Trojan.Generic.11454451 (AdAware), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 6e1af1017ec3546c111e3e628485d2f1
SHA1: 73f003656144f60c04f30c3df90be37e7275d20d
SHA256: 7c4ff29863027e3a6cadd72cfa5d607ca01957763d00a8fd1ea22957ea21837e
SSDeep: 24576:aRevMp /Qlb VoDLhb/ZPPtKWMAEeazRjDRWbXxIZ:a8MpYYSVo/l/ZPPt/rEeaQI
Size: 1074000 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Exent Technologies Ltd.
Created at: 2008-08-20 16:51:24
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
FreeRideGames.e:608
GPlayer.exe:252
GPlayer.exe:1132
GPlayer.exe:1956
%original file name%.exe:860
Regsvr32.exe:1752
RegEdit.exe:936
RegEdit.exe:1584
setup.exe:908
Free Ride Games.exe:1756
The Trojan injects its code into the following process(es):No processes have been created.
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process FreeRideGames.e:608 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (11297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (4508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (6224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (14367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (42648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (157015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (5 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (0 bytes)
The process GPlayer.exe:252 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\FreeRide Games\Info\4.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\3.clg (15349 bytes)
The process GPlayer.exe:1132 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\FreeRide Games\Info\6.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\5.clg (15349 bytes)
The process GPlayer.exe:1956 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\FreeRide Games\Info\1.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\2.clg (1093 bytes)
The process %original file name%.exe:860 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\Free Ride Games.exe (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (6389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\cmhelper.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\resourceDll.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\ExentCtlInstaller.dll (98 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (0 bytes)
The process setup.exe:908 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu20fe.rra (14400 bytes)
%Documents and Settings%\All Users\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgToa3a.rra (1 bytes)
%Program Files%\FreeRide Games\repo2b8.rra (364 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8b3.rra (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defafc30.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\cliec5d.rra (509 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13b0.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\mask\updae80.rra (96 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd519.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_865.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI410.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12a6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5c5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4fa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd43f.rra (4 bytes)
%Program Files%\FreeRide Games\cmhe2a8.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game140d.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1093.rra (2 bytes)
%Program Files%\FreeRide Games\Game25a.rra (65287 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd28.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1333.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data567.rra (31 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14aa.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb53.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e117d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\defa41f.rra (2 bytes)
%Program Files%\FreeRide Games\Data\vers316.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbe2.rra (3404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fb55.rra (7560 bytes)
%Program Files%\FreeRide Games\GPlr23b.rra (32516 bytes)
%Program Files%\FreeRide Games\npGa14e8.rra (13264 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\EXEt6ee.rra (843 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaac6.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd529.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (323 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\auto96f.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\myGac2e.rra (22 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main144c.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLad6.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm827.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos77b.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrtfc20.rra (8434 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc1e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_17f8.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu661.rra (2 bytes)
%System%\d3dx335.rra (32512 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14b9.rra (1 bytes)
%Program Files%\FreeRide Games\Repo299.rra (31560 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f29.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\logi9ad.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f58.rra (156954 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\debu3e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_76b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb690.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF} (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7b9.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logoa78.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13bf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1362.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb25.rra (17 bytes)
%Program Files%\FreeRide Games\glut1ce.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6de.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1313.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files%\FreeRide Games\Skin\icon\Exitaf5.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlafbe2.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaaa7.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dial97e.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1006.rra (2 bytes)
%Program Files%\FreeRide Games\Win815f2.rra (2334 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (21 bytes)
%Program Files%\FreeRide Games\wh_P2d7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos78a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topRa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8c3.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\mask\errod76.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\icon\faviaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd18.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs147b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascba.rra (16 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d112f.rra (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbb3.rra (6040 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info1304.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\erorbef.rra (8 bytes)
%Program Files%\FreeRide Games\Data\Loca335.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ea.rra (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbf2.rra (2104 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help7aa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bannf3b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos120a.rra (376 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec5a6.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\mg42f.rra (7 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\signd37.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\ISSe20ee.rra (10504 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe17f.rra (10504 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos613.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascca.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\mask\playdd4.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7e8.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\preRd37.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load1258.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dropc6c.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbc3.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\og_id09.rra (625 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1164 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada59.rra (2334 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo151.rra (515 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data160.rra (15968 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6cf.rra (2 bytes)
%Program Files%\FreeRide Games\frg-2e7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto558.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_2807.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a111f.rra (5 bytes)
%Program Files%\FreeRide Games\exs.ini (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\licefbc3.rra (9 bytes)
%Program Files%\FreeRide Games\AX322b8.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1239.rra (247 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd47d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\skin9dc.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlr9ec.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd50a.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan13cf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord1287.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\playd18.rra (729 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load142d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l11bc.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd49c.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_a98.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13a0.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\icon\Servb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_940.rra (13 bytes)
%Program Files%\FreeRide Games\ExentComponents.ini (1073 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12b6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca325.rra (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Strifc20.rra (2 bytes)
%Program Files%\FreeRide Games\FRGN383.rra (17 bytes)
%WinDir%\Downloaded Program Files\Exen354.rra (32172 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu213c.rra (4412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Fontfc01.rra (39 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1277.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\inde3a2.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\framcda.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm817.rra (1 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu215c.rra (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (4 bytes)
%Program Files%\FreeRide Games\Skin\Skin3a2.rra (352 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\0x041e7d.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLea2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim539.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC1381.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6bf.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6cf.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR14aa.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBoa1b.rra (1 bytes)
%Program Files%\FreeRide Games\Data\Loca325.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6fe.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\logicf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR149a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\md3f0.rra (383 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLae6.rra (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exsfbd2.rra (12834 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ1352.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_930.rra (12 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (1612 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13bf.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4db.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlrb63.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m11cb.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid76.rra (96 bytes)
%Program Files%\FreeRide Games\lice2e7.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\switd57.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho587.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb43.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_a3b2.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Stri6fe.rra (11940 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_m3c2.rra (24 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm836.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10c2.rra (1 bytes)
%Program Files%\FreeRide Games\exs316.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI400.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlab63.rra (17 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu212d.rra (256 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\dl41f.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd48d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyGab82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun1248.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb16.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_884.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\errocab.rra (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGafbf2.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10d1.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_94f.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\layo20fe.rra (515 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec14d9.rra (807 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada69.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\mg_i9bd.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topLa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load141d.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa95f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca335.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\Mostbc0.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\sett9cc.rra (6 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x0418f.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5e4.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear146b.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o11db.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_875.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\fram99e.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g119c.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Sett393.rra (1 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu19f.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\icon\IAFb72.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corefc11.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dl_i98e.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regifbc3.rra (29 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\jquece9.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb15.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i11ac.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_d3c2.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott13df.rra (35 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\back5b6.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos623.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6b0.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto548.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\icon\Settb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb671.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\yesnd66.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Connad6.rra (296 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro98e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi10f1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd46d.rra (3 bytes)
%Program Files%\FreeRide Games\Clie393.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_1807.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb661.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1eac.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb34.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\mg_id09.rra (20 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\exs20df.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd45e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\pbc2e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi1248.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\icon\Tray383.rra (17 bytes)
%Program Files%\FreeRide Games\GPla1ce.rra (154846 bytes)
%Program Files%\FreeRide Games\X4HS1be.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_70d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc0f.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_75b.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\MyGabd0.rra (4298 bytes)
%Program Files%\FreeRide Games\report.ini (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\play1110.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\splad47.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos633.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1268.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ac.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e114e.rra (4 bytes)
%Program Files%\FreeRide Games\exs2f6.rra (12834 bytes)
%Program Files%\FreeRide Games\X4Ex1ae.rra (16732 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi1100.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g118d.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12c5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear147b.rra (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (807 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec596.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid86.rra (48 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu211d.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1371.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyDob82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\attaa0b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8d2.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12d5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Chanaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_855.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc71d.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\spla9dc.rra (2 bytes)
%Documents and Settings%\All Users\Desktop\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialbe0.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7d8.rra (3 bytes)
%Program Files%\FreeRide Games\3rdP2e7.rra (26 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_c3b2.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_846.rra (27 bytes)
%Program Files%\FreeRide Games\AppL2c8.rra (32102 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\tracd57.rra (7 bytes)
%Program Files%\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u11fa.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_p3d1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\GATrbc0.rra (2326 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4cb.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5f4.rra (2 bytes)
%Program Files%\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10b2.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help79a.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6b0.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxfc01.rra (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s11eb.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\og_i9bd.rra (1 bytes)
%Program Files%\FreeRide Games\exs306.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_74c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb05.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa96f.rra (2 bytes)
%Program Files%\FreeRide Games\Game289.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dl_ic5d.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb681.rra (2 bytes)
%Program Files%\FreeRide Games\npEx373.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g11ac.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_95f.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\botta49.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_07e8.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnfc11.rra (11 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu170.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\erroc9b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1219.rra (483 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu642.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\yesn9ec.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\Helpb72.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\AC_Rc4d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1323.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRia2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13fe.rra (181 bytes)
%Program Files%\FreeRide Games\myGa393.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip690.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_911.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Onlib82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Game3f0.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb24.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12e5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd44e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca326.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaab7.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\key_cf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flasa59.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro99e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_901.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Spla3f0.rra (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exsfd97.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\logi3e1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8f2.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6a0.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu652.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8e2.rra (22 bytes)
%Program Files%\FreeRide Games\DoDl306.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc73c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pids42f.rra (58 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8a4.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retra78.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isrfc30.rra (18974 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e113f.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\iconbef.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo143c.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_921.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\spacc3d.rra (49 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5d5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6ee.rra (5 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlayer.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isres_0x0409.dll (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnetinstaller.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\StringTable_0x0409.ips (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_toolbar.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corecomp.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\license.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\default.pal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_toolbar_w_homepage.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.inx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\RegistryValues.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxData.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGameTreatPlugin.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FontData.ini (0 bytes)
The process Free Ride Games.exe:1756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\header[1].jpg (4881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (18524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].html (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[1].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\beacon[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_PROGRESS[1].htm (2073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Exent\GI20140801150510GMT.Log (28 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (1238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (1286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDMLog.log (2605139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[3].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion3[1].gif (24079 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (223946 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (3017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDM_DB_148.xml (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_HEADER2[1].css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion4[1].jpg (23149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\13[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\header[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\conversionTracking[1].htm (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].htm (1155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion2[1].jpg (23210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion1[1].jpg (19117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\boxshot_sm[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsdm.bat (175 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (0 bytes)
Registry activity
The process FreeRideGames.e:608 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 1F 2A 34 BE 0B 98 48 E9 BF 2B E9 72 C0 7F 12"
The process GPlayer.exe:252 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"RTyp" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"TicketID" = "1204111893"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"ErrorID" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"ErrorID" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"PlayTime" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"
[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"RTyp" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"TargetURL" = ""
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"TargetURL" = ""
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"filepath" = "%Program Files%\FreeRide Games\Info\4.clg"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"TicketID" = "1204111893"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "3"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"STyp" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"STyp" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 5F B3 71 2C EC 9A B0 35 E8 47 58 74 B3 B0 74"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"PlayTime" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"filepath" = "%Program Files%\FreeRide Games\Info\3.clg"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process GPlayer.exe:1132 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"ErrorID" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"RTyp" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"filepath" = "%Program Files%\FreeRide Games\Info\5.clg"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"PlayTime" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"
[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"STyp" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"TicketID" = "1204111893"
"PlayTime" = "0"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"TicketID" = "1204111893"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"ErrorID" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"filepath" = "%Program Files%\FreeRide Games\Info\6.clg"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "5"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"RTyp" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"TargetURL" = ""
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"TargetURL" = ""
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 7A 83 48 C7 A8 5E 0E 54 52 6B 25 92 D9 0E 5A"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"STyp" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process GPlayer.exe:1956 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"RTyp" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"TargetURL" = ""
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"RecoverSendFilesCount" = "3"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"TargetURL" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"PlayTime" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"STyp" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"filepath" = "%Program Files%\FreeRide Games\Info\2.clg"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"filepath" = "%Program Files%\FreeRide Games\Info\1.clg"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"ErrorID" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"PlayTime" = "0"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"RTyp" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"ErrorID" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 A7 6B 5E 45 8F 27 80 EF 47 8F F2 90 55 C8 58"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"TicketID" = "1204111893"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"MaxFilesCount" = "16"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"TicketID" = "1204111893"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"STyp" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process %original file name%.exe:860 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 BE B3 71 50 9E 69 7B 1C A2 D5 4F F3 A1 37 51"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsep.bat" = "_uninsep"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148]
