........tJ.,E..i....a.[.]D. .....t...OOB......X....q...'...B..qY..#%P.....R.....B.0...h.0......G.D..~'bj.....t.......v(.....=............[..wE ..K.Ir,.]....<........`b.......4#.#.....&.@../.H....F...........e..0....s..J...{.V).V!pOc........N..i..h....E...^.v5..Y.Rn....>x.].|......L..9..02S...e&...m...A..F..E.._.p.}>W.!.`.d{....3z..@b~. ....H......W..;..9..J.L....ze..C!...R.....8|..6.N.-.......aB....*...{|.#R.L.._psDu.%.yPp....5.._O.2aOt..1g.W]..i..0..L_z....L....y.]%m.....o..S..g....Im~...0.z\.......S..m M...).J'..[...o.X.w....Y.....T..?.wY;p...M(.........C...sN.j.:#$.(..p.q.......F.VzG...N..>......."CX..W.....x.y-......RL'}X.IM..C..?.>=...#X.......P.D.mG..~bE...u...S0z.(..s..#.6.9Ro...6.........~.D?..$.96...(....]....7,.x..L6..P*...F..@....I{.'(.;=.IWi.......1.?.uN.#.&2... .H7
<<< skipped >>>
GET /easydriverpro803d64.data HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: download.easydriverpro.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 3503276
Connection: keep-alive
Date: Sat, 07 Feb 2015 22:28:58 GMT
x-amz-meta-cb-modifiedtime: Thu, 22 May 2014 08:09:25 GMT
Last-Modified: Thu, 22 May 2014 08:25:30 GMT
ETag: "88fcbdd2f3d077dc38facd8d44e7713d"
Accept-Ranges: bytes
Server: AmazonS3
Age: 7082
X-Cache: Hit from cloudfront
Via: 1.1 8813babdd85ca691e150294142d51c61.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Y-gvm4VqI7AkKIyHF-nZePvsh6ZjJxI04g5l1PXlc4Ook7UGvQ7T-w==
7z..'.....k~.t5.....~............).E.`...&d..&.1...!..m....9F..O....0..M.c.9h... ..F.....U...-....j.2Kd....D...oU...e.. ...u.>..*.6%.j..Pd<...l.....=.....&......o..t2..Lp.XUy[.P.....J.4E.....<.S&`..|Jb.;...EO....Z..FZr.k,`.4wtoO.0Qp...KSj...3'T...B;..F .t.I.....c{8...t..8..~.n.@O!...uv8m.K..\&nw...!.(.*.].a....p ...^......w.X...1..oW^S1....E...6..^...........1.54..;.C7'.(.>.j.."[,ux(K_)..\u7..a.s.;.C...2[J..z24.%..Pvz......r.(.8.XY..8..o/...'U..h......m.o.?>...........*W..C@q....]....dU..% ...*WB...@......B..r..%.n....N!..|.*8..c\4.r.:...Gt.4.d..\9.. jn.j.......x.....LRO.K$e.D..:&Jf....6`.~......9..v......_..\...7%....6...q.......~..e'.8.m.'.p...`....n........!.QL>. 5...!...._\R..*.d..L..T.....Y]B].<.b.H.u.`.........}...F..9W........:.]gn0W.....S7 .K....#..f.4..R..;.w....=IrWf9^w..N....)....c.3.y.>...1...VW5./.....'.r.g>..l..........,.....a..].|H1..D....*F.n.-.......-...Ht....~.O.,.Mt..S.D..#...J...i.r.vo.....'d{ t.....:..f{:...f{...7J..G?...[B$....e..1;^I"..z..B>v-K.S.z...~....V..U.... ...m.f2..Z .......k,x.&...R....^i.............#.@..Zc1..>..k..4.J...Jn.Y.9.}.l.>2...)./..b.7....=.......4.{F.<,.#D.m.O...7.[.)q<..8.s.x.......~8...n.x.R.F.'$........6'.DQ.....)^K,.~!b..m(3zh.....]...4.0...N...#..B...o.\B..A.oH......e1b8..F..&B.= .2%i[.q.<..i....Z...B...........s..a....wp.b.z.<..!.......).*...vw..*rO..D;........G2..F\.o=.?.S.7....L./r^.........=..........iY..N..=...V...C[y..$..S.u.:b.}.>4..`'.........6=..6.......p..Wq1.4. N..]P..K.C.o.&;.vW.....!'$b..M....x3.....
<<< skipped >>>
GET /pagead/show_ads.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 17196149217972916362
Date: Tue, 10 Feb 2015 01:08:40 GMT
Expires: Tue, 10 Feb 2015 02:08:40 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 7552
X-XSS-Protection: 1; mode=block
Age: 1051
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=3600
...........\ys.F.._...KQ.....5...v..I|.g.......".P...".....N..f_.....\===}.....,.#....I d.,HM.Y..U.........._.b.B....c..}.o ...G.u{.$..HD.J"...fo.y''.;....q..v.I...f7.?fI.M...C.%.. .Z_....'..-V.qkt...^......H.Rl...h...mm.y..".i.Uk...W...D.".n_...X$....p.....4c.6%..r....]......MU!T....a*Z94Z..} A.k..,.@.5Q.>...7.Sg2.1]..oT#.|..ou.up.&O.@8.Rcc..#..!7.Y._.N.$Nt.&..r\~......Qc..N%..b.94.|........v.U...?.....\..0..f...N..A6.b. .VpQmy.d..ppx_cy.t..Wq..G..,..-7......[./.^...{.Q.w9az$.[?.L....>...s..UC.p..I*^.1.......[...........>.[|c^7v[...w.....n&R.et..z....[..,...Y.o}|v.p.9...........5.?|6....z..[k)F..Y....;...ww.....%....t...<..s....x../.-h.].oC<.9..5..f....C..;.p`..-....A.oc..MjD..[.X......#..Vi..X.;<..6..!......4K.o.....w..c.F...$..[......n..lJy...8M4m..{...N.>>y..Y7.....0.K......S!..q.. ..O...A.k.?.nr..bb..r....D.tl...d...'...Hz...Z.6.X..0..r......W.(....S..v.m...B....-.......t.f..N.A..HS>.3$oh.*.R1w..%.4...1../..-7V,WI. }.DA&t......8...T..9...P....4...U.a.$y......l..}.Iq:.a...tJC5.:.*....0}... .'......D...C.0.....&......A......w.g....P.......$M.@...P.....x.r...).|..v.|.o.......-....*..z.N.....:jIi..............ZO>...\.U..w.6.%wm...y.HSo.1..iQr............q..Z{[od....0.E ....}...}[W.e\...0.?@...]^3...7....<=qF..I......U.......,.....2..TF..).G. !.n.GV...L.y..Hf<.D..V-.m.R..D0.5.q...gb....@ ........J[.J..H..]j.TH......T^.W.T..\.....k....f.;.U....5..X...Gs.s..$".D.'....a..`...Y....Ay.....m\q.........C0y....B.Wc.NEpX.....v.J..AV.E.x.L.....I.FF..d........C..6.`..SD...61..'..|.4.3..
<<< skipped >>>
GET /pagead/js/r20150205/r20141212/show_ads_impl.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 8853379017671385099
Date: Tue, 10 Feb 2015 01:26:11 GMT
Expires: Tue, 10 Feb 2015 01:26:11 GMT
Cache-Control: private, max-age=1209600
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 54705
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic,p=0.02
............g[...(.._!f.b....p.a. @6.....d=....5"..........|.=.~x..B..:WWWW(vnG..?...?w..0tf.~.\.Q...g..n.......*.......`...?......? .e..}.....{Ui.G..^...C.7.i.2...P.....f6..xZ.p`..A8..zkk......Y.4ms5Nq..g.....x.T....(..b.|........s..pv8.f.......n.....,.......P.$.l....'..Sp.~.h....?3..3!.y.o./j.l...}4y5....N.9% "S.........t<.c....9..G.....P.5......?...-h./k.m.W.|...6......N! ..F....a.?..c5N....e...I8.=.F...N]o.yW.....f...Q.}/._.7.Z....&!..Ar..E8......B..b..*.,.D .d..."'{.F9.P.....D.X'o!R..*..0.E..MZ6..6..9.5.e_.n....]....%9.4^8....m..q..Y..v*.f..L..E....g...s8.E0R?.%a.V]s........0.m...UN..oq....6^..U.:Y.m../....W.M;..vD.Ot.g....q..."[k&..6".. 3"......q(.........*.e......G......q.[..w..r...D{p..st.........a.............C...P.I.. .\g......~>..m.O.L_.if4=W|.^.92..../.,.g.*.x`.q../....}/..g.F.zL....2..g....B..F.^..:P.8|.|...}..i...i.2;...Jf..r...v.k)t....o.]..0.t...N...F..........N...o.......w~....../..q8...Z...E'..<.......Fy.F...j....q....U.../...Q..._o.......g.-...uUY..*..g.l...c........................m... ....l&...M&..`.J.{...........,....8e7.... ....Pc`.j.F..}...q..L.).q.G.....M9.A^.8..$..r.,z.:c.[..0.....,}..6U..0L.~.f.Dc.Y...lB-.v..N.....L..L..L..L..D...ZY.g.l.J...e.4.Fw<..B7...r0......xS..3.0.....n...](.Y....Q..]:........s.|..|...#.W........PJ.\X...p2p..o.......J.4W_.6.........L.......5w8..S.u0n0.....MD.0...8.....l...~R\...X....It"..k.......a.MhI[.t..L......2....3?7..3.=..~...c.".%.....f.D<b.$r...=gc.f...;....w..._.~....~../..........w......-.....`...f.uvX.z...._h.0..8..#f...b.-..1.....7.....
<<< skipped >>>
GET /pagead/osd.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 5172368612601503256
Date: Tue, 10 Feb 2015 00:55:46 GMT
Expires: Tue, 10 Feb 2015 01:55:46 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 18390
X-XSS-Protection: 1; mode=block
Age: 1826
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=3600
...........}gw.J.....D..#..c'.#e... @..P.?..4.M.......w.=E#Y....K...u...g.A2...~..R.W.....0!...,Vq........^..X........V..|-..k..'..h:.._.....L.D.p.....ZO....../yR.t.....(0........9.q3...l5.'...{.....ns....P[c..Y.Q/TUQ......[..i..bzD.7..c9.......w.()V.J....0[......_2.z.b,....jw0..A....cq.."=..^TNsD....H...........M...qw..%.........._..tx...$.6..B2j..ZI.so0..r._.Ov... .Yw So-..QN.].....Oo.&.P.....i..#|O.....c[.R.>u..[Y-...Q....Af....D<\".Z4.T...@.........,.Zd......T.C./8....[.A.L]....N.I.`...K....*..yj...?....P..~..3w$., .$..J.x..h...E-.......8.N.....0Qk".v.........m..].O..jq.i.8[o.KU.;..m..Z-A.._...r... ..Z.R[..a...b...d..,..; 4"...-.~.......]....A.>.......v/.j2La373...D.^...$...[.p...7..........k...S1...%...(...*!...O...PL.........{>o....?..z(T......F.........C.......ob..c.?.1....9.]...pX.X...L.3yo.6...}....3.V....f".1.\#..........a..?X...c9........M..E..1.o.....`v..@.w..P.....4..&.u...@. 27.......(..\N.....S..U...%.......y...?....ae..-........U......./(C....Y....u..[x..s..O.....<.../x..'.....z....O..Z[l.Uy...(.u ......&........2~(..Z_\....L............w......f...v....z\....$...#...........x.kC=.?DF.....#.<....S(........^!..>4..(SK...M...c).../.J.01.......>..F=`..2..N.....M:..~.$..04X\u.@..(...'...<.f.....F(...FX_....,../......o..M.Tl...X8.....?..Lz.&.S........Wt{.t.....t...N.Z......{g.....v....j...^...v]...px...^&^.....j....x.~..`.7........6.@.P...Y .~n.....|S...q..z-........q..m1.t|....`.....}j.a"..v.2..!%~..U-......zD.r....I..........*<5....{W^1............x.......Plh...MO9....