"Free Ride Games.exe" = "FreeRideGames Application"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The process Regsvr32.exe:1752 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 F5 81 E2 FB 95 40 D4 EC 03 2D 38 15 6C C4 0C"
[HKLM\System\CurrentControlSet\Control\WOW]
"DefaultSeparateVDM" = "yes"
The process RegEdit.exe:936 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}]
"(Default)" = "Game Treat Widget"
[HKCR\AppID\{B415CD14-B45D-4BCA-B552-B06175C38606}]
"(Default)" = "FireBreathWin"
[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\ProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\VersionIndependentProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget"
[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"Extension" = ""
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\Version]
"(Default)" = "1"
[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"(Default)" = "Game Treat Widget"
[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}]
"(Default)" = "IFBComEventSource"
[HKCR\GameTreatWidget.GameTreatWidget\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"
[HKCR\GameTreatWidget.GameTreatWidget\CurVer]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"
[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}]
"(Default)" = "IFBComJavascriptObject"
[HKCR\GameTreatWidget.GameTreatWidget.1]
"(Default)" = "Game Treat Widget"
[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"CLSID" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus\1]
"(Default)" = "131473"
[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}]
"(Default)" = "IFBControl"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"
[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\FLAGS]
"(Default)" = "0"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus]
"(Default)" = "0"
[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCR\GameTreatWidget.GameTreatWidget.1\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"
[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"Version" = "1.0"
[HKCR\AppID\npGameTreatWidget.dll]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"
[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 63 2B C2 2A B8 03 3C 7C 11 45 1E BF 68 76 0B"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"
[HKCR\GameTreatWidget.GameTreatWidget]
"(Default)" = "Game Treat Widget"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\iexplore\AllowedDomains\*]
"Count" = "0"
[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"Version" = "1.0"
[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"
[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"Version" = "1.0"
[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0]
"(Default)" = "GameTreatWidget 1.0 Type Library"
The process RegEdit.exe:1584 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"Value" = ""
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"Value" = "30000"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"IsReadOnly" = "1"
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"Value" = "1800"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"Value" = "old"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"Value" = "http://beta.freeridegames.com/messages/rss/"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"Value" = "Default"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"Value" = "3600"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"Value" = "default"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"Value" = "advoyris"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"Value" = "86400000"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"Value" = "60000"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"Value" = "168,86400"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"Value" = "30000"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"Value" = "2"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"Value" = "193"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"Value" = "1000"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 63 68 6E 48 F7 A9 D5 50 C8 CD 97 B1 C2 3A CA"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"Value" = "http://beta.freeridegames.com/messages/contentpush/"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastSuccessfulErrURL" = "http://player.freeridegames.com/opTools/errorReport.jsp"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"Value" = "3600"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsReadOnly" = "1"
[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"RunPlayerOnStartUp" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"Value" = "ON(143_CAMPAIGN_SERIAL_ID)ON(143_TURNKEY)ON(143_FIRST_BROWSER)NN(143_CAMPAIGN_PERFORMED_CONVERSIONS)NN(143_DAYS_PLAYED)NN(143_REACTIVATION_ID)NN(143_GAG)NN(143_UDOM)"
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"Value" = "player.freeridegames.com"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"Value" = "360"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"IsVisible" = "1"
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"Value" = "117802240"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"Value" = "3600"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"Value" = "20000"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"Value" = "player.freeridegames.com"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"Value" = "10"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"Value" = "http://player.freeridegames.com/do/PlayerUpdateInfo"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"Value" = "4320"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"Value" = "http://player.freeridegames.com/opTools/clientReport.jsp?theme=Home"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"Value" = "1800"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"Value" = "168,43200"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"Value" = ""
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"Value" = "http://player.freeridegames.com/check.jsp"
[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingLastState" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"Value" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"Value" = "1440"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"Value" = "http://player.freeridegames.com/do/gameInfo?contentId=%GAME_ID%"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsReadOnly" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsVisible" = "0"
[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingEnable" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsReadOnly" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsVisible" = "1"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"Value" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsVisible" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsVisible" = "1"
The process setup.exe:908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Version" = "16777219"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus\1]
"(Default)" = "132497"
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"Installer" = "MSICD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc" = "Completed"
[HKCR\ExentControl.ExentInf1.1]
"(Default)" = "ExentInf1 Class"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = ""
[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\HELPDIR]
"(Default)" = "%WinDir%\Downloaded Program Files"
[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}]
"(Default)" = "IExentCtlStub"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ProductGUID" = "{6C26A305-4549-4A8A-9F03-25719C03B0FB}"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148]
"BinPath" = "%Program Files%\FreeRide Games"
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\DownloadInformation]
"CodeBase" = ""
[HKCU\Software\AppDataLow\Software\ExentControl]
"runInstallFlag" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\MozillaPlugins\www.exent.com/GameTreatWidget]
"Path" = "%Program Files%\FreeRide Games\NPGameTreatPlugin.dll"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Keep Free Space" = "50"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\0\win32]
"(Default)" = "%Program Files%\FreeRide Games\npGameTreatWidget.dll"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair" = "1"
[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}]
"(Default)" = "_IExentInfEvents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"VersionMajor" = "1"
"URLInfoAbout" = "www.exent.com"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentStub"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\HELPDIR]
"(Default)" = "%Program Files%\FreeRide Games"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"LogMode" = "1"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"
[HKCR\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls safely initializable from persistent data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"
[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}]
"(Default)" = "IExentInf"
[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Version]
"(Default)" = "1.1"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus]
"(Default)" = "0"
[HKCR\ExentControl.ExentStub\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ProgID]
"(Default)" = "ExentControl.ExentInf1.1"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallLocation" = "%Program Files%\FreeRide Games"
"Publisher" = "Exent Technologies"
"InstallSource" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\pft3.tmp\"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\%WinDir%\Downloaded Program Files]
"ExentControl.ocx" = "1"
[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1]
"(Default)" = "ExentControl 1.1 Type Library"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"(Default)" = "%Program Files%\FreeRide Games\FreeRide Games"
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Contains\Files\%WinDir%\Downloaded Program Files]
"ExentControl.ocx" = ""
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\FLAGS]
"(Default)" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallString" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409 -removeonly"
"NoModify" = "1"
"VersionMinor" = "0"
[HKCR\ExentControl.ExentStub.1]
"(Default)" = "ExentStub Class"
[HKCR\ExentControl.ExentInf1]
"(Default)" = "ExentInf1 Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"Path" = "%Program Files%\FreeRide Games"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = "ExentStub Class"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"Policy" = "3"
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"(Default)" = "07,02,00,07"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayName" = "FreeRide Games"
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"LastModified" = "Wed, 20 Jun 2012 05:42:12 GMT"
[HKCR\exent\shell\open\command]
"(Default)" = "%Program Files%\FreeRide Games\Win8Launcher.exe %1"
[HKCR\ExentControl.ExentStub]
"(Default)" = "ExentStub Class"
[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"Version" = "1.1"
[HKCR\ExentControl.ExentInf1\CurVer]
"(Default)" = "ExentControl.ExentInf1.1"
[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"Version" = "1.1"
[HKCR\ExentControl.ExentStub\CurVer]
"(Default)" = "ExentControl.ExentStub.1"
[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\0\win32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayVersion" = "1.00.0003"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"RegOwner" = "XP1"
[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"
[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\TypeLib]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCR\ExentControl.ExentStub.1\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Size" = "3927"
[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppPath" = "%Program Files%\FreeRide Games"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallStringOriginal" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Setup.exe -runfromtemp"
"RegCompany" = "Malware"
[HKCR\ExentControl.ExentInf1.1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ToolboxBitmap32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx, 101"
[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"Version" = "1.1"
[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\ProgID]
"(Default)" = "ExentControl.ExentStub.1"
[HKCR\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls that are safely scriptable"
[HKCR\ExentControl.ExentInf1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = "ExentInf1 Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"ThreadingModel" = "Apartment"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ExentControl.ocx]
"{4FF78044-96B4-4312-A5B7-FDA3CB328095}" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRemove" = "0"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 4A 30 F3 B4 C9 FE 87 4A 16 F8 07 D5 A0 10 3A"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"Progress" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Language" = "1033"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallDate" = "20140801"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Games Dir" = "Remote Programs"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayIcon" = "%Program Files%\FreeRide Games\myGames.ico"
[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"(Default)" = "%Program Files%\FreeRide Games\npGameTreatWidget.dll"
[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentInf1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ModifyPath" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409"
"LogFile" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ilg"
[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"SystemComponent" = "0"
[HKCR\exent]
"URL Protocol" = ""
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ExentControl.ocx]
".Owner" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\MozillaPlugins\@exent.com/npExentControl,version=7.1.0.1]
"Path" = "%Program Files%\FreeRide Games\npExentControl.dll"
[HKCR\exent]
"(Default)" = "URL:Exent Protocol"
[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppName" = "GPlayer.exe"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
The Trojan deletes the following registry key(s):
[HKLM\SOFTWARE\Exent Technologies]
[HKLM\SOFTWARE\Exent Technologies\FreeRide Games]
[HKLM\SOFTWARE\Exent Technologies\FreeRide Games\1.00.0003]
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MinorVersion"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MajorVersion"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ExtResponse"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoModify"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair"
"NoRemove"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"
"Progress"
The process Free Ride Games.exe:1756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014080120140802\"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CacheOptions" = "11"
"CacheRepair" = "0"
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
"ResumePage" = "index.html#PageId=SDM_PROGRESS"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"Free Ride Games.exe" = "10"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148]
"FreeRideGames.exe" = "EXEtender Player"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9216" = "My Computer"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsdm.bat" = "_uninsdm"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 2D 79 01 C9 4E B5 0D 18 D3 F7 41 D9 C8 C5 53"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CachePrefix" = ":2014080120140802:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '595450'"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following registry key(s):
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
"AutoConfigURL"
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"
The Trojan disables automatic startup of the application by deleting the following autorun value:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM"
Dropped PE files
MD5 | File path |
---|---|
0f5522184e9ab86f640b6cb1df65ed9f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\ExentCtlInstaller.dll |
073aed8b0f5e6be312410ba6f61c452b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\Free Ride Games.exe |
35582cf9713985c9b746e8544c792d9c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\FreeRideGames.exe |
72ef2d24d0efd50633e348426acb452f | c:\Program Files\FreeRide Games\AX32.dll |
b3c69f6569b3ddf8f90e0fe882981a5d | c:\Program Files\FreeRide Games\AppLoader2KEx.dll |
3645930301faace148be2813e8ce7977 | c:\Program Files\FreeRide Games\DoDlg.exe |
112811fe88dc3437ba8e731209f66465 | c:\Program Files\FreeRide Games\GPlayer.exe |
e440493ee5b307736dbcccab3b6d4bd5 | c:\Program Files\FreeRide Games\GPlrLanc.exe |
9373af11b046df0de7cd437ad2e99638 | c:\Program Files\FreeRide Games\GameInst.dll |
f1ec77deb12d8637c010ee26e1a28e0d | c:\Program Files\FreeRide Games\GameLauncher.exe |
d2e90286b623106bf283749f49b496f1 | c:\Program Files\FreeRide Games\Report.exe |
549d2f6d72267e727ed29baef05aa68b | c:\Program Files\FreeRide Games\X4Ex_Pr148.sys |
51b3cc1f1a2762f31ac35560a1de9004 | c:\Program Files\FreeRide Games\X4HSEx_Pr148.sys |
ae81517636a17218e6fed6116452ccbc | c:\Program Files\FreeRide Games\cmhelper.exe |
d5783da0f964882bc555a83da5e2bad5 | c:\Program Files\FreeRide Games\exs.dll |
55c38709c3c879b2d0fa24f751d2c824 | c:\Program Files\FreeRide Games\glutil.dll |
c330e3f40bb38bcb04e4743407c8b6c9 | c:\Program Files\FreeRide Games\npExentControl.dll |
9bc0902f50e58167b4b778ef6f1b1103 | c:\Program Files\FreeRide Games\wh_Pr148.dll |
1bf0fc52d41be3f3c1025b3971bc49a0 | c:\Program Files\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSetup.dll |
9afff8eae9918d5051b52eb432d6dac0 | c:\Program Files\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe |
7ac9b56c15369c1c950d32e9084b9dde | c:\WINDOWS\Downloaded Program Files\ExentControl.ocx |
39c858645cbf37b83bc907e188f8bc85 | c:\WINDOWS\system32\d3dx9_32.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
FreeRideGames.e:608
GPlayer.exe:252
GPlayer.exe:1132
GPlayer.exe:1956
%original file name%.exe:860
Regsvr32.exe:1752
RegEdit.exe:936
RegEdit.exe:1584
setup.exe:908
Free Ride Games.exe:1756 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (11297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (4508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (6224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (14367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (42648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (157015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (5 bytes)
%Program Files%\FreeRide Games\Info\4.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\3.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\6.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\5.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\1.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\2.clg (1093 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\Free Ride Games.exe (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (6389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\cmhelper.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\resourceDll.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\ExentCtlInstaller.dll (98 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu20fe.rra (14400 bytes)
%Documents and Settings%\All Users\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgToa3a.rra (1 bytes)
%Program Files%\FreeRide Games\repo2b8.rra (364 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8b3.rra (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defafc30.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\cliec5d.rra (509 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13b0.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\mask\updae80.rra (96 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd519.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_865.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI410.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12a6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5c5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4fa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd43f.rra (4 bytes)
%Program Files%\FreeRide Games\cmhe2a8.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game140d.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1093.rra (2 bytes)
%Program Files%\FreeRide Games\Game25a.rra (65287 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd28.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1333.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data567.rra (31 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14aa.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb53.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e117d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\defa41f.rra (2 bytes)
%Program Files%\FreeRide Games\Data\vers316.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbe2.rra (3404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fb55.rra (7560 bytes)
%Program Files%\FreeRide Games\GPlr23b.rra (32516 bytes)
%Program Files%\FreeRide Games\npGa14e8.rra (13264 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\EXEt6ee.rra (843 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaac6.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd529.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (323 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\auto96f.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\myGac2e.rra (22 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main144c.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLad6.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm827.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos77b.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrtfc20.rra (8434 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc1e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_17f8.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu661.rra (2 bytes)
%System%\d3dx335.rra (32512 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14b9.rra (1 bytes)
%Program Files%\FreeRide Games\Repo299.rra (31560 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f29.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\logi9ad.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f58.rra (156954 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\debu3e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_76b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb690.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7b9.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logoa78.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13bf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1362.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb25.rra (17 bytes)
%Program Files%\FreeRide Games\glut1ce.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6de.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1313.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files%\FreeRide Games\Skin\icon\Exitaf5.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlafbe2.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaaa7.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dial97e.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1006.rra (2 bytes)
%Program Files%\FreeRide Games\Win815f2.rra (2334 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (21 bytes)
%Program Files%\FreeRide Games\wh_P2d7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos78a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topRa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8c3.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\mask\errod76.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\icon\faviaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd18.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs147b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascba.rra (16 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d112f.rra (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbb3.rra (6040 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info1304.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\erorbef.rra (8 bytes)
%Program Files%\FreeRide Games\Data\Loca335.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ea.rra (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbf2.rra (2104 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help7aa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bannf3b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos120a.rra (376 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec5a6.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\mg42f.rra (7 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\signd37.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\ISSe20ee.rra (10504 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe17f.rra (10504 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos613.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascca.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\mask\playdd4.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7e8.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\preRd37.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load1258.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dropc6c.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbc3.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\og_id09.rra (625 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1164 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada59.rra (2334 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo151.rra (515 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data160.rra (15968 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6cf.rra (2 bytes)
%Program Files%\FreeRide Games\frg-2e7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto558.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_2807.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a111f.rra (5 bytes)
%Program Files%\FreeRide Games\exs.ini (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\licefbc3.rra (9 bytes)
%Program Files%\FreeRide Games\AX322b8.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1239.rra (247 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd47d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\skin9dc.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlr9ec.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd50a.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan13cf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord1287.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\playd18.rra (729 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load142d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l11bc.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd49c.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_a98.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13a0.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\icon\Servb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_940.rra (13 bytes)
%Program Files%\FreeRide Games\ExentComponents.ini (1073 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12b6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca325.rra (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Strifc20.rra (2 bytes)
%Program Files%\FreeRide Games\FRGN383.rra (17 bytes)
%WinDir%\Downloaded Program Files\Exen354.rra (32172 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu213c.rra (4412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Fontfc01.rra (39 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1277.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\inde3a2.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\framcda.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm817.rra (1 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu215c.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\Skin3a2.rra (352 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\0x041e7d.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLea2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim539.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC1381.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6bf.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6cf.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR14aa.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBoa1b.rra (1 bytes)
%Program Files%\FreeRide Games\Data\Loca325.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6fe.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\logicf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR149a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\md3f0.rra (383 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLae6.rra (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exsfbd2.rra (12834 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ1352.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_930.rra (12 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (1612 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13bf.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4db.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlrb63.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m11cb.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid76.rra (96 bytes)
%Program Files%\FreeRide Games\lice2e7.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\switd57.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho587.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb43.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_a3b2.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Stri6fe.rra (11940 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_m3c2.rra (24 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm836.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10c2.rra (1 bytes)
%Program Files%\FreeRide Games\exs316.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI400.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlab63.rra (17 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu212d.rra (256 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\dl41f.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd48d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyGab82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun1248.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb16.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_884.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\errocab.rra (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGafbf2.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10d1.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_94f.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\layo20fe.rra (515 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec14d9.rra (807 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada69.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\mg_i9bd.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topLa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load141d.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa95f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca335.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\Mostbc0.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\sett9cc.rra (6 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x0418f.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5e4.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear146b.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o11db.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_875.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\fram99e.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g119c.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Sett393.rra (1 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu19f.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\icon\IAFb72.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corefc11.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dl_i98e.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regifbc3.rra (29 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\jquece9.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb15.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i11ac.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_d3c2.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott13df.rra (35 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\back5b6.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos623.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6b0.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto548.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\icon\Settb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb671.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\yesnd66.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Connad6.rra (296 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro98e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi10f1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd46d.rra (3 bytes)
%Program Files%\FreeRide Games\Clie393.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_1807.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb661.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1eac.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb34.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\mg_id09.rra (20 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\exs20df.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd45e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\pbc2e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi1248.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\icon\Tray383.rra (17 bytes)
%Program Files%\FreeRide Games\GPla1ce.rra (154846 bytes)
%Program Files%\FreeRide Games\X4HS1be.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_70d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc0f.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_75b.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\MyGabd0.rra (4298 bytes)
%Program Files%\FreeRide Games\report.ini (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\play1110.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\splad47.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos633.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1268.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ac.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e114e.rra (4 bytes)
%Program Files%\FreeRide Games\exs2f6.rra (12834 bytes)
%Program Files%\FreeRide Games\X4Ex1ae.rra (16732 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi1100.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g118d.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12c5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear147b.rra (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (807 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec596.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid86.rra (48 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu211d.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1371.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyDob82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\attaa0b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8d2.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12d5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Chanaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_855.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc71d.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\spla9dc.rra (2 bytes)
%Documents and Settings%\All Users\Desktop\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialbe0.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7d8.rra (3 bytes)
%Program Files%\FreeRide Games\3rdP2e7.rra (26 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_c3b2.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_846.rra (27 bytes)
%Program Files%\FreeRide Games\AppL2c8.rra (32102 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\tracd57.rra (7 bytes)
%Program Files%\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u11fa.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_p3d1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\GATrbc0.rra (2326 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4cb.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5f4.rra (2 bytes)
%Program Files%\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10b2.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help79a.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6b0.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxfc01.rra (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s11eb.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\og_i9bd.rra (1 bytes)
%Program Files%\FreeRide Games\exs306.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_74c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb05.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa96f.rra (2 bytes)
%Program Files%\FreeRide Games\Game289.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dl_ic5d.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb681.rra (2 bytes)
%Program Files%\FreeRide Games\npEx373.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g11ac.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_95f.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\botta49.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_07e8.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnfc11.rra (11 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu170.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\erroc9b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1219.rra (483 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu642.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\yesn9ec.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\Helpb72.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\AC_Rc4d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1323.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRia2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13fe.rra (181 bytes)
%Program Files%\FreeRide Games\myGa393.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip690.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_911.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Onlib82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Game3f0.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb24.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12e5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd44e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca326.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaab7.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\key_cf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flasa59.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro99e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_901.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Spla3f0.rra (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exsfd97.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\logi3e1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8f2.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6a0.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu652.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8e2.rra (22 bytes)
%Program Files%\FreeRide Games\DoDl306.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc73c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pids42f.rra (58 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8a4.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retra78.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isrfc30.rra (18974 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e113f.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\iconbef.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo143c.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_921.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\spacc3d.rra (49 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5d5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6ee.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\header[1].jpg (4881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (18524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].html (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[1].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\beacon[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_PROGRESS[1].htm (2073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Exent\GI20140801150510GMT.Log (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (1286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDMLog.log (2605139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[3].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion3[1].gif (24079 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (223946 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDM_DB_148.xml (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_HEADER2[1].css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion4[1].jpg (23149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\13[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\header[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\conversionTracking[1].htm (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion2[1].jpg (23210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion1[1].jpg (19117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\boxshot_sm[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsdm.bat (175 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '595450'" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Exent Technologies Ltd.
Product Name: ExentCtl Module
Product Version: 07.02.00.01
Legal Copyright: Copyright (c) 1996-2007 Exent Technologies Ltd. All rights reserved.
Legal Trademarks:
Original Filename: ExentCtl.ocx
Internal Name: ExentCtl
File Version: 07.02.00.01
File Description: ExentCtl Module
Comments: Release.
Language: Language Neutral
Company Name: Exent Technologies Ltd.Product Name: ExentCtl ModuleProduct Version: 07.02.00.01Legal Copyright: Copyright (c) 1996-2007 Exent Technologies Ltd. All rights reserved.Legal Trademarks: Original Filename: ExentCtl.ocxInternal Name: ExentCtlFile Version: 07.02.00.01File Description: ExentCtl ModuleComments: Release.Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 67586 | 69632 | 4.53151 | 13d4df63a29071e604d09a6768d2e641 |
.rdata | 73728 | 9413 | 12288 | 2.89315 | 1aae2e1490b0b801344569bed4d29505 |
.data | 86016 | 19400 | 16384 | 0.903431 | b02c7e2c998cd8ec273626efa37333f3 |
.rsrc | 106496 | 963096 | 966656 | 5.36094 | fd039aa7373d1f9040955ed82095602e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=595450 | |
hxxp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB | |
hxxp://a1507.b.akamai.net/free/frg/products/595450/boxshot_sm.jpg | |
hxxp://a1697.b.akamai.net/FRG_site/downloads/geo/en/Exetender_Default.exe | |
hxxp://e8296.g.akamaiedge.net/check.jsp | |
hxxp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450 | |
hxxp://a1697.b.akamai.net/freeride_marketing/SDM/SDM_standard/header.html | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/js/defines.js | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html | |
hxxp://e54.g.akamaiedge.net/meter/www.freeridegames.com/13.gif | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/img/header.jpg | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/js/defines.js | |
hxxp://a1294.w20.akamai.net/beacon.js | |
hxxp://a1294.w20.akamai.net/b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= | |
hxxp://a1294.w20.akamai.net/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif | |
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB | |
hxxp://player.freeridegames.com/do/gateway?sId=Default | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationstart | |
hxxp://player.freeridegames.com/do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationfinished | |
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 | |
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 | |
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB | |
hxxp://a1697.b.akamai.net/my_games?gameId=595450 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/main.css?version=38 | |
hxxp://player.freeridegames.com/do/gatewayCD?sId=&subId=&actid=&callback=updateClientCookies&_=1406905525155 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/templates.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/gamebox.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/sprite_sheet.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/hover_elements_sheet.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/tinybox.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/download_assist.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 | |
hxxp://a1697.b.akamai.net/static/marketing/header/css/header.css | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/background_pixel.jpg | |
hxxp://www-google-analytics.l.google.com/js/plusone.js | |
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js | |
hxxp://a1697.b.akamai.net/static/marketing/header/js/header.js | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 | |
hxxp://a1697.b.akamai.net/static/marketing/header/img/ui_elements.png | |
hxxp://a1697.b.akamai.net/static/marketing/header/img/logo.png | |
hxxp://a1697.b.akamai.net/static/marketing/header/img/icons.png | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_left_rib.jpg | |
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/oDB-fAAStWy.js?version=41 | |
hxxp://a1507.b.akamai.net/free/frg/products/450950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/554350/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_right_rib.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_pagenation_rib.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_left_rib.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/616550/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_right_rib.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/661050/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_pagenation_rib.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/footer/css/footer.css | |
hxxp://a1507.b.akamai.net/free/frg/products/608450/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/sprite_sheet.png | |
hxxp://a1507.b.akamai.net/free/frg/products/680950/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/631850/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels_rib.jpg | |
hxxp://star.c10r.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_top_rib.jpg | |
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png | |
hxxp://a1507.b.akamai.net/free/frg/products/558350/boxshot.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/green_btn_28_mid.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_corners.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_bottom_rib.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_top_rib.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_corners.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/645050/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/575350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/616950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/761850/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/589550/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/582150/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/571950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/710650/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/619350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/643650/boxshot.jpg | |
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/hover_elements_sheet.png | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_bottom_rib.jpg | |
hxxp://a1697.b.akamai.net/static/marketing/main/img/preload.gif | |
hxxp://a1697.b.akamai.net/static/marketing/footer/img/footer_pixel.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/563750/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/633350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/668950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/667850/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/624150/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/632750/boxshot.jpg | |
hxxp://a1697.b.akamai.net/action/JSONService | |
hxxp://a1507.b.akamai.net/free/frg/products/663350/boxshot.jpg | |
hxxp://stats.l.doubleclick.net/dc.js | |
hxxp://player.freeridegames.com/do/gateway?sId=&subId=&actid=&udom=partners.freeridegames.com | |
hxxp://a1507.b.akamai.net/free/frg/products/524350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/674750/boxshot.jpg | |
hxxp://www-googletagmanager.l.google.com/gtm.js?id=GTM-MJF4W9 | |
hxxp://a749.dsw4.akamai.net/rsrc.php/v2/y7/r/j0a7CRWp-Sa.js | |
hxxp://a1294.w20.akamai.net/rsrc.php/v2/y1/r/LVx-xkvaJ0b.png | |
hxxp://a1507.b.akamai.net/free/frg/products/719950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/642550/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/765950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/559350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/699950/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/701650/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/748750/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/766250/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/578250/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/521350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/661650/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/764350/boxshot.jpg | |
hxxp://a1507.b.akamai.net/free/frg/products/735250/boxshot.jpg | |
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftRootAuthority.crl | |
hxxp://a1363.g.akamai.net/pki/crl/products/MicWinHarComPCA_2010-11-01.crl | |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/img/header.jpg | 184.84.180.16 |
hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe | 63.85.36.72 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html | 184.84.180.16 |
hxxp://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41 | 23.15.4.18 |
hxxp://partners.freeridegames.com/static/marketing/main/img/background_pixel.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/554350/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 | 184.84.180.32 |
hxxp://b.scorecardresearch.com/beacon.js | 23.15.4.18 |
hxxp://img.exent.com/free/frg/products/699950/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels_rib.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/css/main.css?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 | 184.84.180.32 |
hxxp://b.scorecardresearch.com/b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= | 23.15.4.18 |
hxxp://img.exent.com/free/frg/products/616550/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/766250/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/css/sprite_sheet.css | 184.84.180.32 |
hxxp://static.ak.fbcdn.net/rsrc.php/v2/y1/r/LVx-xkvaJ0b.png | 23.15.4.18 |
hxxp://partners.freeridegames.com/my_games?gameId=595450 | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_corners.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_bottom_rib.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/608450/boxshot.jpg | 184.84.180.59 |
hxxp://stats.g.doubleclick.net/dc.js | |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_right_rib.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_top_rib.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/642550/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/hover_elements_sheet.png | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/748750/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/571950/boxshot.jpg | 184.84.180.59 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg | 184.84.180.16 |
hxxp://img.exent.com/free/frg/products/661650/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/header/img/logo.png | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/header/img/ui_elements.png | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/643650/boxshot.jpg | 184.84.180.59 |
hxxp://apis.google.com/js/plusone.js | |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/589550/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/761850/boxshot.jpg | 184.84.180.59 |
hxxp://images.scanalert.com/meter/www.freeridegames.com/13.gif | 23.194.144.80 |
hxxp://img.exent.com/free/frg/products/663350/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/631850/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 | 184.84.180.32 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css | 184.84.180.16 |
hxxp://partners.freeridegames.com/static/marketing/main/css/hover_elements_sheet.css | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/633350/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/css/download_assist.css | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/735250/boxshot.jpg | 184.84.180.59 |
hxxp://www.googletagmanager.com/gtm.js?id=GTM-MJF4W9 | 74.125.226.62 |
hxxp://partners.freeridegames.com/static/marketing/footer/css/footer.css | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_right_rib.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/624150/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 | 184.84.180.32 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif | 184.84.180.16 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 | 184.84.180.32 |
hxxp://www.freeridegames.com/check.jsp | 23.60.129.154 |
hxxp://img.exent.com/free/frg/products/668950/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/719950/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/616950/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/524350/boxshot.jpg | 184.84.180.59 |
hxxp://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user | 23.15.4.18 |
hxxp://img.exent.com/free/frg/products/563750/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/575350/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/674750/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_left_rib.jpg | 184.84.180.32 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg | 184.84.180.16 |
hxxp://b.static.ak.fbcdn.net/rsrc.php/v2/y7/r/j0a7CRWp-Sa.js | 23.15.4.16 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 | 184.84.180.32 |
hxxp://connect.facebook.net/en_US/all.js | |
hxxp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html | 63.85.36.72 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_corners.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/680950/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/701650/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/header/js/header.js | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/645050/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/css/gamebox.css | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/521350/boxshot.jpg | 184.84.180.59 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/js/defines.js | 184.84.180.16 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_pagenation_rib.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/sprite_sheet.png | 184.84.180.32 |
hxxp://www.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 | 31.13.74.49 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_pagenation_rib.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/710650/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/header/img/icons.png | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/green_btn_28_mid.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/632750/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/css/tinybox.css | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/595450/boxshot_sm.jpg | 184.84.180.59 |
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl | 23.15.4.8 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/img/preload.gif | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/header/css/header.css | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/578250/boxshot.jpg | 184.84.180.59 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css | 184.84.180.16 |
hxxp://partners.freeridegames.com/static/marketing/footer/img/footer_pixel.jpg | 184.84.180.32 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/js/defines.js | 184.84.180.16 |
hxxp://partners.freeridegames.com/action/JSONService | 184.84.180.32 |
hxxp://b.scorecardresearch.com/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= | 23.15.4.18 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/559350/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/558350/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/450950/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_top_rib.jpg | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/static/marketing/main/css/templates.css | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 | 184.84.180.32 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css | 184.84.180.16 |
hxxp://img.exent.com/free/frg/products/582150/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_bottom_rib.jpg | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/667850/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/765950/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/619350/boxshot.jpg | 184.84.180.59 |
hxxp://img.exent.com/free/frg/products/661050/boxshot.jpg | 184.84.180.59 |
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg | 184.84.180.16 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 | 184.84.180.32 |
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp | 184.84.180.32 |
hxxp://img.exent.com/free/frg/products/764350/boxshot.jpg | 184.84.180.59 |
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_left_rib.jpg | 184.84.180.32 |
s-static.ak.facebook.com | 23.209.49.33 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:12 GMT
Connection: keep-alive
GET /connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: static.ak.facebook.com
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Encoding: gzip
X-FB-Debug: ZB 50aMstmsTvc/Q8Bzyb3YkyXotkTC nMtFOpOrjd9HqCdP06SGvCzueP0UYwZvOqczfcXu59vy W3jNMO3Uw==
Vary: Accept-Encoding
Content-Length: 9227
Cache-Control: public, max-age=30665883
Expires: Wed, 22 Jul 2015 13:23:26 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
...........}.z.F...<......")/.1........mlg........D,....H.g.U........-...Z]U][.........../..........yQ.E./_1...tj...<?.).Y.Xoy..I.L..G3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'..zz..w8Ys..=X.?.T<vz[...Re..S.8.....g..p....fsvN.....5..4s.-..06......BR.k.f.@Y.0....zbM:.`r[.....ta%|a}...Y.....e........dR.nH.....Ho..'...E.k6'.&.X@Y.B..dH.$..."(p'..\O..8. ..%..r.|ga.DX.x:6b..<#....D.rLT....@P.....-`Ep..T.qDnZ.y. ...]7G...x.".K...&h......b..)V..BXe.l.6....W).{R.l...n.N.Q..3.....l....OcN...w.....jj.<..0......).Y......x.....E...t"`../.F.;..vz*.m<.(.4h....#.F,/^K`6...q..f..q.......<..X.\..z..L.O......R...Wb..,.A.6H.F... .\^^...LH....(.wP...P<.k..$.B..a..._....A..4.....;9 ...w=...gg....;.Y.8..... ."Z3...}...5l...K\.....V......=.r.q.i..Z....<B.C2.&^...\....Y...#.,..H>d)X.....I.%..d-9.....)v......)... .z........G."$.. .!..EX..n HX.,..X4.v.g&...c8...@..h.....K.9;..G.-.Q....'V.V........z..X............y4n]_.......|.l:r.Wj,..#...Hy........j.....x....[(..o...G....X.{.-.=...SF...{N*..;Z...........`..0.J|.Zl6.V...,....}0......\....W#...x..A0..;.Z.......Mgd.o6.V"..sE`..M]...W.U.Xvs.4....7..:....wb........LC.....0.W....sSNqsq...;v..{#,iEW.r.....7..`..O.I...2<..Q.<(JB.>......W.(.'g`.4.3.....m...T........w*....\.tw...y...}.@}_....&...[9P{k}7.G<./.1M#...BN.'(..Nh...........:.3qy.................N.;..1.>..xx$.~.....a...;.c.\......L6.4.K.by>.,.2..g....}.,9...# ..~]{P...o.q...X...6....6.]......[
<<
<<< skipped >>>
GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.fbcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-MD5: mQCwCAAKHD AV8oddNLhdw==
Content-Type: image/png
Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=
Content-Length: 1329
Cache-Control: public, max-age=16118759
Expires: Wed, 04 Feb 2015 04:31:23 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8......Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(........(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.Td....(.........@..C....."..'..i...u\.........../.A:b.r.P...J..m....~...2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....Dx..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}.......ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&.............[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......Z..nnnf...X..E.<......mR.L@...v.Q.G".Mq...[..j8..8ja.<......e.Q..^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!...... .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U..U..(...;.Mu..I.....IEND.B`...