<<< skipped >>>
GET /pagead/js/r20150205/r20141212/expansion_embed.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 11869618118241093315
Date: Thu, 05 Feb 2015 13:37:29 GMT
Expires: Thu, 19 Feb 2015 13:37:29 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 51404
X-XSS-Protection: 1; mode=block
Age: 388123
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=1209600
...........}iW....w~...2R.........[..-,!.0..f....fK........gr.y...........N....3.....>..X...;cv.........Q..0.D.....).<S...6..:...Y...F6...=.z!f.;..v<.....^o.... '.?^.......z.w0e....c..l.....0.$..A.. .......v.e..J.?..~..VG#....,..../s@.8j.....".6..&...6..OF.~...^....\..T.:.h.x.#.Uorl.b4.*..b..o.x..jJ.^.oM....}?..N?...4..=.g..@..h..3......zPv.<..Dc..[.9s............iL.T:".......A..@.C....2...#.oJ.t.........8eQ. R.....2.@.#...S6,.xL f.....r.f.lRV.X.9..l.s.Te... .0....=em^.9.E..^^l..W.-.4.......Q|}.......|.z.O.....sk;.>|.;...:..-...i...5>...m^...1>j...'c...X..d.;..h.X....]..]~...-....tH..?.."O......Wrx5...../u.'.)...Hw.e..f:-.Z(f,.......W....Wraan.1? W#@...g.t....'.....".%..wo..U..x.|2{......l.1k..<....Amx?n.,G~E....J..............~.X..){,..I.Y.....~..W......?..q8..'//..mam...S:.{...v.......|.sk.N3......|.A_.%...=....*!..0]g?H.{s.v.I.FA\..L.......p2...r..f.!K._9..._;.........n.8z.j.i_t...|.w....;.....%.6l'..^.=...U..R..8...~...m.2'.gu.z.>/. ....!..m...<....e...^........[|.!....A.T,....{..p.O;.I....p.........dPk..#.........#..._-......r...#...'..%'..lX.:P8.Jc.<.b...h..~.U_.......,.....B.........cgF.8..."$.r.$........J.O...\....1o...R.q...=..Zp....}~.....x2..|..0..pWF......_>....WK.I<..A.q... .:..2.H9..ni.(..p..../......,..{a...\.G...CT.SL.`9.P...^&.Y..v..../..P..K.&e.?..?`.VY................m?a..V....|......B.....&._Z.%...........?.............b..s.?/.......WKl-.0.........S`4iDld...D..[.dG...X.F...^.x......k...S.............g.(nm>.m....^;...k.bV..Y.I.....o.3. ....\@... .....
<<< skipped >>>
GET /connect/xd_arbiter/DU1Ia251o0y.js?version=41 HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: static.ak.facebook.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Encoding: gzip
X-FB-Debug: xjz1VMVpl/qb1OpGI1MMiqBhmjEREqYWadEbi0BhC7laBxWyw0R08APcuW /X8AhtbiXk36kn8W8gyJPQ1I64Q==
Vary: Accept-Encoding
Content-Length: 9954
Cache-Control: public, max-age=30374239
Expires: Wed, 27 Jan 2016 14:43:31 GMT
Date: Tue, 10 Feb 2015 01:26:12 GMT
Connection: keep-alive
...........}y..F....)T...F...g.*...........g../..$..%.*(.}...CJqT.w..v..$.....W.T.g/?....... .G....3.."..._.f..%..z.&Y.|..Y.[.x..I.O..G..^.e....;J...E..."....[.y..|..Z.X.........s.<M..5N.9)o.x.{y...#.h.(..QD. M....Y_...*M...?.....0......2..8..o..-K..e.D......g<>..>..0s9.......0~2.>...$....".J.....,O......{.....J'7...?.V.B.q.......f....Yq..C...XRDq ....].F.9s.4j.|.;...cN63:o..h.q....Q.cQ.x...Io.....m...n..x<....R./....v8SL...Q..={..d../:$........7....../b.....U.z.*.'...T.*<..I...i.'.u O>.)0....XA?..$...8S..q...........v....1'........E.z..%.%L........@q....q6.-1....?>.".~...[.e.[#n1.."x....1n.M....No..`...|r1.M... x.u.....;q9!...M.&..$.....5t.;..h..........W.a.....j9l.....bM....v.!&......IvtG..5V# .F.....C.`0....iCln.. .;...2n..N......!..)......l..s..;...q..:.-.e0v.......9RVR..cI.%...........:.{ .K........^.1A..X.]........0cW.@0......"G.*I_1/ '...&@....S#..(.r.._.(@...)..P"(<D.F...".Fc*.8"..b.....!k.-...tM.....&h^.F..h5.%.(.^.l.JI..*.z...M@...;)..............K... ..^.....T.y|i!...cr.|o..d..z.-.6v.`...t"`../.F.;..V..f.../(`....F,..H`.[..q..f..q.....YB..j.C.bL.z..R..}M {)v.. ..l.. zk.[!...M...OH....(.wh.j.S.8'...u..N...i....hpI;WAw.,...w=....&"7@..A..N..`.....V0...!S....*L.5...[..I~hQ.M.A..Rh.c...HX.dR1....\<...F@.Bo.,.p..L..Br..b. J...Fr,....R.r..'.;R.A.@".B..Q#......./......]...n H..,...m.zf. .>.. '........,...f..?.Hs.I....V...}C..M..Y..!.....s.C..4...LS....R.hs..0.=F....{....i.G0......a......2P...&........6.W,........`...3TR#..u....uF.... .awm...cw...Q...x.Y.z..\.Q.>...K.I.
<<< skipped >>>
GET /PublicSureServerSV.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.omniroot.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=864000
Content-Type: application/x-pkcs7-crl
Date: Tue, 10 Feb 2015 01:26:14 GMT
Etag: "2b002b-472b3-21577a40"
Expires: Fri, 20 Feb 2015 01:26:14 GMT
Last-Modified: Mon, 09 Feb 2015 22:17:05 GMT
Server: ECS (ams/D1C3)
X-Cache: HIT
X-Cntnt-Length: 291507
Content-Length: 291507
0..r.0..q....0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybertrust Public SureServer SV CA..150209214805Z..150219214805Z0..p.0......... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I..101116165848Z0.........,U./...101116173007Z0.........,U.h...101116172944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0.........,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..101116195619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0.........-..4...110315204303Z0........../P....120206141831Z0..........I..@..120124180322Z0..........JP....110222182509Z0..........Jf/Y..120213142815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0..........YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu...120220131416Z0..........^..^..111007192320Z0..........`.w...120213144727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0..........hlG...120213145015Z0..........h.....120130140408Z0............j...120110213653Z0...........}....110406160143Z0............$...110401005006Z0................110401005536Z0............W...120308151704Z0.............h..120228141105Z0................110314145902Z0............`...110322142311Z0................110322142551Z0............lb..120110213802Z0.............0..130201130700Z0............OB..110321165802Z0.............o..110321172720Z0...........g.:..120221183148Z0...........Ud...110516131110Z0............h5..120229174140Z0................1202
<<< skipped >>>
GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.omniroot.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/ocsp-response
Date: Tue, 10 Feb 2015 01:26:13 GMT
Last-Modified: Thu, 05 Feb 2015 09:08:42 GMT
Server: ECS (ams/D1C4)
X-Cache: HIT
Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..20150204214606Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M....'.j....20150204200915Z....20150505201415Z0...*.H.............AZ..f......\i.../e....5.........%...j........<A.J.K0....|.!.z./jn.....>.i.g...3....^yjS...h.T......w..(..k.Z.5.xe..."oW|..3*..$......4G...E..C......t..-`.a.kFF.~.;.^.2.........n..p....p.FE.z...w.J.<.c.....L.w..;s.....-v...,.-.=...h.$..%.99..p).i.t 8...U.......0...0...0...........'..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM..*.4.MP..../D4n.=ZTeH.B=kOT.v..2@F.2L..A...yn.4......fP...L...2.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>.O....G.A........0..0... .....0......0...U.......0.0...U...........0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....j.t%..e.....(.h@.Z.7.a!m...sZH.N..>.S....K..........7wi3..x.D..l..ud.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&....q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?....E...........'>..O.._..