<<
<<< skipped >>>
GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.fbcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-MD5: mQCwCAAKHD AV8oddNLhdw==
Content-Type: image/png
Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=
Content-Length: 1329
Cache-Control: public, max-age=16118759
Expires: Wed, 04 Feb 2015 04:31:23 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8......Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(........(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.Td....(.........@..C....."..'..i...u\.........../.A:b.r.P...J..m....~...2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....Dx..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}.......ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&.............[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......Z..nnnf...X..E.<......mR.L@...v.Q.G".Mq...[..j8..8ja.<......e.Q..^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!...... .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U..U..(...;.Mu..I.....IEND.B`...
<<
<<< skipped >>>
GET /do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=595450 HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 302 Moved Temporarily
Date: Fri, 01 Aug 2014 15:04:00 GMT
Server: Apache
Set-Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; Path=/; HttpOnly
Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_TURNKEY=Default-641406905440442383; Expires=Sat, 01-Aug-2015 15:04:00 GMT; Path=/
Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:04:00 GMT; Path=/
Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:04:00 GMT; Path=/
Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:04:00 GMT; Path=/
Location: hXXp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html
....
GET /do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:00 GMT
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html
7f9..<?xml version="1.0" encoding="utf-8"?><Response><ContentConfiguration id="595450"><IS><Url>hXXp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender.exe</Url><AddOns><Param><ID>""</ID><Name>noaddons</Name><Priority>0</Priority><Checked>false</Checked><Dependencies/></Param></AddOns><CommandLine/></IS><SDMVersion>1.0.0.22</SDMVersion><PromotionUrl>hXXp://player.freeridegames.com/product/SDM/SDM_standard</PromotionUrl><ReportUrl>hXXp://player.freeridegames.com/opTools/clientTracking.jsp</ReportUrl><ConversionUrl>http://player.freeridegames.com/do/conversionTracking</ConversionUrl><PartnerName>Default</PartnerName><ProviderId>148</ProviderId><ProviderName>FreeRideGames</ProviderName><ClientVersion>7.2.0.0</ClientVersion><EULAUrl>http://player.freeridegames.com/do/general?Partner=Default&jspName=licenseAgreement</EULAUrl><ImgServerUrl>hXXp://img.exent.com/free/frg</ImgServerUrl><HeaderUrl>hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html</HeaderUrl><MyGamesUrl>hXXp://partners.freeridegames.com/my_games?gameId=%GAME_ID%</MyGamesUrl><StartPageId>SDM_EULA</StartPageId><Type>EN_NO_TB</Type><Game><Id>595450</Id><Name><![CDATA[The Secret of Margrave Manor]]>&
<<
<<< skipped >>>
POST /opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:00 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=798
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:00 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=798..Connection: Keep-Alive..Content-Type: text/html......
POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hXXp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:01 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=797
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:01 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=797..Connection: Keep-Alive..Content-Type: text/html......
GET /product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:02 GMT
Server: Apache
Last-Modified: Wed, 13 Apr 2011 11:32:31 GMT
ETag: "300000000521b-236c-4a0cb2a10245c"
Accept-Ranges: bytes
Content-Length: 9068
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=796
Connection: Keep-Alive
Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<title>Progress</title>..<!-- <link rel="stylesheet" type="text/css" href="css/SDM_PROGRESS.css"> -->..<!-- <script type="text/javascript" src="js/defines.js"></script> -->..<link rel="stylesheet" type="text/css" href="hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css">..<script type="text/javascript" src="http://cdn.exent.com/freeride_marketing/SDM/SDM_standard/js/defines.js"></script>..<script language="JavaScript" type="text/javascript">..function checkIframeSize(){..<!--...var viewportwidth;...var viewportheight;... // the more standards compliant browsers (mozilla/netscape/opera/IE7) use window.innerWidth and window.innerHeight... ... if (typeof window.innerWidth != 'undefined')... {.....viewportwidth = window.innerWidth,.....viewportheight = window.innerHeight... }... ...// IE6 in standards compliant mode (i.e. with a valid doctype as the first line in the document)...... else if (typeof document.documentElement != 'undefined'.... && typeof document.documentElement.clientWidth !=.... 'undefined' && document.documentElement.clientWidth != 0)... {..... viewportwidth = document.documentElement.clientWidth,..... viewportheight = document.documentElement.clientHeight... }... ... // older versions of IE... ... else... {..... viewportwidth = document.getElementsByTagName('body')[0].clientWidth,..... viewportheight =
<<
<<< skipped >>>
GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.fbcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-MD5: mQCwCAAKHD AV8oddNLhdw==
Content-Type: image/png
Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT
X-Content-Type-Options: nosniff
X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=
Content-Length: 1329
Cache-Control: public, max-age=16118759
Expires: Wed, 04 Feb 2015 04:31:23 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8......Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(........(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.Td....(.........@..C....."..'..i...u\.........../.A:b.r.P...J..m....~...2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....Dx..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}.......ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&.............[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......Z..nnnf...X..E.<......mR.L@...v.Q.G".Mq...[..j8..8ja.<......e.Q..^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!...... .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U..U..(...;.Mu..I.....IEND.B`...
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:33 GMT
Connection: keep-alive
GET /free/frg/products/589550/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 19 Apr 2009 06:44:48 GMT
Content-Type: image/jpeg
Content-Length: 26276
Accept-Ranges: bytes
X-Varnish: 1111897187
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................................................................................................................................................................................................................................................!1...AQ"a2#.q.BR....b3C....S$T...4%5..r.s.DdtE.&.......................!1..AQaq".......2..BRb#...r.3......c$..CSs45.............?.p.re...`..............l.R......?..._........|.Q..y..l.V..S......9S.U..."..>.u.....V.*..WJW%.cMa....J..Bh.....H?j.jI......Q. RPn....5*'..3.P.l..o....LBN."..G..<B0.......b............7.....p@.....8.<.uUU^...UW.\J..fD....7=..(....q....h......W..z .M*.v9T.E.....#......>.j..H..c...q.I..).H..k........z.............x...7l..'S......:.._c...U...{...W0.QV...h.q.....i*.r..rG..m%..Y\...&.^T.H..B,....".....*.sm.g....B..Q.....e....ch.....3.A.\..........2=\*.k.D.2K.....2O.E...*..zr]...D..~W...o........1k........y.).....vA..|.b.lC.|TEL.T.k."...N2.....o..a.a.wQGN..8\..\..^..T.vV,...a.X.....h!#._1.Q.Tw.wN......:9...W.?t..l!...=.1...2.. .S..../i (.....~..\n.2...j..Qf......h..B....d.g...0Z...i.4..t>K..4^-.01.DZ.Q..e..D.D.:....I..Z.<....."..h....Mu..P.)c..h...N.SQ]n ....~.E_........YM..|.sutt...g.s0....]7y. ....""|W..t.V..O.......r..g.....=$.N.2.5...DW.>]7.....].U*.....2.......c.\*U$.0~>......."..g..h.T....v..5.......59I...K..N../......J..U].. ...q..Eh..,s.l.%..!.=-.M4....*/....[v.|.K.Z...o.G,..cd'...l./,?.... C3)..N...k..."...'.x....U.34..M|t.......!.6.:.4...d..{....j.1..*..Y.}OE{: W..ya.^/Q
<<
<<< skipped >>>
GET /free/frg/products/582150/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 26 Jun 2013 10:47:21 GMT
Content-Type: image/jpeg
Content-Length: 38149
Accept-Ranges: bytes
X-Varnish: 1111897231 1111052407
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6F9A17903439E211955FE55656C7D978" xmpMM:DocumentID="xmp.did:2564C0E0DE4D11E2A95ED3BB7153D468" xmpMM:InstanceID="xmp.iid:2564C0DFDE4D11E2A95ED3BB7153D468" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F9B6107DCC611E295048EF1D728ED69" stRef:documentID="xmp.did:5F9B6108DCC611E295048EF1D728ED69"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d........................................................................................................................................................................................................................................................"!2#..1ABR3..Qaq.br$.....CST....cs4%...Dtu&6.....d.5.v.8........................"2..BR...br#!1...3$...AQ.C4.aq..S%....cs..DT..t5......6.....U&'............?.....|5..M>.......-...._...x.>........_.|......Yi.Uxz<~....}8.b.M...e....."^6I*..r8r..~.m...G....O..n......?.W.......!.M..)..Y.U3.q]
<<
<<< skipped >>>
GET /free/frg/products/661650/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 22 Mar 2011 12:18:46 GMT
Content-Type: image/jpeg
Content-Length: 28217
Accept-Ranges: bytes
X-Varnish: 1111897217 1111051928
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......J......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?...J.........V...>.r...G..^G.C.H#.`....J.I...F.....x....A.L=6.............../..... .W.j..Ou..Ek,.qZJ.9.%R....S\997.....<.>.<......H ....)...........fa.V.......3...^^..$.......BT..<@.....|#..\.....f...../.^.^M2.y{R..R...i..Z]}b.......@..aU.w./......#..k..@...e.&...I4^.\.NbD...@.. y"....8a../5I.#K ...-...G..$.......~29>.............mR;.<...?.......T.......%..siI...C~..y...E..S.>.e...bK{.k......a'%....'.G.,...w.}5.C.... .B..z.3ZhZ...g..sq/(.8`J..S.....Y..r......s..s..'..]*.X.!....M=...o$.Zi..K......>.J............X..z...#qBI=.r..K/...e....,....Uf..............U~Gy..Z.......k...I}E...r.....J....1?...54Y.b..9..\,%.........I.lC...N^p......yc;. .........J.....SXC5c{..bY....nb..=2. G6b@.cZN.....{m.R..W.k...6.#.....Rd..,..#R...m,....y#.............%..Xfy..b...".s..{..9(..XZ._k.........HY@"..J...... .w}...8...?..........[.<yz..Cc.s..S....w.@y.;:J...W..f.....@.?.5
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:31 GMT
Content-Type: image/jpeg
Content-Length: 58728
Accept-Ranges: bytes
X-Varnish: 1111680955 1109957715
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:B22AB4A0B36411DFA9EAD1B5118C216B" xmpMM:InstanceID="xmp.iid:B22AB49FB36411DFA9EAD1B5118C216B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|..............................................................................................!..1Qa"A2..q...R#.....Bb3..Cs$t.%E&r..DT..Ffv.....S...7.c..4d.58.Ueu...6V'.........................!.1..AQq"a...2....R....Br#D..b3$4...C..Sc5................?.....Y.....b.........?.h..................H....;.P.g.H.0}.....1.".....$:
<<
<<< skipped >>>
GET /gtm.js?id=GTM-MJF4W9 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googletagmanager.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Fri, 01 Aug 2014 15:05:24 GMT
Expires: Fri, 01 Aug 2014 15:05:24 GMT
Cache-Control: private, max-age=903
Server: HTTP server (unknown)
Content-Length: 10698
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
...........}.W.;.......>...7..n:>@ .&..Kr....V....Mw..b...JK/v;...3..9.7sqK*I.R.6-).....K...E.Z.Z .....^8..Ra.0(........./....0..!.._x..FC...bv&C.A.|"]....m..g:}.9.Q.n..Z...&..........Y.So....zW q....=.....-'..z]y.A....z!.h...^..s..1.u...uLc...,2\.. .0.......2.....bI........,.Q@...~|W....(.a..ht...a...`.}..Z...W1.6`....n.0....N......$..J.>.Fwkk.d.....o.&..x.c|Y) :.A.r..A.<...`W..LC6fX....=V....v...oB..J..3o.. ...;....".....X ...Eq~R.d..K3....3..Y......%..............&..J....=...`...Mj{q=5.... .".d!...0]..,.oj.H.....3.5..w.N.....w@U..f6[.u.,E......,.G)...kk...e..j3..$..g..!.z...F>0ns.Q...q.QB..LS....,.i...iz(bj.K.....T-...7...V>.@.8_C........&<x)<VK..j.d.......^...`.P..Hi....K..[F..!/......R.|...y0..8.N..d....j.M.(..h....{.<.n.er...@'...R-Q.D.`.............P....5.V..p.FO<8.!7-[....e./.....h..ix...\wPqF...Z. .UW...........W.&|..KR....V.(x.:..F.p...F....T'F*..Tn.0.....\'>wb).Z.1..;3.,.t@....%WHX.q.....uW.....fd0O3...tj*....6[m.uf..`.L..C.-1KV..m.......nI.......u[m....../....R_..&..;_...\...&X.>5&.uF&..../.....<......;#C..b...eq..3z..32... ..tQ.Q...%..'{.........s .......Ea?!1..R.d.5.H.y.).&-.|<........)..G.K...&,...j.......2..AZM.....,.V.u.#........>............{8 .......!.*.8..(...C..........[!.[....;.....8$.IA........V.gv..J..0.`.<.F7./....(0.....6...v...j.H..7W.....;..\]&].0..)JV]a.c/...P(..&..@./-.n..`:.....-%..,.X.........V....C99H%(...P..gI.`V...8....Lc....N.{Ls.. ..x[._.....q.....4}.C.*0...../..W!.....N.j........$.vE.Te.k...Qm.........^..<..*.M`.}.....hq...
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT
Content-Type: text/css
Accept-Ranges: bytes
X-Varnish: 1277530684 1277300854
Content-Encoding: gzip
Content-Length: 301
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Vary: Accept-Encoding
............=O.0..gG......IShQ.....,..*'.8..m]........hG..^.z......g.y...{.\p...,-...Dm...=?.%c,.~.L.m..R.>".T.....j.....(...n.......Dg...L%W..<z...2... .l!...Yk..S..h.;. ..Q..=8*..)[.@.`5j.......{.UO.)..4.]v.X|.}...n.%..-B.I' ..'.4.u..@.H.>Xy....:>.W.f..*;.bv........1..1=..i../o^........8U...$.:....HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT..Content-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1277530684 1277300854..Content-Encoding: gzip..Content-Length: 301..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding..............=O.0..gG......IShQ.....,..*'.8..m]........hG..^.z......g.y...{.\p...,-...Dm...=?.%c,.~.L.m..R.>".T.....j.....(...n.......Dg...L%W..<z...2... .l!...Yk..S..h.;. ..Q..=8*..)[.@.`5j.......{.UO.)..4.]v.X|.}...n.%..-B.I' ..'.4.u..@.H.>Xy....:>.W.f..*;.bv........1..1=..i../o^........8U...$.:........
GET /freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT
Content-Type: text/css
Accept-Ranges: bytes
X-Varnish: 1111680717 1111348487
Content-Encoding: gzip
Content-Length: 347
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...0(..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...n,..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...(...@1..X.....Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$.....PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$............HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT..Content-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1111680717 1111348487..Content-Encoding: gzip..Content-Length: 347..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding...............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...0(..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...n,..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...(...@1..X.....Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$.....PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$................
GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/jpeg
Content-Length: 90657
Accept-Ranges: bytes
X-Varnish: 1111680933 1109709205
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:AF514043B36311DFB23FC5759A59FD89" xmpMM:InstanceID="xmp.iid:AF514042B36311DFB23FC5759A59FD89" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|................................................................................................!.1a.A".Q2.q...#..V.BR.3.$Tt..uF.......Sc..^U.&v..brCs...4D7.8....e.f...6d'.......................!..1AQ.aq".......2...BR...br.#3.D....CS.4T...cs.$..5.t.%..d............?..g.....e=..WN.tu.U...N..V."(..".."(..".......J..<.P.
<<
<<< skipped >>>
POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 2552
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
tAQAAAAAAADBewCAeQAeAAkAeQApA4YelAAAAAUAAAAeAAAAKAoAAAIAAAeTZXxGa8NlIFehYGqCMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAA1OTUHODUGQTMzODUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:04 GMT
Server: Apache
Set-Cookie: JSESSIONID=6E8F644F8AD594DDDD847D9798CB7234; Path=/; HttpOnly
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 1
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
0..
GET /free/frg/products/680950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT
Content-Type: image/jpeg
Content-Length: 17864
Accept-Ranges: bytes
X-Varnish: 1109304790 1107277168
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..y7..k.5.......P .$...................^.D.......=:....V...6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e......6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5.........Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... ....z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5..@.sq.}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q....^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb ..6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2
<<
<<< skipped >>>
GET /free/frg/products/524350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 05 Mar 2009 14:05:07 GMT
Content-Type: image/jpeg
Content-Length: 29022
Accept-Ranges: bytes
X-Varnish: 1679247317 1678275182
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d..................................................................................................................................................................................................................................................!.1.AQ"...aq.2#...B......R3$%.rCb..4&.......................!..1A..Qa..q....."2.....B.Rbr#......3s.Sc$....4D............?..;.....=.... *...-.G5..YJSU!(......#F..K..H.........IU3.Ls.....Q.x....a.....[>Q...'.......1...zBV...o.J....j...gb.Q..u.C..M!T......"7Z.e.3............a7...s...v.........~p. OMhTv...P.q.]..t&..,.3..\.I ..'..M.7V..v.yq(fx..3S.b.../.}........S.J\..}.q.!..u....Rk..).bk.O.q.A.m..k.1o..t......U.....P...........t.._.LV .(.%..>.r|......[.G*).V.l...==.J..un.\..<....A.W?..` ..>....{.9.s.p..P....!..n3...F?tZ.Rmr..........x...C.c....{...Q....(.`YM...u...:.A.Z....SU).J..H.i..z.{..$Q.....H..f......j.Bv0>W.-.J}...*$......f....teizD..{u.).p..n$V.]y...BEN.'...H.V.J..Y.0bI......*..)Ris..!$.>c".&...T.1.Ty7&...6^MO.........I..v.`5.5.Z...9.<.......&...!.......q..}....qc..N..V..@uM.*j...P...B..../..].w...<..=..=l.....H....bI.c)...........o...D....7q.R.....]@.>."..U.W.sN.M(u/..6d...........A..oG...{....{]....v.......e.......?.....X.".:..`..#.v3..R.x..ZBTh....{C{.uQF.F..d.$......m.....Rx.....^.T.f......X...c...sP.v;.A)<J.... Ji.~...V4.]..1..x.{......Q..E......8..........$(qJB-...xmF..-S.,D.]...........S.S.F1;q.....h.....CmY..fBJ...t...H$.P..........y...j...e..6..w....S.W`.Iq...ko.[.."^3m.1.Y.!A.M.%.
<<
<<< skipped >>>
GET /free/frg/products/761850/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 26 Feb 2012 08:56:37 GMT
Content-Type: image/jpeg
Content-Length: 12469
Accept-Ranges: bytes
X-Varnish: 1111897241 1110148689
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90....C....................................................................C............................................................................".........................................D..........................!.1."AQ.2a..q..#3BRb..r......$CS...ED...................................9.......................!.1..AQ."aq2...BR.....#..br.3CS.............?...@.A=......4.....H>.J....I.g..H...,..H.8W...QHM..gRZb.......H.Z.D.&.T.O..<.......j.f.~..P..H...T8R.W....G..G......U..7Hk.X.%.7.cC.8%.q........F3...u..).....w..O.NHA?S..............}.W...M_.yv%..w>..w. i.....!..W$....?..S..v..kEE..2.LbUNx~..c2.......?.}....]|..6....v.......A....h.F.=.}.)5..5,8..*.z)'U}..{.....?.........b.S..._..#.b?1._E.....W.T.{*.~.x..l..'.:..v.5x...f#;,...N....gh$e .@=.....L...k........J.R.l.^..,...n..F.U....E.I..PSBBF.d..X8..x.Sa....L.1..........i.eL.9U....2g...[.D.....T...h..........%.8.."..'.9....H.....w..-;...?.g...%HP...c...\.2;j'U.x..$......1.rq....^.."..X.$.....q.s......Q...tY.;.i..]....Ns.......e( .v...P.8..& .VMH.O...F...:.EQJ....r7.........N.x....%.. ... ls.k......................6.DNV.F.Y..L...A..im.-...h..P.k..Q..U...{j...:oNm.....*....P..Q.a>.dd.....Lu.....u.!.......-....2TT=...>....t...u?p...j......S.Bo.@...d.Q\Aq.E...R...{OA....KCe.......I.1.'.(...z.U.....J"..n....H._.....N....N..\48E.M...R..d.....@.......Z../1.....R../......(>d...~:...6...].0.ASe.I...'.E.m..%N..q.{.'z._...RB2L{.s..t..6...v.n.). t..uB.@S......M .\'...b.Z.)xr.
<<
<<< skipped >>>
GET /free/frg/products/699950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 15 Sep 2011 12:15:43 GMT
Content-Type: image/jpeg
Content-Length: 16837
Accept-Ranges: bytes
X-Varnish: 1424314704 1424231860
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:26 GMT
Date: Fri, 01 Aug 2014 15:05:26 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d.................................................................................................................................................................................................................................................!.1..A.Qa"..q..2#....B.Rb%.....3C..s&........................!1.A.Qa..q."2......R#...Bbr.....3C.S$4............?..K.'.r.d.".79.X&.:F.. ..&..ww .)[........8......E...I..o.C].I.8*.P..P....O....[B....D....R..eIR....:..:\H....b.qk...7..z.2.....\Sn.Fw..$w$.).*aHl..g .....S....SZ...t...l..|.q.O....8f...E..ul.G_.4.:....s?.4^..sFoi....F...2..v...?.S.q.L..Er......OEYP."D.;.....w.....MDO....]*...t..b.N....a$Q....;...l..!.gPMg...R_....i...)TW.R.k.J.....G.h.Q.h...&.P.-.K.Is........_..4.q......-5..O.M.M..n..<......'..8..(..z..0'.=./R..thT.)@.......:.M$s$.....}C......{.k.u.*.>.}..1p...1..W*......[..B.]j..*..z......8.z..(U.]....$....tP..>=4l.......M.@G~s...[......:...s... ..Pz..D.I.V..#....m..b....B.OGW2!:.UP.t.V.Q..u...i...WJ&.V.....u..b....4.T..N..Rz.$......p.V.zzi'G~<.G..;..`...P.(.lG......|...`.........d....7|A0.Q.C....u..q...Dk../e..m..:Lh.r.:XA.%^....u...U`.I.5.j.lQ...QXV..we.2....P.......b5.?l.uNW.O...{..m.[...C...N.?O......*2 ..=.7N.."....Rcv...&..Wm$.W.....tE..'.....ov..II...5UG..6...X.........)S..cE^...=I.z.}l..".....Y.CGY..3"5.(..*m......UH.b...F...%.Kv!.q....E.O@~Z.ArQ9. B.S..w\..8>.,....F....n... .W.l:.iOb..SC].I.E..U(.K............;.N..i:.....Z...>.Q$...m...;...UO......Z.Zi.:..F."Z}.%...(.{gs.h. C.......P....
<<
<<< skipped >>>
GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=7287786-9717047
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 1926374367 1926325909
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 7287786-9717047/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 1926374367 1926325909..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 7287786-9717047/12146312..Content-Length: 2429262..Connection: keep-alive..Cache-Control: Private,max-age=0.....bK..h...ss...KA....&.uId..d..xf.[..PLDa... n.............T..T.7.z._!.-...P54......#ti.Y:k.;..}.Xja..cFa|3.;....Q.=^C3.....u.`...8..p.......`~zoR..w(..A^...~.$.>A.q...N..D0gtO.\...\.)....,n)X.|....Z...N..m....$.v..694....9wM...K....I..De.s....8W.../1l........-mW.kC.\.sK...Z........i.by.......X.........K.........`.&...I&....$....3>.'.[zu.s.n......4:...".....z...= ._..t..s>..&/(.Co.y.f....Gj(..z......OZ.mF.l.Jc..\%vu..'z.5J.P..4._0......(...^i...^..>!42]~.EQ\9........zMT...o-..D....2.,1..%..$#.n...-_hN...Ni..j........mU.......`...k....WV......"..R.j.......uc..qW.../...J.}j.]..g...F.f.U`._.".9..-..1....l....A..] ...cW..Z.,.........%.g....k.t....7(B(...&.......oS(..I.@...w.n......S.gk../.......H.5>.O...B)..-.]..x>q.~..M...gD..4..Vn<..H.H.p...0yl.<0c0m....V.{....L.4..rp......Cz.t...`...8...6 Jj..F]#&.<@.2...l.....ssK...K.m....d....."7..U././.Jo.....d. .v.....}K~i".9.-J.!.o.....,.@,.G.T.\...#.u....n2]Wx..y.}.-.{3..N..i>S/..G.!...=...|.....Y,...... .....F..d....>$...W..L..K.....BC.....efO0DK....-3....jd..D.......d.v...f4.....d....T.a...3..A.E.Y.......^izv.J^.K.J.#..]).{.m....=".D...Y.$..x..(.o3
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:28 GMT
Connection: keep-alive
GET /free/frg/products/668950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 21 Feb 2011 15:39:31 GMT
Content-Type: image/jpeg
Content-Length: 23666
Accept-Ranges: bytes
X-Varnish: 1111411910 1110267205
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d..................................................................................................................................................................................................................................................!..1AQ.a"..q.....2...B#..Rb..3r..$.....E.........................!1..AQa.q"....2...BR#....$..b3r..C%.............?..GA.|#.....F ..<......\0..\.....p.y.~.....>y..?<.O.......~..0(P..!......=........A.G..~#..e..~8.zx..G:............\'Z..T...>..H`........TA...<9D....E.....G.0.nC.r8O...ZE.'<.q...<.P.<(.........V...C.Q.=G...$.t.>.q..(.....o>.....s.u....CF.._T.xU.*Ky...?.....c.}..A.?u............?....>_..._..............|....,....|0....!B..G..w...$.....~.........|.........<%I...B.k..?.....p<(P......p5.K...@...U..H` .x../X....y..!.',c$.u.bP,y....2...2...@9Vu...9..#.....8.d&..s.Q......=M .....k .``#......$.j....Y.D...>P..d2yV..k.......y.......X^.........|xq.../..i:...k.e.x.....W.....o........q.....0D..T...K{Q.:.."p.@~n..i4}.........ck.v.C.yt...\..t4...x.?..g.,.........~#...W.t4j.yP,..L>.c...0.@.^&.A4]...............k...>...CV..0..(.f....z...DR...4a.>P...!..p.KH[.. ............i..~..'R I.Y.. ..C....<jJ.{s....iZ\u. #....H...A...a............K.mY9.V<N....'......u!l..............<..u.....E.m.x......a...4.=G..~.p.2<.1..yr.)LFC..0...../.L%...m-D|#..!..........$...$p...0....An5..*... ....>.....I.hv~....0e...K.|.....!..oqO4.:|(.9......m.E..Z.......a.....&..9q...Q........=...G.