<<< skipped >>>
GET /CRL/Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com
HTTP/1.1 200 OK
Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 04 Feb 2015 20:30:01 GMT
ETag: "2015b-6ca-50e490d4402ee"
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Connection: Keep-Alive
Date: Tue, 10 Feb 2015 01:27:54 GMT
Content-Length: 1738
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..150204200915Z..150505201415Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'....141112202254Z0....'....100217174732Z0....'#...100303201301Z0....'!...100312202204Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z..0.0...U........0...*.H.............Xb.F.M4hYy.h~...2.... .. ~.A4...F...gyQ.....:_..g.|
<<< skipped >>>
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?924f477917498068 HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT
If-None-Match: "0b96c77303ecf1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ctldl.windowsupdate.com
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Fri, 23 Jan 2015 02:29:11 GMT
Accept-Ranges: bytes
ETag: "803565fb436d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 57591
Date: Tue, 10 Feb 2015 01:26:44 GMT
Connection: keep-alive
MSCF............,...................I.................6Fm. .authroot.stl......8..CK...<T...g.v!M.d..f.%d..}K..5......dM*K..J.,%K"...!..=.k..........{=/....{g.~...............'....6..N....w......(.$.>.7...........'.....`.bx....^..$.'.^.K.C......<b=J..u....@.....2..e....pr.....usXq.d.i.jF$.4.........KI.Q........A2m:..E.P|...(.^p..=G|.....m...... .6...H.e.....X'...%$r.Y.(..)........|...;...V^r.VM.._*X.I. ..4.....*.....Y..`.0w.u...c.i.[..-...x..<.8.<.p..,..y.[v.Yn`......!.s...4e......B...$.,..........w.Pd.)....,..#.%..h...8...`.A...8.i(.!.$/.=.....i.\X.H......"...a...k...y6....F.._?\*.&..3.AJo.!..`....9....=.p.u..u....f.f....w...?..S..I.;.....5._...F.f..G?$......."..kq.y'.6tJ.e%..G.n.....z<.pX"....1..g."........V:.H.-...!}LM..t..-.y.j&...n{..-.]H. .....A.O.Xg..B...#.f.-..V@.g..8.....Ov...ET..*.....T...}o._./S..h@$.....!.@.D....c...A1..#.:?."....1..v.....&G...?O1x6"5.@..$.U...n.J...w.Y.{..........E.N.&...&.rC..W.....M.........,.e.....&eI(/eSO.B..K...R. K...s.@9....Jv.....(..Y./;-..M5.0.H2.y....:...........a.U....%.S.).^....1.B..a..=...q...X .B....F.../..../.Z...'..t....C....,.^...N=..t%N|IC.#.)6...q.E.J.i.E.>....".L........>...Vy.7.jxx......G........._q.1^..H&.4Z......^.E.K 9.Xg...qO.6%>..T....;n..s.'u.-...=.........p..p.Rn.........=.......F........d. d.AR.0U..........9b...=N..#....c.Icz......u.0............Y.q..b.wYE.......R...s..W....r].....hT....k.g..[...s.....X..`=zb.>..../..=........J.N.h...(}.5.7. .;..=F..F...'.?..2...3...=...B..`....{...f.`Kb..@..`Z.0!^8.t..<l.j..lI.P.q.>k
<<< skipped >>>
GET /publishers/3/524/EasyDriverPro.app HTTP/1.1
User-Agent: NSIS_Inetc (Mozilla)
Host: download.easydriverpro.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 720864
Connection: keep-alive
Date: Thu, 05 Feb 2015 00:49:33 GMT
Last-Modified: Thu, 05 Feb 2015 00:21:46 GMT
ETag: "19746a029c39d9d1c3ce2b7976dbd107"
Accept-Ranges: bytes
Server: AmazonS3
Age: 15330
X-Cache: Hit from cloudfront
Via: 1.1 1f8a17c41295fac39556a328869a62bd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Q3j5Dh02UWR1ikauAXNfv7Mlp5ShwMS1WdpCiv0LOCY-2xAKnWZRSg==
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@..........................................................................t.......P..@............................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...`...............................rsrc...@....P.......z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>
GET /en_US/all.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: connect.facebook.net
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
ETag: "a7753d52056f88160de1b42f583ea64b"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Vary: Accept-Encoding
Content-Encoding: gzip
Content-MD5: ndCHfHKV3D5/ScKX/a6nA==
X-FB-Debug: n6C5MaH2G5Ie8Fvsw4X2hweW6jy7 /HkoZLsxFnM/3kmZcf6fugZxGKPuLeBjexF1SpTq5Be9hVPL0r 9dXBYA==
Content-Length: 52552
Cache-Control: public, max-age=1200
Expires: Tue, 10 Feb 2015 01:46:11 GMT
Date: Tue, 10 Feb 2015 01:26:11 GMT
Connection: keep-alive
............{..../...^..$.1.(J..4...%.....=.l(....H... %Q..k..[..h. %'.s~.l.......U.U.G?.?99}z..E.........x..g..<.'......O.>.....o.~:._......W.'*6]..^.^..t.v..K.'.*e!....N..[ZL...4...7..C.T.W.k8K...I.....|Z?:.....\...zG#).......O...J...5.-K..h..o..~......b...K.[Z...`VJ..e./I.W....8..MRU.4.8.|.Mh.~.:.....'..{4...U3M...q2.g..(S@'z.Q..6..S..f .....j.{..V......K.x:_~.P.....[-.w.E...|...]...b6)...E..A..s...Yx..f..ju.).. 2.........tz......Qu..w.I0.:i./...~...b.r..4........c..Kw.].;.~.|..|...p6_.C.U..4.....k..A.K]r......,.)M.....,..._y.%..V...P...R;.'%......|{~....~........e....eu.Nz..7..~..qI.....5F....RqW.M4.......]u...T....^.=..aC.5@.QU?2...)?..k.S..,.........a.I>.$X..i.j'...(.......t.....L..L..e9..n..eMJ.L....f...y}^..r.........w.5.W..z......N<..sZ{O.\_...M........i..../#.....y?J\l.ny....of.`I.5.1.}.y....k{...1....n.U..4.N..............;]..@ .E...G).M.`.t....^.........hR......./..<$Q.!.LM....P...D.s..)H}...(........hB...z...F..Z.<h&..zvC=/w,hH..WS.....p..............-.@.?........F...3.....F......PP....!.:...M..3..c.af..1.A..~...[.b-v#ZS..~...F...#iD...H...U?8.5..h..u........5.........A...7p.fb...=.. ......x..T)...i.....z.@........S=.j..H...z..$.1.{U.4,..;R..."M.....2..F.t.,?..oN;&...T....^G...u.g..}X.....h.3P*....f.|.h.T.......p...8])Y(...GX..H?.p...H.Y.-..14s..,$.i..R...<.....x.........&.{4....#..Qu..3.O[.`............b..g)j4./..l..S...v.t......._.G..|....Ws.H5g..izPV3..DA|..@Ty.....n.Q...&...s.h(.R(.\.......4....7...CC./....EG..,HH.......n...M>..I.A.~.P..G.*.,...F;.c.g......K..'.(..3.....
<<< skipped >>>
GET /cgi-bin/CRL/2018/cdp.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.public-trust.com
HTTP/1.1 200 OK
Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 04 Feb 2015 20:30:01 GMT
ETag: "200c0-420-50e490d42fd35"
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Connection: Keep-Alive
Date: Tue, 10 Feb 2015 01:27:53 GMT
Content-Length: 1056
0...0......0...*.H........0u1.0...U....US1.0...U....GTE Corporation1'0%..U....GTE CyberTrust Solutions, Inc.1#0!..U....GTE CyberTrust Global Root..150204203344Z..150510203844Z0...0....'.x..110110211653Z0....'....141119195306Z0....'B...141119195752Z0....'....141119200006Z0....'1-..150204203232Z0....'.:..071121154528Z0....'.v..080219183346Z0....'....080514142515Z0....'....080515170349Z0....'....080924143337Z0....'#...081203144336Z0....''j..090209174351Z0....'b...100414181148Z0....'....080917150432Z0....'#...081203144209Z0....'#...081203144241Z0....'#...081203144304Z0....'%u..081203144409Z0....'/9..090318130930Z0....'8...090715181853Z0....'TU..100113191852Z0....'k...101130163724Z0....'.B..111107193907Z0....'@...141119200409Z0....'....080917150312Z0....'....140709175318Z0....'....141210173900Z0....'-E..141119195854Z0....'....141119200037Z0....'F...141217193909Z0....'F...141217193956Z..0.0...U........0...*.H............&O......@<7.@..a%~Uy.A.u.F...........?..a.wqf?.....U......m^....%..4.>....}.). ..%...GD....S...Y.L.D~....t{..@....^N..q..&EXR.p,HTTP/1.1 200 OK..Server: Apache/2.2.15 (CentOS)..Last-Modified: Wed, 04 Feb 2015 20:30:01 GMT..ETag: "200c0-420-50e490d42fd35"..Accept-Ranges: bytes..Content-Type: application/x-pkcs7-crl..Connection: Keep-Alive..Date: Tue, 10 Feb 2015 01:27:53 GMT..Content-Length: 1056..0...0......0...*.H........0u1.0...U....US1.0...U....GTE Corporation1'0%..U....GTE CyberTrust Solutions, Inc.1#0!..U....GTE CyberTrust Global Root..150204203344Z..150510203844Z0...0....'.x..110110211653Z
<<< skipped >>>
GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: vassg141.ocsp.omniroot.com
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 1765
Last-Modified: Tue, 10 Feb 2015 01:14:33 GMT
ETag: "b35a82ba5004878b337e0aa43271815578f62296"
Cache-Control: public, no-transform, must-revalidate, max-age=339753
Expires: Fri, 13 Feb 2015 23:48:46 GMT
Date: Tue, 10 Feb 2015 01:26:13 GMT
Connection: keep-alive
0..........0..... .....0......0...0..........[us..Ni......f....20150210011433Z0w0u0M0... ...........]d...N....P5....0...l.|..2...A@...f./....j3."d..Ii...............20150210011433Z....20150214011433Z0...*.H.............#.7#..... .?....,...=8..g..........O.wD`...mT.Z..k.A..X..2.....e........$5&.Z~B.$[{hYoeV..j...).Q.....8..lj....Y.{....lOlXq.Z@....uhS..C......A..S..Tw-5K...e..........g.....d..D.'\E.WT.d.B.........\....1q.?.......c.$|.F......e.......a....'.....r.b3$.G. .d.....0...0...0...........=......Ri..\..(.{..0...*.H........0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA10...140410115548Z..150410115548Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1806..U.../Verizon Akamai SureServer CA G14-SHA1 Responder0.."0...*.H.............0.........f..).1.............Z.45..l. IB..r`...f....h.....h..._i'...J....|.c....E.D0bg.b.v..........:Q....W._U.w..3....i...k........t.....m.CO$..j@.....>..Q.m......1/Z.r......L..a.n..;..KoIY.......fk{..c..d...IU.......zy.X...zp...F.1..F......b...Z...=9.o...N.fL.%Z.........H0..D0... .....0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure.omniroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a.omniroot.com/vassg141.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vassg141.der0...U...........0...U.%..0... .......0...U.#..0....l.|..2...A@...f./..0...U..........[us..Ni......f..0...*.H.............Fk:..%..H.:.|P.;..-3.