<<
<<< skipped >>>
POST /do/gateway?sId=Default HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:52 GMT
Server: Apache
Set-Cookie: JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4; Path=/; HttpOnly
Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:04:52 GMT; Path=/
Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:04:52 GMT; Path=/
Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:04:52 GMT; Path=/
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Length: 38
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})....
POST /opTools/clientTracking.jsp?trackEvent=playerinstallationstart HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:53 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:53 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Content-Type: text/html..
GET /free/frg/products/563750/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 13:28:54 GMT
Content-Type: image/jpeg
Content-Length: 29430
Accept-Ranges: bytes
X-Varnish: 1110064354 1108874112
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE211955FE55656C7D978" xmpMM:DocumentID="xmp.did:0C1B73D5EA2D11E2A18CEE3F989F8A24" xmpMM:InstanceID="xmp.iid:0C1B73D4EA2D11E2A18CEE3F989F8A24" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:90D37B62E79B11E28D69DE4027E5AE9A" stRef:documentID="xmp.did:90D37B63E79B11E28D69DE4027E5AE9A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................................................................................................!..1A"..Q.aq2#...b.....BR.3...C$4%5........................!1...AQaq...."..2B...Rb.....r#..3.4CS$............?...%.:..\.......(i.J.J.R..Hm...>.S].hq.=.,.....I.TW3."}.Cb.F...3'..R...N.E...3..... O......R..%.DwR[.J@."...}w...!.@K.x...8..`do....._..&..fX6D....E...N.9.qZ.HT7....j.6.....U4!.q...,N%...%.
<<
<<< skipped >>>
GET /free/frg/products/645050/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 27 Sep 2010 13:16:46 GMT
Content-Type: image/jpeg
Content-Length: 24320
Accept-Ranges: bytes
X-Varnish: 798420471 798402511
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d....................................................................................................................................................................................................................................................!..1".AQa...q2.R#...B.t....br.3Ss$%7...c4T.u...CD.5..&6'8........................!1..AQaq....."r...2B.4.R.#3....bs$%5......Cc..............?...w._....YE"]S.Q,@IP..R.t.?]><h....t....GL....d....x..D.{}....j........].c.e..Z.a............J.....J...L.. e.@.P'R.h...[..M.[.....1.Sb=!6....N>..%....y.S....z.....{k...a..D.../...5..P.;D....D..........].lvo.C..8......l.Ej....R....q.S.$1#.......9...)..6.P.-2.M..`2.-..e...uT.@I.n.n.|k...... h0.....,Z.1e.b....%.XuL..2..q.R.C.QJ...<dUt...6H$i.n..b..).7s.Zv.s.nzDV..hN..6V9...G.\......b.?..\....@O.$2.......B....<...%jO...<#(.#.o.8....e;...SB$.Z..i.p.T.......">%.....}......q.i...g{.......J.z....Y...Hqk_Z....m$.I..nq.>$%aR-.]:m.......Q.%`......x...]...vJ.P....w.0j.....}.9*T.n..8...2.](AQ.!>e... ....... N...L.0qUV..V....?.n.......QS.l.^V#..D.W....[...;..Y....i................j...H&S..%.S......kT...e.{.....Z....j.)..ss.gC...x.....,.I.b...q.l....{T.'...>.S.a.Wx1..|.o...r.<..>...e.......s..&*f ....F.mhy..}-..t.h....`x'A...`..Q!...2...bg............&.E.!.8m$EEm..z...%..0.<.O.4.cN..qI.wFk....J.B...yk...XL`..5....&.=zkM.NG....$I.W.=.k.....;be.>\a..R.:.......GX:..k..xA.8x....'.|y.."..~.'drB..........~Q....o#..(..W. ..........t...o.v4......dv.-%E=...2;........
<<
<<< skipped >>>
GET /free/frg/products/578250/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 26 Jun 2013 12:33:39 GMT
Content-Type: image/jpeg
Content-Length: 31460
Accept-Ranges: bytes
X-Varnish: 1679249247 1678506895
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8E4D0DB03DCE211BB4FB0C483C69A6F" xmpMM:DocumentID="xmp.did:E13E1744DE5B11E2ABECAE40EB182E57" xmpMM:InstanceID="xmp.iid:E13E1743DE5B11E2ABECAE40EB182E57" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AA4F045ADCAA11E2B008B337C7D9C0AC" stRef:documentID="xmp.did:AA4F045BDCAA11E2B008B337C7D9C0AC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d......................................................................................................................................................................................................................................................!..1.$.AQ4.a..#DT%5.q..3d..."tE&.....2BC..U6.re.F'.Ss....Vfv.7.........................!..1A.$...Qa4DT%.q....dt5..."..E....2....U&6..u.Be'R...F7(..V..............?....w..k.8.tk../..N;..|.r.O.2E.WC8O....F.De_n.............O...qU)..y.z.............<..f..r..&..Mi......... >..sT.-.....6.....b...b
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:05:06 GMT
Connection: keep-alive
GET /rsrc.php/v2/y7/r/j0a7CRWp-Sa.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.static.ak.fbcdn.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/x-javascript; charset=utf-8
Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Content-MD5: MgEbNIV6xAPVxsNV4TTerw==
X-FB-Debug: YfDCXj1hmqpEFIqSlYah5nkeJh84VFS2zPnv/7EaiwBC/64qhfj7URdeE6OBgvz9PThqLpeQ6QN5L5zUSdocuA==
Vary: Accept-Encoding
Content-Length: 64284
Cache-Control: public, max-age=31273662
Expires: Wed, 29 Jul 2015 14:13:06 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
.............c.8.(..~.....I.h.N....7...9.n.L......h..E..dK....Z.. .%3....^,..Z(........^.w....~z...gO~>......g.?.....'?.?.....75;....k......d0.R......l....Qf.....yzy.qZ.G,o..LS...3.u.7.f..fa....J..<.k....7kL.d.....1K.gi...=?. ..Y..2.....zl....rVw~Z.....]..>.....u.....^Z..Z...U.....!8.<z=m=.Q..D......g'..?....xv..t.>>s~......(IR...n.u;-1.....)....:.i9....YAI.....qK~...0M.kqp_.../...wZ...;.f.0kDA<.....\..=tZ7.q...<........ja\."N..t......$Hp......dT..j..{CgCza`.E./.m.1.f......@.ptP..vG.PX...a.P!....J.9..t......\......t.T...C.9.K.:.H1....b..F.....:.2.Q.x..........q.hn|X...f.<.0.,..NU...c.<4..1....q?X|.q6....]...u.....7.O...7.>.n...w.F....!.M.C.$.&.x|.......qg.k.}..u.4..=~..x@..-E.q.(n......#.{..$.Lv;..4.l..@z...1M..F................'.....$.g.j/...G.u......9.g. .Co..;=.6.....r../...1.w....Z.0.i.;....`M...WFjN6.e .....V-.jq2...<k.A.!...e.U......9t...............@5....}.9M.A:.}.......Y1..xZ@!i...8...).|....`......`TC.L..e.G...........B?...1.,.......p0.9[........._........G.H11~o.Y...{G>x..&J`...v..`.5....s.t^_...........\.[Q.6.] ...t...'...sk.^A...<...A.I\....X.....p...-.{...z...s..99.....v..GG4..q.........m..i....d..55.o......b[.... .Yo..4.!.f....]..&.....vWO_....~-...1.<..o.&.\QM..waNs.................?....3...08..z3 ..o.T...g....U.5G.I.y%..Y...\...<9.....[D...".<l....................ul.}[..!.gC.pV....>|-|.#...}i.....,..v.........1...-...X?.']..J...$..x/..0A.. ..}5?.......?.....3..........3.......i..~n..._.....|J/?..Mp..on0.~n:'.Xo........X..\-~....n...x..N.[YW].
<<
<<< skipped >>>
GET /free/frg/products/595450/boxshot_sm.jpg HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 27 Jun 2013 06:36:07 GMT
Content-Type: image/jpeg
Content-Length: 3913
Accept-Ranges: bytes
X-Varnish: 467849060 467652213
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:01 GMT
Date: Fri, 01 Aug 2014 15:04:01 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8E4D0DB03DCE211BB4FB0C483C69A6F" xmpMM:DocumentID="xmp.did:37B0D717DEF311E2945197C9A349E208" xmpMM:InstanceID="xmp.iid:37B0D716DEF311E2945197C9A349E208" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:78F7FD0CDCA811E2B081EE85099AA43D" stRef:documentID="xmp.did:78F7FD0DDCA811E2B081EE85099AA43D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................<.3...........................................................................................$...4.!.D%5.T&..d7.AQ.#3E6.....c..Ue...FV'............................!1Qaq$4A..T%.....Dd..5.......U6............?..v.A.\>.0...}...........v..yZa...>,?l..fDn..l..vX.l.I.J0..8......RIyrI.......B..F..p....X..1. ..f...........m2v......'....._.pvYq.#..[.^.*Z.I..0..............l....(.....x...s.....^..
<<
<<< skipped >>>
GET /plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.facebook.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Pragma: no-cache
X-XSS-Protection: 0
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
X-UA-Compatible: IE=edge
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
X-FB-Debug: NJW5uIlGzuuGb8v0WPLpbhVOtUkQdQ9juZ3DzV8BnncVkXIogjvnc2uy3PPF2BAH8oj21lut95NPM7DNLB6LvQ==
Date: Fri, 01 Aug 2014 15:05:22 GMT
Transfer-Encoding: chunked
Connection: keep-alive
1ae3.............<.s.H..._.U.....|@....k...8...I#.. ..qX...=..!.o^}_..r..g...o............4........#.d..@.\{.;..f......$..A8.MtD..~...)..).....Y..wu.)....H..C....D..4.<.:d..|.D...`rb.n..|.._R7....A..&.~....a..c#.f.7X......,..iL.$"1l8..i.x..`..6....nkb.....].~.R..3..A{h.I.....xn@.....3.q.V....Y..."R}J..4......ObXy..F...`..R:O..s'...N.[..J....x8.\ .i.tmw@}..lS...i..n..R.#&...z0.Hm...~...9.........,.&...a....i....b...$v.....'4v.!...?......i..v.i....i..n..9B7..l....*~..,Y.7..bz..ZkI.ra....;.fq..Q....\z6...0..!....\...L.....pd4f.......p..(A......Ngi...V...Sy.....y..M....z..QFN.8.i.b.....>.|.......C........[.A.^ ...Q.;.|@....].`..PX.@o....^h.)...k.r......k...>fv#w...l.$%.1...@l...LP..:^/..>f.E.....e.z..%n.X3Q~..P....nJ.`..J..[6.....z...x..TC...G.V.h....,`....lX..HhJ.a.2KCqd....!.g..j.N..........t.(.S..*..0.y..(.S.%.E....n....p.....sC..Vo5E .}.0....?1..HJ.\...e.g..g..E.`.z. \-.xNcf)l.....8[.gR^J.....|.:@.>...N...^...n..../..#5rq"....F. /.su.UuC[.U..S...m9..S1P`U....x.Y1..V.7. ...7.c6.}A'!U.g...9..4..x.."....X.61....7ax3w#..<.. %......^`W.....<....c1.4.<o..pL..5.y.$...l..y6Td>.*.?.[....Q.....D..'...I.WEP.(.HA.r. .9P..... .n..Dx.}.8n..5..i.Z9.3`..........VCE....RP....ByR....;:..Z[...P..f..l|.....,'.) .0...:._..&B<...N X....:.&.,.@.Fm..[..Y6f.......e.-..$...9.#......|.$<.....:.OkW8.SH..iA6|...:.S3........Ij....z[S.._rX}!..:.#...P.nB...........'...uu...e..y..9..Y&.K.....q...... .V.....'I.Bi.S5'..k'.yku...9........ T....A...C......$;...g..^O.5..#^?dl8......L..x..V..y....@Q6.. #[...2..KG.
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 3330
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
.PNG........IHDR...1...).............tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.did:4E25B844FBE211E19D22C37B1A58EBB1" xmpMM:InstanceID="xmp.iid:4E25B843FBE211E19D22C37B1A58EBB1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18547691F077E1118511BC5C7C940756" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>?.u.....IDATx..Y]l\G.>g.......IJ.4)..J...KS..P.!Q.......'$........Q.*H..Z.F.ETi..RZJ..B,...sl.....zw..{...s83.n.(?..I.e...{=w.|s..3c$"._o....m..-.^...< wZ.....ZU..........`...I...@E...........".7.._#...yv...3..6.7.S..8.@..vt4..c....R.h...T...r...(....mKV...Tx.. .Xz......(.]yaB..*K.%......0G..e...jA#=?..8[rE......}r..Z||n.T...ul...y....I....T.MA.Mq.....[.*.7.....D...k........\.;..LN~..?4.Z.....n.M....xL.e.e....-.<..../0...F.... ...K......}....!.M..
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/yellow_bottom_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1237
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DCA0EBD556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8DCA0EBC556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................b...........................................................Q....U........................b...S..............?...Y........F...H......tH........