<<< skipped >>>
GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com
HTTP/1.1 200 OK
Date: Tue, 10 Feb 2015 01:27:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=d805ab16eb5eddc9ccdcb26c49110f6d81423531636; expires=Wed, 10-Feb-16 01:27:16 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT
Expires: Tue, 10 Feb 2015 23:51:50 GMT
ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b6485f8184d05d5-WAW
0..........0..... .....0......0...0..........<.|7...@N6p.I.e|..20150206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0... .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f..&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Should be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q...........bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... .......0... .....7....0.0... .......0... .....0......0...*.H..................sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>
GET /css/style.css HTTP/1.1
Accept: text/css
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.easydriverpro.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=9plslcodkrdkt0b2obpi40tb87; AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684950193DFB88BE41987C7E156D7F91AC9932BE17ABC54889040364137740AF66719939B1ACEB47879F9029F784CC65A8
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Tue, 10 Feb 2015 01:27:57 GMT
ETag: "24236-1cb7-4f20b0ddd1f80"
Last-Modified: Mon, 10 Feb 2014 10:46:38 GMT
Server: Apache/2.2.15 (CentOS)
Content-Length: 7351
Connection: keep-alive
body ..{...margin:0;...padding:0;...border:0;.../* This removes the border around the viewport in old versions of IE */...width:100%;...background:#cccccc;...font-family:Sans Serif, Arial, Tahoma;...font-size:90%;..}..h1, h2, h3, h4 ..{...margin:0px 0px;...padding:0px;.....}..h1..{...margin:10px 0px;...font-size:22px;..}..h4 ..{...margin:0px 0px;...margin-bottom:5px;...margin-top:20px;...font-size:15px;...color:#6e6e6e;..}..p ..{...margin:0px;...padding:0px;..}..img ..{...margin:0px;..}..a..{...color:blue;..}...body_wrapper..{...position:relative;....clear:both;...width:960px;...background:#FFFFFF;...margin:0px auto;...padding-top:5px;;..}../* Header styles */..#header ..{...position:relative;....clear:both;...margin:0px auto;...width:928px;...height:55px;...background:#FFFFFF;...background-image:url(../images/header_bkg.gif);...background-repeat:no-repeat;..}..#edp_secure_site..{...position:absolute;...left:265px;...top:5px;..}../* Footer styles */..#footer ..{...clear:both;...margin:0px auto;...padding-top:30px;...background:#FFFFFF;...text-align:center;..}..#footer p ..{...padding:5px;...margin:0px;...text-align:center;..}../* Top Menu */..#top_menu..{...position:absolute;...top:11px;...right:10px;....width:520px;...height:31px;..}...menu_item..{...border-left:1px solid #0c4374;...min-width:72px;...padding:2px;...text-align:center;...vertical-align:middle;...color:#FFFFFF;...white-space: nowrap;..}...menu_item a..{...color:#FFFFFF;...text-decoration:none;..}...menu_item a:hover..{...text-decoration:underline
<<< skipped >>>
GET /images/header_bkg.gif HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.easydriverpro.com
DNT: 1
Connection: Keep-Alive
Cookie: PHPSESSID=9plslcodkrdkt0b2obpi40tb87; AWSELB=15A7D78B08CC57797F87EA072FDB431CC5F43D7E684950193DFB88BE41987C7E156D7F91AC9932BE17ABC54889040364137740AF66719939B1ACEB47879F9029F784CC65A8
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/gif
Date: Tue, 10 Feb 2015 01:27:57 GMT
ETag: "24abc-1fff-4f20b0e6673c0"
Last-Modified: Mon, 10 Feb 2014 10:46:47 GMT
Server: Apache/2.2.15 (CentOS)
Content-Length: 8191
Connection: keep-alive
GIF89a..7.......Xy....z.......F.{d..F.........Nq....^~.'P.ly...5...Hl.....................<...Kn......h..\Af....Qft..YEi......x..J...........JUv...RDb.8_...e.....G..:Xk...e...<b.t..Vv....zyyQt.:`...-..w......}vi8[......4..Z..g^s.......oru........Bs..s.x..=Z{...=..J|....X"L...8.N.Ku.j..6].....P..V...f.K.Z..u.....4[.2Z.`{.f..s....5.....f%Z.......m.. S.akl?d....6Z}So....!R.Ch.h....g......j..........tNj.co|Ee.:b.)T.R|....Pr...e.....J...o...........6\....e....FDh.-a...\...Mo.a....{...6d.........Bi....]o..Z..c..Dl....Mt....@^|d..Vt.l.......8f..=g.b..3f.f..U..9j...u..S.U.......(Y.Jj...rAn...N<j.&R.c..$M.St.Mg.Gk.c..Mm.Fo.2^.c..4Z.c..`..h..$N.%O.-U.)R.0X....0W......./X.f..;m....}.....@h.\x.2Y.<`.@_.,^....c..(V.&U.......,T..U.......&Q............q..f~..oph3k.5h.Hp....[{..........!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:7E45C53AF2E7DE11B465A20C290F2B7A" xmpMM:DocumentID="xmp.did:30407F2DB98511DF849FC9FFCEEDF3AF" xmpMM:InstanceID="xmp.iid:30407F2CB98511DF849FC9FFCEEDF3AF" xmp:CreatorTool="Adobe Photoshop CS4 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:961985C0E7FADE
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1453
content-transfer-encoding: binary
Cache-Control: max-age=547920, public, no-transform, must-revalidate
Last-Modified: Mon, 9 Feb 2015 09:39:15 GMT
Expires: Mon, 16 Feb 2015 09:39:15 GMT
Date: Tue, 10 Feb 2015 01:31:29 GMT
Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....20150209093915Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20150209093915Z....20150216093915Z0...*.H.............~0...hO6...:&.O........D......Bnr.s.PL.....a.......|..]'[>...`......I...P<I.$.T.....s..zF....... R...39...<.. J........~..{.g....W#..............|.r.l..<4.b.....er.kw.3.....P[.........Q.....Z?.Sa.........6.F......8.{E.[......mQ/.@..4......X.1P."O.\....3.S.....0...0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0..........'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T..pS.p..^|o....S..v.).).....r.v.qo$......C.V!....@.h#qh...u1T.].G0.]E...=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.............$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,....
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=587659, public, no-transform, must-revalidate
Last-Modified: Mon, 9 Feb 2015 20:44:24 GMT
Expires: Mon, 16 Feb 2015 20:44:24 GMT
Date: Tue, 10 Feb 2015 01:31:29 GMT
Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..20150209204424Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5........M.s.Q~...@?j.......20150209204424Z....20150216204424Z0...*.H..............2..T.U...=..C.V....Bo9..e..2.....S.'.#../Y].k.....n..1.8J\..PM.xY.P6H.....Q9...]...Z..d...Bl...!..7W.P*..-.a.-...q.f'k.d.Z...o.. D.q.8w.!.:..8...C0.j.%V.#&.d..n..Q.,..kE.s...*....p..7....~..MI.LFE....e../.....\..,Z.clG...v.R....Q....o.w..`...@^...%...K..,...#0...0...0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at https://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{(..t....2.Vf.....&;6).i*FK....W@....F....jnb.w._p.E.6.|.mk....(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H......
<<< skipped >>>
GET /ga.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 10 Feb 2015 01:04:32 GMT
Expires: Tue, 10 Feb 2015 03:04:32 GMT
Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 16151
Age: 1299
Alternate-Protocol: 80:quic,p=0.02
Cache-Control: public, max-age=7200
............yW...8.?..|{.....S..7.(m.....Ms.dY.iB....%.g..A..$...y.z..%..<mm.I~2...3....k9Z.2.}5....G.........dx.O:.Nz'...:.....I*b.v.o..q....Bh..z6..V.|.})...H..Q.Y....@.a4....'...`....3i..RC.%..0.Fz..J{.'C/...#O\BP]..^..../e..<1..p0...&.i......f{..zm..'&.w1...:...Y:...........p....`.n4....vz.W....|\c.-GX...:...5.y..".F:.. $....'..b2......k....:.....e.. t-{..^.^.....P....3........d..6.nM...."...^..|..1z......dq.t.}.....I46..Kb....1..A...t...q.N.7zt .P.a......o:0.>..$Y..x:=.$.....r./..0........n.%.vA.Ke.*....P/.....My..\..t...J(WW....,.A..<Q..........E..e.(.K.$......uBa ..1..yN.v..E....D=...:..[...>..zX.l^.._..z C..o.......Mk.............^\.G.I?.7.[...l.l=..@.......;...e./y,.cR.w`.d_...0.L/..F.q` j......y.5L....Zp*....#w0.%....]..:T..W...l.4.1U.,.W~.q0.=XO.z'..f.,/e..K..P".F.e..^..9..S...1..1..J.. .4....WW....K..I..x......\....@..c]...tj..3w$...cA... XD..F.a.......3...?..41.!.w}..T 8...vj..(.....q.P...........S^r.......A..X.e.K=J.5,o..0..Q.|=.v..l........j..';...B..$..-....$Z.R.L.OB.tL/:....t..g[..:A......i..4o[e8..3grr..SJI...2...\YW..j3.^J%.................x.?.6...){...o..V.c.........@hi.8.=..jR....]....x^.`.<..7........y1..8...YT...iLm}..Ye7T. X..d..T L Ui.....q}........#....elF.........m.6-..[./.-.x[{5 ....,.<....b.e..aK\].VWMZ....{.x(....O........p..[3I.@....4.)..x...Fk......4.Z.i p.7..`>.o.Z..O*<.c.....i.f...fk.g....J..a..y.....c_.X..%..4.Gz.M$....j5oe.0......$T~..}....0FtC].`-...Z.O..V.:Z..54o.4...oI...... .) ..6*...Y.1......B..-._..{r..1]F.....f..|8..u.OY...38..}5.c.`.. ....`.
<<< skipped >>>
GET /r/__utm.gif?utmwv=5.6.2&utms=1&utmn=1414896808&utmhn=VVV.easydriverpro.com&utmcs=utf-8&utmsr=1916x902&utmvp=1900x805&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Easy Driver Pro - Welcome&utmhid=1303542799&utmr=-&utmp=/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350&utmht=1423531572420&utmac=UA-15244178-1&utmcc=__utma=234048906.299294506.1423531572.1423531572.1423531572.1;+__utmz=234048906.1423531572.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1021910407&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.easydriverpro.com/thank-you.php?ins=524&umi=B48A115F&iid=15379358&sst=7c1d0bc99d0398a455df316a762fe350
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)
Accept-Encoding: gzip, deflate
Host: VVV.google-analytics.com
DNT: 1
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Tue, 10 Feb 2015 01:26:11 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 10 Feb 2015 01:26:11 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.............,...........D..;..
GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.msocsp.com
HTTP/1.1 200 OK
Date: Tue, 10 Feb 2015 01:27:16 GMT
Content-Type: application/ocsp-response
Content-Length: 1757
Connection: keep-alive
Set-Cookie: __cfduid=d8eedd0800ce70630ff3ce165c58a514e1423531636; expires=Wed, 10-Feb-16 01:27:16 GMT; path=/; domain=.msocsp.com; HttpOnly
Last-Modified: Fri, 06 Feb 2015 23:51:50 GMT
Expires: Tue, 10 Feb 2015 23:51:50 GMT
ETag: "9006297540e316688484ed9e4b46a0dce7b0d372"
Cache-Control: max-age=345599,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 1b6485f7fef805e1-WAW
0..........0..... .....0......0...0..........<.|7...@N6p.I.e|..20150206235150Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.{.....Z..w...d..\.-....w.....20150206235150Z....20150210235150Z."0 0... .....0......20140206235150Z0...*.H.............Q."...T1..ý.Rs.(..%l..<.....qN.jm\f...x3g...&.R.qQaH^....X.#{O G.....8K....(........f..&.%..m}.hU......9.......psNO.c;.Dz._....... ^..oQa48..6.......s.o..#.]{D..nQL.2.;.i0.$Vp....6...:f.....h.O..#......8..!g<q...d.tl.....h(..E.]-...................y.2.......0...0...0..........Z..~..M..<ZYJ....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Should be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q...........bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... .......0... .....7....0.0... .......0... .....0......0...*.H..................sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3....L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....<.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..