GET /static/marketing/main/img/containers/green_bottom_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1229
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F89900DD556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F89900DC556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................^............................................................R...U........................R..............?....L. ..Qu...-..oz\..3..HTTP/1.1 200 OK..Server: Apache..Content-Length: 1229..Content-Type: image/jpeg;charset=UTF-8..Cache-Control: max-age=86400..Expires: Sat, 02 Aug 2014 15:05:23 GMT..Date: Fri, 01 Aug 2014 15:05:23 GMT..Connection: keep-alive........Exif..II*............
<<
<<< skipped >>>
GET /free/frg/products/616950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 13 May 2009 07:04:16 GMT
Content-Type: image/jpeg
Content-Length: 15113
Accept-Ranges: bytes
X-Varnish: 1250507785 1249857010
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.............................................................................................................................................................................................................................................!.1.AQ".aq2..B#...R...b3$...r....CS%........................!1.A.Qa"....q....2B..Rb#...3..r...$............?.u.kg..e..W..e`.@...:.......~C..1.7]....f...8..r....5......dn..AVF......9@.>...^..g....Or....@.s.@$...E......-..(&}.~.......WrY....:...yWI%.....=#.0W....i....H...H.{....Q.zj<~cI...k...V.h....e.........3.m....'kUc9....[.Un?...`|.n](...3.jZ....O.u.6.....8.p.v........A...2..^C.....#.8.>"s...K{.-....fajx...B...Q.NDyj...l.u.W.e8_.......... v..v.. ..A Dm..V..W`T.)"...u....m..Tua.A{...Y..E....B....gMm$od....nD....Z..A...{... ha..1...9.m.l~..........`a...I..4.j...U.p|..\.^....|.g2.......9D.).3.GC.;kg......g.;.7........=4O(.c.N.. .L.Y3 P../ ...}.s..CB.....qy*.H..?.1....X@.f.=h .GMv.p.p.N..]."../..)....[Y$...(.6.|u..k:.t.......vP~..@.:..b.i.>......<..p.q..}Q.....6Z...e.U..N?.6.G9y%.{v.........[...-....ww....b.X,x..@..&j..F.#...(...Et. .LkW.........3.l..x.@w?P.{{.r.$...,...p....5......J;.M..n#.6...1,=.f....We....wq..V.h..........#....k.....s.............V....{i...~(/23.& .*[px.o..W....od...3[.k.?t.....&}.P......Zw..d.{v?.J......v4.....c..t.|g..v.r..7......2.v..#..w.\.k.r..?..s..w....s7._..~.~.O..|...\{s7....J...h.W......Xkr.......||{.dn..0....7v.......&....G3A..5......:...K.. V.u.cR...^w&b.........k...64..P|..#......
<<
<<< skipped >>>
GET /free/frg/products/719950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 18 Mar 2012 15:31:39 GMT
Content-Type: image/jpeg
Content-Length: 18774
Accept-Ranges: bytes
X-Varnish: 1111897254 1110700244
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d.....................................................................................................................................................................................................................................................#."23C.BRbS$..rcs.4..!1Qa...D%A..T5.q.......dE.....tU&......6'..........................."2#3.BRb....r..C$!1A...Sc4Q..%.aq.sD...........d............?...7...Z.m..R..J...J.i...%x!........... G..SnY..]8...o.$av."..E.<...&Z.T!......,..O.'S..Y&....7#g.0 ..!F.?Y....2`......T.`..C....p...$..S".~0.......3.R].K{..g...H.M.:.a.<.G.B1...9$|............Q..:...%......C.. .A..E....x.| .{?>;.. ...1.4.k...c....9s~M.G0......c....\..|8Eu..y?.....V...........o.. .p.x}......]...7....0,.=.o.]M(5....d....Q.....=.`.B.....B.....E....k.>L.s..........6...Lj.y~a.N...B...7.....[9m.9%..mwx....J.c!1.....Y,..L.4m..F._....x[..q.Q........9>8e......u.-..S.........=1.pb.r*.{53S$.....m..$&D.@..Kw...q".{..Q.........o....,L..0.opK .RUJK.s...RY.`.1..f....~.j....,.F.[.....!:....-..DM.....8..K.Q.9Z...3..P...............6g....6.....G....]|...vm?Oq.y...@...z....$..3..MEI*.@.....e!2.........Yw....*.$|.........HN.p.]j..W^........Ue.OG..#.t..W..|....;.w*.....w.r.......w:..X..L/.]....7......<(.{..A%.).......'.......rX....'.t07:.I....\..C.4..Qu%.....m.I....D*.D........4.."......#~....1#L "Xt.Mw....X......=.m...\.;....1P`.\!Z.}|s....e.@.m&.s...J..L.....\....c....p.........@...U...t.......,.n.N..%.eJ.K......$~......M.5a...X.....01..o........[`.2|r...6=4
<<
<<< skipped >>>
GET /free/frg/products/521350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 14:00:26 GMT
Content-Type: image/jpeg
Content-Length: 20224
Accept-Ranges: bytes
X-Varnish: 1465218307 1465089466
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A2564DD428E9E2119B6EAAA9B36B19B3" xmpMM:DocumentID="xmp.did:683F9C80EA3111E28E18D6C6357C70B1" xmpMM:InstanceID="xmp.iid:683F9C7FEA3111E28E18D6C6357C70B1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8EFCE9A1E93311E2931C861C14986523" stRef:documentID="xmp.did:8EFCE9A2E93311E2931C861C14986523"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................................................................................................!1.A.Q"..aq2...B#..R..3$....b.C%r..S4........................!1AQ..aq...."2..B#.....R.br$.3.C.............?.......V.c.JR....."W.#..c.Um.m........q........@H=....|.SgB...3.m......f..q.V?......H......>.R.fr..),..(;.Ep..6...r........P3._........W..55.'..*&..j.^k......N.......Y-A...oO.......D..].........
<<
<<< skipped >>>
POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 1848
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
tAQAAAAAAADBewCAeQAeAAkAeQAMAOoAlAAAAAUAAAAeAAAAKAoAAAIAAAeTZXxGa8NlIFehYGqCMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAA1OTUHODUGQTMzODUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:04 GMT
Server: Apache
Set-Cookie: JSESSIONID=096DFCAA73E3C37F86B4EA5350B4FC0F; Path=/; HttpOnly
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 1
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
0..
POST /opTools/clientTracking.jsp?trackEvent=playerinstallationfinished HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:02 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:02 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html..
GET /free/frg/products/643650/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 21 Jul 2009 12:45:04 GMT
Content-Type: image/jpeg
Content-Length: 17001
Accept-Ranges: bytes
X-Varnish: 1108941170 1108243209
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d..................................................................................................................................................................................................................................................!1..AQ".a..q..2#..BR$.br.........3CDcs4d.......................!1...AQ.raq......."2.$4..BR..b#3..Ccs...............?..-.......k...}....2.M.#x....hdZ..>:I..(..Or.~.I2...I5..U....]5..:I... ..IP.Y=.v<v.uJ...".L2M7..J..$.p.O!..sx0...*.".#[...W}...R.."6..7......T..R.......3c3.c..(z.W.`1L..bs..<5..^.W..$..H.M$.45..I{...4._..$..IxU.t.I.X.:9...h.....8...........m............?...o.....q.....G.....|....i..2K .....lJ.y.i$.......z-...i..........c..j.#'..c;d.......8.MIn.........^.e.n........!.?p[~DnW.r5....<hO.....?..B.HW.W.5....F_.M...2/Vc...pR.m .]....\ C....I.GH96.9p...u*..L.Jy....j-e.....L....K.R.I/6$.i$...zN.).Q......}....P.i9...1..a.y.'..l..............U...G..j.I...I%.Q\t...LM..4...$....cR.X.....i..,)S6.A...\....y...bR.Q.t2...|...Kw.7.H.~..... .).q.(.O........sM..b;-......M._...d.gw...O9..-.........id..%T.NU.N....L..Z......V..bwr.^..WX..J.M..^.h....ST.......'..A.H..&Ca.....m.S..y(..G.k..g....nX...]rZ..*AN..E.*..VU.iP.MX..,M.6...u`r.j..5$..S...)...-F......s...j-Jec.H:z.Id$.^...S.h.....8........'.?.F5...G...s...<S...M.#x..1.t....hj....=.S..=2.y......(..v...US.......>.lt'hH...8....]......KP...4...K.......m......K.j.(..a_.P........6l6..QQe..6.^.Yny<........8.....U...>.p...$.u.h.PahO;?nN.LfKp.mIB.*R...Pw'.NZ.....
<<
<<< skipped >>>
GET /free/frg/products/663350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 08 Feb 2010 12:06:01 GMT
Content-Type: image/jpeg
Content-Length: 16226
Accept-Ranges: bytes
X-Varnish: 1111897215 1111051955
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......D......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..L.,.5*w.XA.b(..k${..R2G..$.&........1.N.....h.z.]6.H.......j..ga..N.<.l.......,\ZFC.84*GZ|.s(.c....O....`....G...j..u]..8`.N..kr..Y.......l...S<Y...S.#.M.N.eI.x..a..6R..)...KV.FBjT....`...N.\\..jA....<....7F.m..$K{.."..u!.V..j2..............(...../..s[.8;....#$..b3k.Gi...7o...5C<d{.|...D......i....J\#..;.*........(.z..*....0.... .q$..3X4.&...jw./.Wq.S..G.....{...T..4.5... cdzV.Z.....X....C..Z.T....#...nG.'8.e....yJI....2.bvn..|>`..#.A@G.o0{E(..7.qe...S2.jLX....9W.=a.h......?@.e.:.;.|4|....^-.6.c...>....EF.w.)..N1.'r.Il-.)......^.vFY..bc.[..6...xP.^....&.@..$.7K.EEI................g..GrsC)d...g"...K........@=.sJ.R.p..E9.DK...q.:.3{.'.....$..C5......1...f.tF.. .69..(.T.l.@>Z....R....4..~|..z.fj0..f ...?.......@#... [.R.4.<..#.0.[R1.........f.5.7.w.[Q.[....%.&.?...'0?{.>.A.h.^l=.-7..u.|.=.1........I9.b...TUA.6...d81....D. ..`MCT)...5......X.".Y..z..ke....~.
<<
<<< skipped >>>
GET /free/frg/products/571950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 02 Apr 2009 12:56:42 GMT
Content-Type: image/jpeg
Content-Length: 17011
Accept-Ranges: bytes
X-Varnish: 1111897252 1110760732
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d.................................................................................................................................................................................................................................................!.1"..AQa.q.2..b.BR.#...cs$.r...4.v....3C..&7.......................!1..AQaq..".....2.B....R...#35.r.b.s.............?...Z$...hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F....hH..F.#B.....hB4!....F.#B.....|.I.P'm...|...........H......).5.E..\....3..).I-............q..y.-.J`q...`.....uQ;8........1....Q.[)!E.#......Ihq...r.....J.....,=.Z4!......A.4.IU.H.hJ...L8r.$...u.....(.}...N...:G84T...xj.H.-b@..).G..%..R.p...Oh)..<N..L.@..0n(N..-...J.....hJ...4....uM.$I.H.ZI\...?.........P.....Q%y{M2.....E.~`H.....U......<.maGt...P:...a...by}TgKW5..h.N|;....H .u#.>.c.......(T._.0;....N ......J..Z.Nb.i6.-.....h.K.$..8....H...CZ..@..&..#Y$..T...z.........S.I.$.I%K.6..-....t..Q......%.. ..;|...&..i.[..o.X7%t......e#...I.......a.......V*4....A..W.9-..>.......e..r...................h.|....5.!.....c7%...1...\.;....Z...R.7.... .. ....5`~..E...$uJ.(W.@x.|.....)-{\h. wAth.>..2.q.2..BV.!AH'......5,BF.73].n4......aw.<F~......m..........(.t0.c8......_.=...^f.?&;.%J..B....qM.....ON....y......#.tiWh..hJ..|.3....{.Vq~9.b...YC.............'...$........N.ka......\....V....of)...4nxyh.8..LE.G..........~Y....L...Eo....z.0^l....e#..'...F........,.(.C...@.]..G....D....yo..7.>.8........L.v[.u
<<
<<< skipped >>>
GET /free/frg/products/748750/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT
Content-Type: image/jpeg
Content-Length: 30665
Accept-Ranges: bytes
X-Varnish: 1110567298 1110386393
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......^......Adobe.d........................................................................................................................................................................................................................................................"#.2B3..RbC$.!rS.1.cs.4%.AQaq....D&..T5.......d'......t...e......................."....2B#..Rbr3......C.!1Aa..Ss$4..Qqc..%....D......T.5......t..............?..!.MEx..x?.^0.....k....&!#tM-.....qS..u...I.h.$..~........n..hq.....8...~..}h.L.=.[gdf..1...E.n....].D....~W.'...t.dn.E..Z<."(..rN7|..!S..9..~`.6.[}W~..^.....u.}c..W...*.."........."?\.u*j.....~..G...7..;"..s..C7_).t.<..~1..W......1f......S.<A..b....J.F......W'>E.xYC.....)t.......F.....u................f..g.A.0k.f....'..._70.l.......y.p.~B....,1.(.eR........-h....9.......pE..O$f.e.Rn.....^.F../....}.......IC#....n5..q...IwhJ<..|D/..k....|.X......8..'..0.9..k....6../#.$e..P....!...VMAk........d{>t..7`g........../~8.....b....../~8.....kt,K.......}./....'...{..G.'...k*.......2?..Q......e....ip...[..w..T{...G>K'...yq.>G..1../...g.....yr..'.......EzK.L..v....K.\.Cj4.T.i1p.`..7.....t~z...aHTTP/1.1 200 OK..Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT..Content-Type: image/jpeg..Content-Length: 30665..Accept-Ranges: bytes..X-Varnish: 1110567298 1110386393..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:05:25 GMT..Date: Fri, 01 Aug 2014 15:05:25 GMT..Connection: keep-alive........JFIF.....d.d......Ducky.......^......Adobe.d....
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:18 GMT
Connection: keep-alive
GET /static/marketing/main/img/green_btn_28_mid.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1289
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=67666
Expires: Sat, 02 Aug 2014 09:53:08 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:79D12945B258E1119DF2A5DBDC21884E" xmpMM:DocumentID="xmp.did:CCF2A9DF58C311E18081921A07E6FF11" xmpMM:InstanceID="xmp.iid:CCF2A9DE58C311E18081921A07E6FF11" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BD12945B258E1119DF2A5DBDC21884E" stRef:documentID="xmp.did:79D12945B258E1119DF2A5DBDC21884E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................u...................................................................R..T.....Vf'...................Q.....!.."b.c.T.&............?...4....nL(.zMz..X.i1}.;..#n...#.J%ATM...*..R....]...%............