<<< skipped >>>
Map
The Worm connects to the servers at the folowing location(s):
Strings from Dumps
IEXPLORE.EXE_1000:
.text
.text
`.data
`.data
.idata
.idata
.rsrc
.rsrc
@.reloc
@.reloc
u\j.Xf9
u\j.Xf9
j.Xf9
j.Xf9
USER32.dll
USER32.dll
api-ms-win-downlevel-shell32-l1-1-0.dll
api-ms-win-downlevel-shell32-l1-1-0.dll
IEFRAME.dll
IEFRAME.dll
SHELL32.dll
SHELL32.dll
iexplore.pdb
iexplore.pdb
api-ms-win-downlevel-shlwapi-l1-1-0.dll
api-ms-win-downlevel-shlwapi-l1-1-0.dll
iertutil.dll
iertutil.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
api-ms-win-downlevel-advapi32-l1-1-0.dll
KERNEL32.dll
KERNEL32.dll
msvcrt.dll
msvcrt.dll
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
name="Microsoft.InternetExplorer"
name="Microsoft.InternetExplorer"
true
true
KEYW
KEYW
.ENNNG.
.ENNNG.
a.ry.v
a.ry.v
l.igM4
l.igM4
?1%SGf
?1%SGf
xh.JW^
xh.JW^
.97777"7" " " !
.97777"7" " " !
3.... ))
3.... ))
8888888888888
8888888888888
8888888888
8888888888
.lPV)
.lPV)
úW1
úW1
.ApX/
.ApX/
H.ZAf
H.ZAf
ð[U
ð[U
%s!FK
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
888777777
Y.hilkRROMLK=C,
Y.hilkRROMLK=C,
..(((($$
..(((($$
3...((((%
3...((((%
3....(.''$
3....(.''$
3.2...((((%
3.2...((((%
33.2....(,'
33.2....(,'
55323222...
55323222...
(%&'00443445?
(%&'00443445?
00.,,,4(
00.,,,4(
000.,,9(
000.,,9(
0020..9(
0020..9(
003200;(
003200;(
(#'( (''''!'!
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
{28fb17e0-d393-439d-9a21-9474a070473a}
imm32.dll
imm32.dll
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
Kernel32.dll
Kernel32.dll
"%s" %s
"%s" %s
kernel32.dll
kernel32.dll
IEXPLORE.EXE
IEXPLORE.EXE
{00000000-0000-0000-0000-000000000000}
{00000000-0000-0000-0000-000000000000}
\\?\Volume
\\?\Volume
Imaging_CreateWebPagePreview_Perftrack
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows_TabProc
Browseui_Tabs_Tearoff_BetweenWindows_TabProc
Frame_URLEntered
Frame_URLEntered
Imaging_CreateWebPagePreview
Imaging_CreateWebPagePreview
WS_ExecuteQuery
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
IdleTask_Execution_Time
Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute
Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute
IMTravelLogMVC_TravelURL
IMTravelLogMVC_TravelURL
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)
Windows
Windows
10.00.9200.16521
10.00.9200.16521
EasyDriverPro.exe_3108:
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
kernel32.dll
kernel32.dll
Windows
Windows
HKEY
HKEY
MSWHEEL_ROLLMSG
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
MSH_SCROLL_LINES_MSG
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
$*@@@*$@@@$ *@@* $@@($*)@-$*@@$-*@@$*-@@(*$)@-*$@@*-$@@*$-@@-* $@-$ *@* $-@$ *-@$ -*@*- $@($ *)(* $)
oleaut32.dll
oleaut32.dll
EVariantBadIndexError
EVariantBadIndexError
ssShift
ssShift
htKeyword
htKeyword
EInvalidOperation
EInvalidOperation
u%CNu
u%CNu
%s[%d]
%s[%d]
%s_%d
%s_%d
.Owner
.Owner
EInvalidGraphicOperation
EInvalidGraphicOperation
comctl32.dll
comctl32.dll
USER32.DLL
USER32.DLL
uxtheme.dll
uxtheme.dll
Proportional
Proportional
MAPI32.DLL
MAPI32.DLL
vsReport
vsReport
OnKeyDown
OnKeyDown
OnKeyPress
OnKeyPress
OnKeyUp
OnKeyUp
TComboBoxExEnumerator
TComboBoxExEnumerator
ole32.dll
ole32.dll
PasswordChar
PasswordChar
ssHorizontal
ssHorizontal
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
JumpID("","%s")
JumpID("","%s")
TKeyEvent
TKeyEvent
TKeyPressEvent
TKeyPressEvent
HelpKeyword
HelpKeyword
crSQLWait
crSQLWait
%s (%s)
%s (%s)
imm32.dll
imm32.dll
OnExecuteh
OnExecuteh
AutoHotkeys
AutoHotkeys
AutoHotkeysT
AutoHotkeysT
ssHotTrack
ssHotTrack
TWindowState
TWindowState
poProportional
poProportional
TWMKey
TWMKey
KeyPreview
KeyPreview
WindowState8
WindowState8
tagMSG
tagMSG
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
vcltest3.dll
vcltest3.dll
User32.dll
User32.dll
OnActionExecute,
OnActionExecute,
WNNC_NET_FTP_NFS
WNNC_NET_FTP_NFS
olepro32.dll
olepro32.dll
TCommonShellExecuteThreadU
TCommonShellExecuteThreadU
%Program Files%\Borland\Common Library\Source\MPThreadManager.pas
%Program Files%\Borland\Common Library\Source\MPThreadManager.pas
TExtractImageXeH
TExtractImageXeH
shell32.dll
shell32.dll
\\.\vwin32
\\.\vwin32
shlwapi.dll
shlwapi.dll
Mpr.dll
Mpr.dll
%Program Files%\Borland\Common Library\Source\MPShellUtilities.pas
%Program Files%\Borland\Common Library\Source\MPShellUtilities.pas
To show a Context Menu using TNamespace you must pass a valid Owner TWinControl
To show a Context Menu using TNamespace you must pass a valid Owner TWinControl
THKeyArray
THKeyArray
TCommonKeyState
TCommonKeyState
cksShift
cksShift
TCommonKeyStates
TCommonKeyStates
%Program Files%\Borland\Common Library\Source\MPCommonUtilities.pas
%Program Files%\Borland\Common Library\Source\MPCommonUtilities.pas
user32.dll
user32.dll
gdi32.dll
gdi32.dll
advapi32.dll
advapi32.dll
Userenv.dll
Userenv.dll
ShellExecuteExW
ShellExecuteExW
ShellExecuteW
ShellExecuteW
GetWindowsDirectoryW
GetWindowsDirectoryW
RegOpenKeyW
RegOpenKeyW
RegOpenKeyExW
RegOpenKeyExW
SHFileOperationW
SHFileOperationW
%Program Files%\Borland\EasyListview\Source\EasyListviewAccessible.pas
%Program Files%\Borland\EasyListview\Source\EasyListviewAccessible.pas
TEasyAccessibleManager.Create not a TCustomEasyListview type
TEasyAccessibleManager.Create not a TCustomEasyListview type
TEasyGroupAccessibleManager.Create not a TEasyGroup type
TEasyGroupAccessibleManager.Create not a TEasyGroup type
TEasyItemAccessibleManager.Create not a TEasyItem type
TEasyItemAccessibleManager.Create not a TEasyItem type
TEasyColumnAccessibleManager.Create not a TEasyColumn type
TEasyColumnAccessibleManager.Create not a TEasyColumn type
TEasyHeaderAccessibleManager.Create not a TEasyHeader type
TEasyHeaderAccessibleManager.Create not a TEasyHeader type
elsReport
elsReport
elsReportThumb
elsReportThumb
TAutoGroupGetKeyEvent
TAutoGroupGetKeyEvent
TColumnGetImageIndexEvent
TColumnGetImageIndexEvent
TColumnSetImageIndexEvent
TColumnSetImageIndexEvent
KeyState
KeyState
KeyStates
KeyStates
TGroupGetImageIndexEvent
TGroupGetImageIndexEvent
TGroupSetImageIndexEvent
TGroupSetImageIndexEvent
HintWindowShown
HintWindowShown
TItemGetGroupKeyEvent
TItemGetGroupKeyEvent
GroupKey
GroupKey
TItemGetImageIndexEvent
TItemGetImageIndexEvent
TItemSetGroupKeyEvent
TItemSetGroupKeyEvent
TItemSetImageIndexEvent
TItemSetImageIndexEvent
MouseMsg
MouseMsg
TEasyKeyActionEvent
TEasyKeyActionEvent
EscapeKeyPressed
EscapeKeyPressed
TEasyViewReportItem
TEasyViewReportItem
TEasyViewReportThumbItem
TEasyViewReportThumbItem
TEasyViewReportThumbItemH
TEasyViewReportThumbItemH
TEasyGridReportGroup
TEasyGridReportGroup
TEasyGridReportGroupd
TEasyGridReportGroupd
TEasyGridReportThumbGroup
TEasyGridReportThumbGroup
TEasyGridReportThumbGroup@
TEasyGridReportThumbGroup@
TEasyCellSizeReport
TEasyCellSizeReport
TEasyCellSizeReportThumb
TEasyCellSizeReportThumb
ReportThumb
ReportThumb
ReportD
ReportD
AlwaysShow
AlwaysShow
OnAutoGroupGetKey0
OnAutoGroupGetKey0
OnItemGetGroupKey
OnItemGetGroupKey
OnItemSetGroupKey
OnItemSetGroupKey
OnKeyAction$XJ
OnKeyAction$XJ
%Program Files%\Borland\EasyListview\Source\EasyListview.pas
%Program Files%\Borland\EasyListview\Source\EasyListview.pas
FTPf
FTPf
Can not find TEasyGroups.AdjacentItem of an Invisible Item
Can not find TEasyGroups.AdjacentItem of an Invisible Item
EasyListview.Header
EasyListview.Header
LeftPopup
LeftPopup
!"#$%&*;@[]^_`{|}
!"#$%&*;@[]^_`{|}
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
TNT Internal Error: TWideComponentHelper.Create should never be encountered.
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntClasses.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntClasses.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntActnList.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntActnList.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntForms.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntForms.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntMenus.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntMenus.pas
Internal Error: SyncHotKeyPosition Failed ("%s" "%s").
Internal Error: SyncHotKeyPosition Failed ("%s" "%s").
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntControls.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntControls.pas
Internal Error: SubClassUnicodeControl.Control is not Unicode.
Internal Error: SubClassUnicodeControl.Control is not Unicode.
.UnicodeClass
.UnicodeClass
TntUnicodeVcl.DestroyWindow
TntUnicodeVcl.DestroyWindow
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntStdCtrls.pas
%Program Files%\TntWare\Delphi Unicode Controls\Source\TntStdCtrls.pas
TMonochromeLookup
TMonochromeLookup
ESQLiteException
ESQLiteException
TSQLiteDatabase
TSQLiteDatabase
TSQLiteTable
TSQLiteTable
Failed to open database "%s" : %s
Failed to open database "%s" : %s
Failed to open database "%s" : unknown error
Failed to open database "%s" : unknown error
"%s" : %s
"%s" : %s
Error executing SQL
Error executing SQL
Could not prepare SQL statement
Could not prepare SQL statement
Error executing SQL statement
Error executing SQL statement
SQLite is Busy
SQLite is Busy
invalid zipfile
invalid zipfile
Shell.Application
Shell.Application
invalid source
invalid source
invalid target folder
invalid target folder
getservbyport
getservbyport
WSAAsyncGetServByPort
WSAAsyncGetServByPort
WSAJoinLeaf
WSAJoinLeaf
WS2_32.DLL
WS2_32.DLL
127.0.0.1
127.0.0.1
TIdSocketListWindows
TIdSocketListWindows
TIdStackWindowsU
TIdStackWindowsU
IdStackWindows
IdStackWindows
%s, %d %s %d %s %s
%s, %d %s %d %s %s
ftpTransfer
ftpTransfer
ftpReady
ftpReady
ftpAborted
ftpAborted
ClientPortMinT
ClientPortMinT
ClientPortMax
ClientPortMax
Port
Port
EIdCanNotBindPortInRange
EIdCanNotBindPortInRange
EIdInvalidPortRangeSVW
EIdInvalidPortRangeSVW
saUsernamePassword
saUsernamePassword
PasswordT
PasswordT
0.0.0.1
0.0.0.1
TIdTCPStream
TIdTCPStream
End of stream: %s at %d
End of stream: %s at %d
TIdTCPConnection
TIdTCPConnection
TIdTCPConnectionxfP
TIdTCPConnectionxfP
IdTCPConnection
IdTCPConnection
EIdTCPConnectionError
EIdTCPConnectionError
EIdObjectTypeNotSupported
EIdObjectTypeNotSupported
Uh.yP
Uh.yP
password
password
Password
Password
IdHTTPHeaderInfo
IdHTTPHeaderInfo
ProxyPasswordT
ProxyPasswordT
ProxyPort
ProxyPort
Mozilla/3.0 (compatible; Indy Library)
Mozilla/3.0 (compatible; Indy Library)
libeay32.dll
libeay32.dll
ssleay32.dll
ssleay32.dll
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_use_certificate_file
SSL_get_peer_certificate
SSL_get_peer_certificate
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_check_private_key
SSL_CTX_check_private_key
X509_STORE_CTX_get_current_cert
X509_STORE_CTX_get_current_cert
des_set_key
des_set_key
sslvrfFailIfNoPeerCert
sslvrfFailIfNoPeerCert
TPasswordEvent
TPasswordEvent
Certificate
Certificate
RootCertFile|
RootCertFile|
CertFile|
CertFile|
KeyFile
KeyFile
OnGetPassword
OnGetPassword
EIdOSSLLoadingRootCertError
EIdOSSLLoadingRootCertError
EIdOSSLLoadingCertError(
EIdOSSLLoadingCertError(
EIdOSSLLoadingKeyError
EIdOSSLLoadingKeyError
TIdTCPClient
TIdTCPClient
TIdTCPClientd
TIdTCPClientd
IdTCPClient
IdTCPClient
BoundPort
BoundPort
PortU
PortU
CommentURL
CommentURL
TIdHTTPMethod
TIdHTTPMethod
IdHTTP
IdHTTP
TIdHTTPOption
TIdHTTPOption
TIdHTTPOptions
TIdHTTPOptions
TIdHTTPProtocolVersion
TIdHTTPProtocolVersion
IdHTTPd)Q
IdHTTPd)Q
TIdHTTPOnRedirectEvent
TIdHTTPOnRedirectEvent
TIdHTTPResponse
TIdHTTPResponse
TIdHTTPResponse, Q
TIdHTTPResponse, Q
TIdHTTPRequest
TIdHTTPRequest
TIdHTTPProtocol
TIdHTTPProtocol
TIdCustomHTTP
TIdCustomHTTP
TIdHTTP
TIdHTTP
TIdHTTP(.Q
TIdHTTP(.Q
HTTPOptions`)Q
HTTPOptions`)Q
EIdHTTPProtocolException
EIdHTTPProtocolException
HTTPS
HTTPS
https
https
This request method is supported in HTTP 1.1
This request method is supported in HTTP 1.1
HTTP/1.0 200 OK
HTTP/1.0 200 OK
HTTP/
HTTP/
EInvalidGridOperation
EInvalidGridOperation
goAlwaysShowEditor
goAlwaysShowEditor
doKeyColFixed
doKeyColFixed
TKeyOption
TKeyOption
keyEdit
keyEdit
keyAdd
keyAdd
keyDelete
keyDelete
keyUnique
keyUnique
TKeyOptions
TKeyOptions
KeyName
KeyName
KeyValue
KeyValue
KeyOptions
KeyOptions
KeyDesc
KeyDesc
%s=%s
%s=%s
FormKeyDown
FormKeyDown
IdHTTP1
IdHTTP1
Do you have a License Key?
Do you have a License Key?
If you already have a License Key, please enter it in the form below and click "Activate Now".
If you already have a License Key, please enter it in the form below and click "Activate Now".
License key
License key
Do you need a License Key?
Do you need a License Key?
To purchase Easy Driver Pro and obtain a license key click
To purchase Easy Driver Pro and obtain a license key click
service.smartpcupdate.com
service.smartpcupdate.com
ProxyLogin
ProxyLogin
ProxyPassword
ProxyPassword
hXXp://service.smartpcupdate.com/rpc/sendpurchase?partner=ProbitSoftware&build=8.1.2&key=
hXXp://service.smartpcupdate.com/rpc/sendpurchase?partner=ProbitSoftware&build=8.1.2&key=
Licensing key has reached its usage limit!
Licensing key has reached its usage limit!
LicenseKey
LicenseKey
Current Windows version
Current Windows version
Backuped driver Windows version
Backuped driver Windows version
We NOT reccomend your use this driver for current Windows version.
We NOT reccomend your use this driver for current Windows version.
5 (Windows XP)
5 (Windows XP)
6 (Windows Vista)
6 (Windows Vista)
7 (Windows 7)
7 (Windows 7)
8 (Windows 8)
8 (Windows 8)
IdHTTP1
IdHTTP1
HTTPWorkBegin
HTTPWorkBegin
HTTPWork
HTTPWork
HTTPWorkEnd
HTTPWorkEnd
hXXp://service.smartpcupdate.com/rpc/getdatabasex32
hXXp://service.smartpcupdate.com/rpc/getdatabasex32
hXXp://service.smartpcupdate.com/rpc/getdatabasex64
hXXp://service.smartpcupdate.com/rpc/getdatabasex64
Drivers.zip
Drivers.zip
Drivers32.db
Drivers32.db
Drivers32prev.db
Drivers32prev.db
Drivers64.db
Drivers64.db
Drivers64prev.db
Drivers64prev.db
SetupFiles.txt
SetupFiles.txt
%s
%s
=?WINDOWS
=?WINDOWS
Uh^%S
Uh^%S
Indy 9.00.10
Indy 9.00.10
atLogin
atLogin
IdSMTP
IdSMTP
TIdSMTP
TIdSMTP
AUTH LOGIN
AUTH LOGIN
LOGIN
LOGIN
IdSMTP1
IdSMTP1
Report a problem with a new driver!
Report a problem with a new driver!
mail.smartpctools.com
mail.smartpctools.com
apps@smartpctools.com
apps@smartpctools.com
support@easydriverpro.com
support@easydriverpro.com
IdHTTP0
IdHTTP0
HTTP1Start
HTTP1Start
HTTP2Start
HTTP2Start
HTTP3Start
HTTP3Start
HTTP4Start
HTTP4Start
HTTP5Start
HTTP5Start
HTTP1Work
HTTP1Work
HTTP2Work
HTTP2Work
HTTP3Work
HTTP3Work
HTTP4Work
HTTP4Work
HTTP5Work
HTTP5Work
InstallExeDriver
InstallExeDriver
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
PCInfo.ini
PCInfo.ini
English.ini
English.ini
French.ini
French.ini
German.ini
German.ini
Spanish.ini
Spanish.ini
Italian.ini
Italian.ini
Portuguese.ini
Portuguese.ini
Danish.ini
Danish.ini
Dutch.ini
Dutch.ini
Swedish.ini
Swedish.ini
Polish.ini
Polish.ini
Russian.ini
Russian.ini
Brazilian.ini
Brazilian.ini
Finnish.ini
Finnish.ini
Norwegian.ini
Norwegian.ini
Czech.ini
Czech.ini
hXXp://VVV.easydriverpro.com/
hXXp://VVV.easydriverpro.com/
hXXp://VVV.easydriverpro.com/go-register.php?srid=
hXXp://VVV.easydriverpro.com/go-register.php?srid=
hXXp://support.easydriverpro.com/
hXXp://support.easydriverpro.com/
Login
Login
Product information and support link
Product information and support link
Support
Support
: 8.1.2
: 8.1.2
Scan.ini
Scan.ini
InstallLog.ini
InstallLog.ini
Backups.ini
Backups.ini
UpdateWindowShown
UpdateWindowShown
\DPSchedule.exe
\DPSchedule.exe
Devices.ini
Devices.ini
\Easy Driver Pro.chm
\Easy Driver Pro.chm
CERTANCE
CERTANCE
Keyboard
Keyboard
Ports
Ports
MultiPortSerial
MultiPortSerial
Vendors.txt
Vendors.txt
ClassKey
ClassKey
EnumKey
EnumKey
ScanExecuted
ScanExecuted
\Scan.gif
\Scan.gif
Exclusions.txt
Exclusions.txt
1.0.0.0
1.0.0.0
update1.smartpcupdate.com
update1.smartpcupdate.com
hXXp://update1.smartpcupdate.com/rpc/getlastupdate
hXXp://update1.smartpcupdate.com/rpc/getlastupdate
hXXp://service.smartpcupdate.com/rpc/getstatus?exedate=
hXXp://service.smartpcupdate.com/rpc/getstatus?exedate=
hXXp://service.smartpcupdate.com/rpc/candownloadfiles?partner=ProbitSoftware&version=3.1&key=
hXXp://service.smartpcupdate.com/rpc/candownloadfiles?partner=ProbitSoftware&version=3.1&key=
hXXp://update1.smartpcupdate.com/rpc/sendinstall?partner=ProbitSoftware&build=8.1.2
hXXp://update1.smartpcupdate.com/rpc/sendinstall?partner=ProbitSoftware&build=8.1.2
hXXp://update1.smartpcupdate.com/rpc/sendstats?partner=ProbitSoftware&build=3.1&files=
hXXp://update1.smartpcupdate.com/rpc/sendstats?partner=ProbitSoftware&build=3.1&files=
hXXp://update1.smartpcupdate.com/rpc/sendreport?filename=
hXXp://update1.smartpcupdate.com/rpc/sendreport?filename=
UpdateList.txt
UpdateList.txt
This version is no longer supported!
This version is no longer supported!
SrClient.dll
SrClient.dll
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
hXXp://VVV.google.com/search?hl=en&q=
hXXp://VVV.google.com/search?hl=en&q=
.SYS.DLL.INF.CAT.NFO.EXE.REG.AX.DRV.CPL
.SYS.DLL.INF.CAT.NFO.EXE.REG.AX.DRV.CPL
RUNDLL32.EXE
RUNDLL32.EXE
LAYOUT.INF
LAYOUT.INF
regedit.exe
regedit.exe
\Enum.reg" "HKEY_LOCAL_MACHINE\
\Enum.reg" "HKEY_LOCAL_MACHINE\
\Classes.reg" "HKEY_LOCAL_MACHINE\
\Classes.reg" "HKEY_LOCAL_MACHINE\
\*.inf
\*.inf
\Log.txt
\Log.txt
/s zipfldr.dll
/s zipfldr.dll
regsvr32.exe
regsvr32.exe
\.zip\CompressedFolder\ShellNew
\.zip\CompressedFolder\ShellNew
\Classes.reg
\Classes.reg
\Classes.reg"
\Classes.reg"
\Enum.reg
\Enum.reg
\Enum.reg"
\Enum.reg"
*.exe
*.exe
AUTORUN.EXE
AUTORUN.EXE
32.EXE
32.EXE
64.EXE
64.EXE
*.inf
*.inf
msiexec.exe
msiexec.exe
newdev.dll
newdev.dll
advpack.dll,LaunchINFSectionEx "
advpack.dll,LaunchINFSectionEx "
rundll32.exe
rundll32.exe
01-01-2013
01-01-2013
RunExe
RunExe
hXXp://service.smartpcupdate.com/downloads/
hXXp://service.smartpcupdate.com/downloads/
s_Exec
s_Exec
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\DPLauncher.exe
\DPLauncher.exe
\DPSmartScan.exe
\DPSmartScan.exe
#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%
#!V!W!"!&!r%!%#%%%'%)%c%e%g%C%
P%S%V%Y%\%
P%S%V%Y%\%
?456789:;
?456789:;
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123
!"#$%&'()* ,-./0123456789:;?
!"#$%&'()* ,-./0123456789:;?
&'()* ,-./0123456789:;?
&'()* ,-./0123456789:;?
GetKeyboardType
GetKeyboardType
RegOpenKeyExA
RegOpenKeyExA
RegCloseKey
RegCloseKey
RegQueryInfoKeyA
RegQueryInfoKeyA
RegFlushKey
RegFlushKey
RegEnumKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegCreateKeyExA
GetWindowsDirectoryA
GetWindowsDirectoryA
GetCPInfo
GetCPInfo
version.dll
version.dll
SetViewportOrgEx
SetViewportOrgEx
SetViewportExtEx
SetViewportExtEx
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
SetWindowsHookExA
SetWindowsHookExA
SetKeyboardState
SetKeyboardState
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
MapVirtualKeyA
MapVirtualKeyA
LoadKeyboardLayoutA
LoadKeyboardLayoutA
GetKeyboardState
GetKeyboardState
GetKeyboardLayoutList
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyNameTextW
GetKeyNameTextW
GetKeyNameTextA
GetKeyNameTextA
GetAsyncKeyState
GetAsyncKeyState
ExitWindowsEx
ExitWindowsEx
EnumWindows
EnumWindows
EnumThreadWindows
EnumThreadWindows
ActivateKeyboardLayout
ActivateKeyboardLayout
ShellExecuteExA
ShellExecuteExA
ShellExecuteA
ShellExecuteA
SHFileOperationA
SHFileOperationA
wininet.dll
wininet.dll
SHFolder.dll
SHFolder.dll
oleacc.dll
oleacc.dll
winmm.dll
winmm.dll
sqlite3.dll
sqlite3.dll
sqlite3_finalize
sqlite3_finalize
sqlite3_column_type
sqlite3_column_type
sqlite3_column_text
sqlite3_column_text
sqlite3_column_int
sqlite3_column_int
sqlite3_column_double
sqlite3_column_double
sqlite3_column_bytes
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_blob
sqlite3_step
sqlite3_step
sqlite3_column_decltype
sqlite3_column_decltype
sqlite3_column_name
sqlite3_column_name
sqlite3_column_count
sqlite3_column_count
sqlite3_prepare
sqlite3_prepare
sqlite3_free
sqlite3_free
sqlite3_errcode
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg
sqlite3_close
sqlite3_close
sqlite3_open
sqlite3_open
0 0$0(0,0004080
0 0$0(0,0004080
2 2$2(2,2024282
2 2$2(2,2024282
5!5%5)5-5155595=5
5!5%5)5-5155595=5
3(4,4044484
3(4,4044484
1 1$1(1,1014181
1 1$1(1,1014181
1 1$1(1,1014181
1 1$1(1,1014181
1-15191L1u1}1
1-15191L1u1}1
= =$=(= >
= =$=(= >
? ?$?2?:?
? ?$?2?:?
3"3&353=3
3"3&353=3
7(757
7(757
2 2$252_2
2 2$252_2
0%1S1
0%1S1
>!>%>)>0>
>!>%>)>0>
5!5%5)505
5!5%5)505
62767:7@7
62767:7@7
; ;$;(;,;
; ;$;(;,;
0*1.161
0*1.161
3_3}3"4/4{4
3_3}3"4/4{4
8(8:8@8\8
8(8:8@8\8
2 2$2(2,202>2
2 2$2(2,202>2
2'2X2c2u2
2'2X2c2u2
: ;$;(;,;0;
: ;$;(;,;0;
>%>)>7>?>\>
>%>)>7>?>\>
9!9Ÿ9Q9Y9`9
9!9Ÿ9Q9Y9`9
;#; ;9;~;
;#; ;9;~;
6*64696\6
6*64696\6
9 9%9s9
9 9%9s9
7(71787=7
7(71787=7
6 6-626P6U6}6
6 6-626P6U6}6
6"6(60666
6"6(60666
74888
74888
333333333333333333
333333333333333333
33333833
33333833
3333339
3333339
3333333333333338
3333333333333338
:*"*"$3338
:*"*"$3338
3333333
3333333
33333333
33333333
33333333333
33333333333
3333333333338
3333333333338
33338?383
33338?383
333333333333
333333333333
:*3:"$3338
:*3:"$3338
333333333333333
333333333333333
KWindows
KWindows
UrlMon
UrlMon
0IdHTTPHeaderInfo
0IdHTTPHeaderInfo
IdTCPServer
IdTCPServer
IdTCPStream
IdTCPStream
#IdSMTP
#IdSMTP
TntWindows
TntWindows
SQLiteTable3
SQLiteTable3
SQLite3
SQLite3
Font.Charset
Font.Charset
Font.Color
Font.Color
Font.Height
Font.Height
Font.Name
Font.Name
Font.Style
Font.Style
Picture.Data
Picture.Data
X9}V9zT9vR8rP8nN7jL6eI5aG4\D3XB1T?0O<.qa6md>
X9}V9zT9vR8rP8nN7jL6eI5aG4\D3XB1T?0O<.qa6md>
^8~Q1uK-zP2}R2
^8~Q1uK-zP2}R2
c=|R2%d
c=|R2%d
Z;ü)^>&
Z;ü)^>&
_9wM.Bt
_9wM.Bt
.7b%%%%%%%% cG[
.7b%%%%%%%% cG[
\%tV%YW0WU/[S0WJ6UJ6\M2mR%oT%uS"
\%tV%YW0WU/[S0WJ6UJ6\M2mR%oT%uS"
_I&]I*bM-aM.aM.aM-aM-aM-aM-aM-aM.aK,[R3g
_I&]I*bM-aM.aM.aM-aM-aM-aM-aM-aM.aK,[R3g
%Select the drivers you wish to backup
%Select the drivers you wish to backup
EditManager.Font.Charset
EditManager.Font.Charset
EditManager.Font.Color
EditManager.Font.Color
EditManager.Font.Height
EditManager.Font.Height
EditManager.Font.Name
EditManager.Font.Name
EditManager.Font.Style
EditManager.Font.Style
GroupFont.Charset
GroupFont.Charset
GroupFont.Color
GroupFont.Color
GroupFont.Height
GroupFont.Height
GroupFont.Name
GroupFont.Name
GroupFont.Style
GroupFont.Style
Header.Columns.Items
Header.Columns.Items
Header.Font.Charset
Header.Font.Charset
Header.Font.Color
Header.Font.Color
Header.Font.Height
Header.Font.Height
Header.Font.Name
Header.Font.Name
Header.Font.Style
Header.Font.Style
ImageList1)PaintInfoGroup.MarginBottom.CaptionIndent
ImageList1)PaintInfoGroup.MarginBottom.CaptionIndent
Selection.FullRowSelect
Selection.FullRowSelect
%Select name, location and backup type
%Select name, location and backup type
Items.Strings
Items.Strings
%Driver backup successfully completed!
%Driver backup successfully completed!
,,,888555
,,,888555
%Save downloded drivers to this folder
%Save downloded drivers to this folder
$Product information and support link
$Product information and support link
"!## "#!##"##"##"##"$#!#$!#$!##"$%"$$#$%#%%#%%$%%$%%$%%$%%$%%$%%$&%$%%$&&$%&$%%$%%$%'$%%#%%#%%#$$###"""
"!## "#!##"##"##"##"$#!#$!#$!##"$%"$$#$%#%%#%%$%%$%%$%%$%%$%%$%%$&%$%%$&&$%&$%%$%%$%'$%%#%%#%%#$$###"""
/;~/
/;~/
/
/
*u)6u 9w 9w 8y,9z-;z-;z-:x,7{-9}.:~/
*u)6u 9w 9w 8y,9z-;z-;z-:x,7{-9}.:~/
/
/
#p .}/=p"-y,7z-8}.9}/:|-8|.9}.9}.9}.:}/;~/;~/:
#p .}/=p"-y,7z-8}.9}/:|-8|.9}.9}.9}.:}/;~/;~/:
/;~/:}.:z-8{-8{-9|-9}.:|.:}cs
/;~/:}.:z-8{-8{-9|-9}.:|.:}cs
/;}.9~/;
/;}.9~/;
/9~.8~.8
/9~.8~.8
/:~.8}.8}.8}.9}.8
/:~.8}.8}.8}.9}.8
/:~/9~/9
/:~/9~/9
/:~/:}.8~.:}.9z-7}.9}.9}.:
/:~/:}.8~.:}.9z-7}.9}.9}.:
/:~/:}.9}.9}.9}.9}.9}.9}.9
/:~/:}.9}.9}.9}.9}.9}.9}.9
|.8{-7}.8}.9~/:~/9~/9~/9}.8~/9
|.8{-7}.8}.9~/:~/9~/9~/9}.8~/9
/:~/9}.8~/9}.9}.9}.8|.8|.8
/:~/9}.8~/9}.9}.9}.8|.8|.8
~/9}.8~.8~/9
~/9}.8~.8~/9
/9~/9~/9}.8}.8}.9}.9
/9~/9~/9}.8}.8}.9}.9
/:~/9~/9~/9}.9}.8~.9}3>
/:~/9~/9~/9}.9}.8~.9}3>
/8~/9~/9~/:~/9~/:}.9
/8~/9~/9~/:~/9~/:}.9
/9~/9~/9|.7|/8
/9~/9~/9|.7|/8
/9}/8|.8
/9}/8|.8
.5}& |#)
.5}& |#)
/9}.7}2;
/9}.7}2;
0:}.9}.8
0:}.9}.8
17~.5}.6
17~.5}.6
3@{%1~,6
3@{%1~,6
:Gq"1s%1x 8z-:w 8s*7q)6o'4o
:Gq"1s%1x 8z-:w 8s*7q)6o'4o
hXXp://support.easydriverpro.com
hXXp://support.easydriverpro.com
Support:
Support:
hXXp://VVV.easydriverpro.com
hXXp://VVV.easydriverpro.com
Version: 8.1.2
Version: 8.1.2
Webcam drivers
Webcam drivers
Windows system drivers
Windows system drivers
Keyboard drivers
Keyboard drivers
Icon.Data
Icon.Data
@000///1111*$&
@000///1111*$&
ProxyParams.BasicAuthentication
ProxyParams.BasicAuthentication
ProxyParams.ProxyPort
ProxyParams.ProxyPort
Request.ContentLength
Request.ContentLength
Request.ContentRangeEnd
Request.ContentRangeEnd
Request.ContentRangeStart
Request.ContentRangeStart
Request.ContentType
Request.ContentType
Request.Accept
Request.Accept
Request.BasicAuthentication
Request.BasicAuthentication
Request.UserAgent
Request.UserAgent
&Mozilla/3.0 (compatible; Indy Library)
&Mozilla/3.0 (compatible; Indy Library)
HTTPOptions
HTTPOptions
)))222666===
)))222666===
"""***333000
"""***333000
$$$"""^^^
$$$"""^^^
93-81-3-)$
93-81-3-)$
gA{R4lH.oJ/wP2
gA{R4lH.oJ/wP2
fK:nJ.yQ3
fK:nJ.yQ3
.NN outdated drivers have been found on your PC
.NN outdated drivers have been found on your PC
If you purchased Easy Driver Pro a license key will have been emailed to you. Please enter the license key below and click Activate Now.
If you purchased Easy Driver Pro a license key will have been emailed to you. Please enter the license key below and click Activate Now.
;To purchase Easy Driver Pro and obtain a license key click
;To purchase Easy Driver Pro and obtain a license key click
.7b%%%%%%%% cFX
.7b%%%%%%%% cFX
YCheck the email you received after you purchased the product for the correct license key.
YCheck the email you received after you purchased the product for the correct license key.
&Your license key will look like this:
&Your license key will look like this:
BWe NOT reccomend your use this driver for current Windows version.
BWe NOT reccomend your use this driver for current Windows version.
Current Windows version:
Current Windows version:
Backuped driver Windows version:
Backuped driver Windows version:
"Report a problem with a new driver
"Report a problem with a new driver
IdSMTP1
IdSMTP1
name="EasyDriverPro.exe"
name="EasyDriverPro.exe"
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
PIDLs to operate on are not siblings of the Namespace doing the operation.
PIDLs to operate on are not siblings of the Namespace doing the operation.
Unable to find RegSvr32.exe executable.
Unable to find RegSvr32.exe executable.
RegSvr32.exe
RegSvr32.exe
Unspecified error (%d) from %s.
Unspecified error (%d) from %s.
miranda32.exe
miranda32.exe
SSL status: "%s"
SSL status: "%s"
Command not supported.
Command not supported.
Address type not supported.$Error accepting connection with SSL.
Address type not supported.$Error accepting connection with SSL.
Error creating SSL context. Could not load root certificate.
Error creating SSL context. Could not load root certificate.
Could not load certificate.#Could not load key, check password.
Could not load certificate.#Could not load key, check password.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
Request rejected or failed.5Request rejected because SOCKS server cannot connect.QRequest rejected because the client program and identd report different user-ids.
"Operation not supported on socket.
"Operation not supported on socket.
Protocol family not supported.0Address family not supported by protocol family.
Protocol family not supported.0Address family not supported by protocol family.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice.
Operation would block.
Operation would block.
Operation now in progress.
Operation now in progress.
Operation already in progress.
Operation already in progress.
Socket operation on non-socket.
Socket operation on non-socket.
Protocol not supported.
Protocol not supported.
Socket type not supported.
Socket type not supported.
&Error on loading Winsock2 library (%s)
&Error on loading Winsock2 library (%s)
Resolving hostname %s.
Resolving hostname %s.
Connecting to %s.
Connecting to %s.
Chunk StartedDThis authentication method is already registered with class name %s.
Chunk StartedDThis authentication method is already registered with class name %s.
%s is not a valid service.
%s is not a valid service.
Socket Error # %d
Socket Error # %d
File "%s" not found1Only one TIdAntiFreeze can exist per application.
File "%s" not found1Only one TIdAntiFreeze can exist per application.
Object type not supported.
Object type not supported.
No data to read.$Can not bind in port range (%d - %d)
No data to read.$Can not bind in port range (%d - %d)
Invalid Port Range (%d - %d)
Invalid Port Range (%d - %d)
@ Outside address*Error on call Winsock2 library function %s
@ Outside address*Error on call Winsock2 library function %s
Invalid stream operation
Invalid stream operation
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
Invalid Image trailerAInternal error: Extension Instance does not match Extension Label,Unsupported Application Extension block size
Unknown GIF block type'Object type not supported for operation
Unknown GIF block type'Object type not supported for operation
Unsupported PixelFormat
Unsupported PixelFormat
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
OLE error %.8x.Method '%s' not supported by automation object/Variant does not reference an automation object7Dispatch methods do not support more than 64 parameters
Unsupported GIF version7Invalid number of colors specified in Screen Descriptor6Invalid number of colors specified in Image Descriptor
Unsupported GIF version7Invalid number of colors specified in Screen Descriptor6Invalid number of colors specified in Image Descriptor
Invalid extension introducerúiled to allocate memory for GIF DIB
Invalid extension introducerúiled to allocate memory for GIF DIB
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
RichEdit line insertion error=This control requires version 4.70 or greater of COMCTL32.DLL
Date exceeds maximum of %s
Date exceeds maximum of %s
Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeúiled to set maximum selection range$Failed to set calendar min/max rangeúiled to set calendar selected range
Date is less than minimum of %s4You must be in ShowCheckbox mode to set to this date#Failed to set calendar date or timeúiled to set maximum selection range$Failed to set calendar min/max rangeúiled to set calendar selected range
No help keyword specified.
No help keyword specified.
8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
8Listbox (%s) style must be virtual in order to set Count#No OnGetItem event handler assigned"Unable to find a Table of Contents
No help found for %s#No context-sensitive help installed$No topic-based help system installed
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Invalid clipboard format Clipboard does not support Icons
Invalid clipboard format Clipboard does not support Icons
Text exceeds memo capacity/Menu '%s' is already being used by another form
Text exceeds memo capacity/Menu '%s' is already being used by another form
Value*A key with the name of "%s" already exists
Value*A key with the name of "%s" already exists
Key "%s" not found%goColMoving is not a supported option%Key may not contain equals sign ("=")
Key "%s" not found%goColMoving is not a supported option%Key may not contain equals sign ("=")
Error setting %s.Count
Error setting %s.Count
Value must be between %d and %d
Value must be between %d and %d
Invalid input value7Invalid input value. Use escape key to abandon changes
Invalid input value7Invalid input value. Use escape key to abandon changes
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Scan line index out of range!Cannot change the size of an icon Invalid operation on TOleGraphic
Unsupported clipboard format
Unsupported clipboard format
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Error creating window class Cannot focus a disabled or invisible window!Control '%s' has no parent window
Failed to get data for '%s'
Failed to get data for '%s'
Failed to set data for '%s'
Failed to set data for '%s'
Resource %s not found
Resource %s not found
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
%s.Seek not implemented$Operation not allowed on sorted list Too many rows or columns deleted$%s not in a class registration group
Property %s does not exist
Property %s does not exist
Thread creation error: %s
Thread creation error: %s
Thread Error: %s (%d)
Thread Error: %s (%d)
Cannot open file "%s". %s
Cannot open file "%s". %s
Grid too large for operation
Grid too large for operation
Unable to write to %s
Unable to write to %s
Invalid stream format$''%s'' is not a valid component name
Invalid stream format$''%s'' is not a valid component name
Invalid data type for '%s' List capacity out of bounds (%d)
Invalid data type for '%s' List capacity out of bounds (%d)
List count out of bounds (%d)
List count out of bounds (%d)
List index out of bounds (%d) Out of memory while expanding memory stream
List index out of bounds (%d) Out of memory while expanding memory stream
Error reading %s%s%s: %s
Error reading %s%s%s: %s
Ancestor for '%s' not found
Ancestor for '%s' not found
Cannot assign a %s to a %s
Cannot assign a %s to a %s
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Bits index out of range*Can't write to a read-only resource streamECheckSynchronize called from thread $%x, which is NOT the main thread
Class %s not found
Class %s not found
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
A class named %s already exists%List does not allow duplicates ($0%x)#A component named %s already exists%String list does not allow duplicates
Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count
Cannot create file "%s". %s1Fixed column count must be less than column count Fixed row count must be less than row count
Operation not supported
Operation not supported
External exception %x
External exception %x
Interface not supported
Interface not supported
%s (%s, line %d)
%s (%s, line %d)
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
Abstract Error?Access violation at address %p in module '%s'. %s of address %p
System Error. Code: %d.
System Error. Code: %d.
1Format '%s' invalid or incompatible with argument
1Format '%s' invalid or incompatible with argument
No argument for format '%s'"Variant method calls not supported
No argument for format '%s'"Variant method calls not supported
Invalid variant operation
Invalid variant operation
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
Invalid NULL variant operation%Invalid variant operation (%s%.8x)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
%s5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Integer overflow Invalid floating point operation
Integer overflow Invalid floating point operation
Invalid pointer operation
Invalid pointer operation
Invalid class typecast0Access violation at address %p. %s of address %p
Invalid class typecast0Access violation at address %p. %s of address %p
Privileged instruction(Exception %s in module %s at %p.
Privileged instruction(Exception %s in module %s at %p.
!'%s' is not a valid integer value('%s' is not a valid floating point value
!'%s' is not a valid integer value('%s' is not a valid floating point value
'%s' is not a valid date
'%s' is not a valid date
'%s' is not a valid time!'%s' is not a valid date and time
'%s' is not a valid time!'%s' is not a valid date and time
I/O error %d
I/O error %d
8.1.2.0
8.1.2.0