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/green_corners.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 2157
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:408B6E0A556411E18557BC153AD0475B" xmpMM:InstanceID="xmp.iid:408B6E09556411E18557BC153AD0475B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5E231C124755E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................I......................................................................................!1A.q.Q...".a..2B$.#3...T..V.......................!1..A.aq..."2.Q.....Rr..S............?..Q2w&V.9q..a..2$.A.8%QC.*..f ..I>.\iB.NMl.s.C.....2 . ......q........4n?.]...og.`.7.._.;.;.......1.Ts.^....fS~T<....s..@...";.....%A.np..Pga..).0...#.......$2!.q..u..e....I......"E"..`Lu.............2.....?..m...2Jn
<<
<<< skipped >>>
GET /static/marketing/main/img/preload.gif HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 6712
Content-Type: image/gif;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
GIF89a0.#....................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.....G.,....0.#.....4...................................<............>.......<. ........< ...... .....3........<..*........!....*<.<.....<...<............._.1.0hA^.G T..."..H.(J\w..F..:B.h..B..T.\.....!B.lI#DI.1....S.O.3f..!t^L.!~.X1....D..[.T)..O.J=W..R...v...k/.P........p......!.....G.,...... .....G....!<...<.3..!...G.G...........: .G........;..........G..!G.....*...... G.........<........<..............*....*...G*........!..s........8.p......0..b...z........B.[.2......L..e...h.|.r...3rV..B..G3n.......G~>..shQ.=.n...(..Q....s..@.!.....G.,...... .....G....<..<.......G....................*........;......G...:*..G....3. !.....<.......<.G......... .G.<.........4.. G*....!*.*.....T..G..>....C.".B........#.3...qD..#.C~..r....R..yD....U..........\1.g...g..Q.hQ.4...@..Q.H..<...O.R..x.5 A.......!.....G.,...... .....4...4.!.<...!....!<........... .........!.4*.......<..<........ ....*.3. !...>;......... <..>..3...3...........3*. *.....*.*.......j..{....d...s.!.p.-"...;Y.41...44x...$.."E.3yH.K.&i.p.aELA.Q.X..B..@o..:c.L....@v.B
<<
<<< skipped >>>
GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=2429262-4858523
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 1926374369 1926325909
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 2429262-4858523/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 1926374369 1926325909..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 2429262-4858523/12146312..Content-Length: 2429262..Connection: keep-alive..Cache-Control: Private,max-age=0..q..O..E"^...E.B..D.r=^"....R./.....1-^-../...D|....y}.........].-..Qa.._.'.......[X..<...f..P....z6.y..U-].)....AJ.U..../..fc3.V.....o.'......^..yVb.]..Lh.3dZDT.v...KT.....|..CB...*...T.j...pSq........G..q....y....$...._......4.....`.FT..N.w.4.D...O...|......%. ....._>... V.6.5...-e3.. )......}l.....i..u.P1.....o..>"..ou........[#...6[#. ..y..|.Y<c.y....(>.Y.%p......YL...d.S......`E.............?...`@....^3.`... X..............A>....vN.^.4..V.*...O.P....6n:........lf.........yN..{.x..%..-l.Wfc....... _.......z.5z..t...:..4l6^.C{Y.$O. ..4......../....`p.N.....5..&..X...m.4.v..b]9.s..%...C......j.!?..Sz...>;*....p.v.k.=.:.=.......H.Y..V.l..E./.Q....$...q5....a...~..Vaz.[(.1.2..[.6p..p.u3e....K..5.g%........3Kd.|......?b.n`-.A....V.H.b<.D...9.N...e........hViVn.s.J$...E...`.f._..>z..?./M..........G|a...L|..a.......%....l......C~>.1w.D.JP.0.IE...a.....\....r.......s......sG..]..O.ll _@.]`.].cx..."..>..a...?..Sq....q.G....@ue..H)....!....N.:g.uXh..........-.Ue0...\...\.c.b.&D5.......T..B......32.yO.g.....'..s....u.s.....o...../G.....O.....'.....9....&....qQ.}t....$Xsh`.5g@.]..A.&8B....Jr..;.%=.
<<
<<< skipped >>>
GET /en_US/all.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive
HTTP/1.1 200 OK
ETag: "a89d9f64c8545f8b1b7c72572d2188f4"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Content-Encoding: gzip
Content-MD5: g7tSjC4YILZvPtnpqLpd/Q==
X-FB-Debug: 0gk9ovic4HQA6uchwM49yJT0YNnZJr2BCxoJBI2vISFstDN wKGadQJ2IGehLL EIzxZhdr8n8MGiH3Sko9nUQ==
Content-Length: 54012
Cache-Control: public, max-age=1200
Expires: Fri, 01 Aug 2014 15:25:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Connection: keep-alive
Vary: Accept-Encoding
............k{.H.7...O..3.jd..:B.|.q.v..[U==3..%@.q.F`....../"3...vu.....9.E.3222"2"....G.'.k....y..~.^z.O..l..G..^.<<~|D%.p..........?.......t9.z.y.}...q<,}.t...._.N8I.ni1.......^M...Q9^...,..JG..j...i.......p.j<....tr...7.>}{./...c>[.VW..._U........b...K.[Z..e0 %.....$. u..b.N.&..S....{4...U"M...a2.g..(S@'z.Q..6..S..f .....j.}..V.......W.......-..V..j..Z-.....p..j....I)h.....*W..P....E4..V..H.J....W.^..t......`.x...~.]N.q.I.~.n..k.w.#.....l.8g.U .S...............,.........l...5..N.........h...g.Ui.^...f...|.a..JXqJ.Bi..K.0....y4......|{~....~........y....eu.Nz..7..~..qN.....5F/...RqW.U4.......]u...T....^.=..aC.5@.QU?2...)?..k.S..,...rw)^%*.P.|.H....z.N0..Q..y5n...".....B'.NG.r....V...Z.4.8...........4..i.|G.;..k..TO.....w..x......j.......}.?v7......._FH..u..~...D....o._.f...k.c,.^..K7...:^.c..t......i:....S...SI1.;e.v....V..F...R<.2...6 T...6*..K..J.....5.g~_&.yH..BT.......R;......S....!Q.G#"P.........=$..mNj%.............!..VMq.c./.........=.;s..Z...~n..y.S.#....c.<.M....!f....^.:{C.u..-...f........c..,..|.....Z.F......E..*..G..^....!.....k.......#...!u.j:...a_[......n.6.....z..^.;....x..T).........z.@........S=.j..G...z..$.!.{U.4,..;R..."M.....2..F.t.,?..oN;&...T....^G...u.'..}X.....h.3P*....f.|.h.T.......p...8])Y(...GX..H?.p...H.Y.g..jf@.a..,$.i..R...4.....:.y...l.y@..-...V.....:w~........D..j;.<<.....Y....3..[4..|....]F...1....hR....<.j......"M..j.}.(.....*O..c..m?..z.D..q....A........q..F....&.x.hH.yyBT..(....I....7!.M.v...A4I6H...J7..@e...#ht'~..L.{.Za`.2.s.....`_.._4..=
<<
<<< skipped >>>
GET /en_US/all.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: connect.facebook.net
Connection: Keep-Alive
HTTP/1.1 200 OK
ETag: "a89d9f64c8545f8b1b7c72572d2188f4"
Content-Type: application/x-javascript; charset=utf-8
Timing-Allow-Origin: *
Content-Encoding: gzip
Content-MD5: g7tSjC4YILZvPtnpqLpd/Q==
X-FB-Debug: 0gk9ovic4HQA6uchwM49yJT0YNnZJr2BCxoJBI2vISFstDN wKGadQJ2IGehLL EIzxZhdr8n8MGiH3Sko9nUQ==
Content-Length: 54012
Cache-Control: public, max-age=1200
Expires: Fri, 01 Aug 2014 15:25:19 GMT
Date: Fri, 01 Aug 2014 15:05:19 GMT
Connection: keep-alive
Vary: Accept-Encoding
............k{.H.7...O..3.jd..:B.|.q.v..[U==3..%@.q.F`....../"3...vu.....9.E.3222"2"....G.'.k....y..~.^z.O..l..G..^.<<~|D%.p..........?.......t9.z.y.}...q<,}.t...._.N8I.ni1.......^M...Q9^...,..JG..j...i.......p.j<....tr...7.>}{./...c>[.VW..._U........b...K.[Z..e0 %.....$. u..b.N.&..S....{4...U"M...a2.g..(S@'z.Q..6..S..f .....j.}..V.......W.......-..V..j..Z-.....p..j....I)h.....*W..P....E4..V..H.J....W.^..t......`.x...~.]N.q.I.~.n..k.w.#.....l.8g.U .S...............,.........l...5..N.........h...g.Ui.^...f...|.a..JXqJ.Bi..K.0....y4......|{~....~........y....eu.Nz..7..~..qN.....5F/...RqW.U4.......]u...T....^.=..aC.5@.QU?2...)?..k.S..,...rw)^%*.P.|.H....z.N0..Q..y5n...".....B'.NG.r....V...Z.4.8...........4..i.|G.;..k..TO.....w..x......j.......}.?v7......._FH..u..~...D....o._.f...k.c,.^..K7...:^.c..t......i:....S...SI1.;e.v....V..F...R<.2...6 T...6*..K..J.....5.g~_&.yH..BT.......R;......S....!Q.G#"P.........=$..mNj%.............!..VMq.c./.........=.;s..Z...~n..y.S.#....c.<.M....!f....^.:{C.u..-...f........c..,..|.....Z.F......E..*..G..^....!.....k.......#...!u.j:...a_[......n.6.....z..^.;....x..T).........z.@........S=.j..G...z..$.!.{U.4,..;R..."M.....2..F.t.,?..oN;&...T....^G...u.'..}X.....h.3P*....f.|.h.T.......p...8])Y(...GX..H?.p...H.Y.g..jf@.a..,$.i..R...4.....:.y...l.y@..-...V.....:w~........D..j;.<<.....Y....3..[4..|....]F...1....hR....<.j......"M..j.}.(.....*O..c..m?..z.D..q....A........q..F....&.x.hH.yyBT..(....I....7!.M.v...A4I6H...J7..@e...#ht'~..L.{.Za`.2.s.....`_.._4..=
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:39 GMT
Connection: keep-alive
GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=9717048-12146311
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 494852603 494804948
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 9717048-12146311/12146312
Content-Length: 2429264
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 494852603 494804948..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 9717048-12146311/12146312..Content-Length: 2429264..Connection: keep-alive..Cache-Control: Private,max-age=0..Y......).la.a~{..vP..)4.f....<TZ..3m.... .#....{..:!.f,I....8.L.(..l....wf.s2..6.... yt........W.....2...g.........?...n%....<..(@...w0:.,.h.d.....W8G..1..,...c.X.U....a.U.@......q4.xx]t...v......d..'.....' .\O#f8...r...>..`...xV|..?...7..N.95g16.0Bs>..9...B.Y..3i.4.S.b.!.......P*I.C..Q..z_._.....n.?q.<...SVE...#....... ........^......e...........;x..|..,,w..n.6..w.N<..S?>.l......G.w..,....W....U.{..S.A..$#..$...t.. 7&..........Zy-..^~l..f.d/..F.P..#.}.*.?3.(..F..lC.c..........=..M@.z,..h....*!.&.........g*a.XnPQi.J..7..rG,.(.'.EE._*..c0.`...._r'^.?.....-.....C.P.hy`~....Y=;8....Y.[/....:...|...j]<...5........>wA...l.>7<.O5.}......j.......k8e.R!.... .]<OD...\..yI.......#..`.S.E.........;..#H.bs=/<.....R....R.Ygn5Bf.1#.JE.....-92....Y.....u.6.......e.d&a..,.9.y.......^....NY9C.W5.....Y....XC.....E..|W....3..5.......{.....Hn~....Ny/...Jos....Bv.q.....s.L0 .KL.W....8.=.<.....r........h.=!^..#3k.U.B!>........P..L.............w......@n.@}.y..|.8.. ..o..um..it.5.9%.).J.d.-....p'q.........~.....c.z..Z....N\...n.....C.7rg:...~....r.u~..f...$....U..".F.w..H....J....{.f..$.. ..U&p4i"..(..
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard/header.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dts1.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 21 Feb 2013 10:04:09 GMT
Content-Type: text/html
Accept-Ranges: bytes
X-Varnish: 1140614167 1139395939
Content-Encoding: gzip
Content-Length: 1002
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:02 GMT
Date: Fri, 01 Aug 2014 15:04:02 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........Umo.6......W.Km,.....m5pl7)....n.."....F....#...=./s......IQ....{....../......j.7..g...Z....s>YN./^...,.(LjSU....5{........Q.n......og.....4f!3.....-.[..2...Kc..5&![[[.9.q....6.*..F.i....wh.b... ..5V......7....t...O...qE*.......!..}.#.....1.....PxC. c.....&..Z...GZj.W.r..j._..1tfE.vO.....)......u.V..q|...n..o.3Pf.@Yi.m.^...m.................c.."....P.a...t..........WR$HH}.CV..P."2*.,.t.Z.~.....V...[...g....,........h6....d..........l.....0.4..\8..M.$..3.)).P..`..v...^.kthC.........)9-C.y....4RP#...4G....;.`.&.Df.S#......|.D.....p.XB.*0..$Z..,.'.5.5&....8. I.d ...LYo.F...)...)......=...S.U!U.......G.x9VeM...V.4"01D5...Z..iJN.....CP...). d..9.&... ....A...N.'?.....|..y.i...H..........T....t.Ic7(..:.'.85e&.~....H.....^h.%..;..._...O.gs......_@v............n...[..7......M.....b.{.d....n.....S.m...)`vlF...1..R..Ic.Y.l.......I.....6..U....S..p...........&.gph,.1...V.X........5...r.... .......,(I...V1.iaHt.....q.m...l.....0,.QM|{....x"~y&;t..n.......A.D~.;........~.....7....w..)0l...HTTP/1.1 200 OK..Last-Modified: Thu, 21 Feb 2013 10:04:09 GMT..Content-Type: text/html..Accept-Ranges: bytes..X-Varnish: 1140614167 1139395939..Content-Encoding: gzip..Content-Length: 1002..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:02 GMT..Date: Fri, 01 Aug 2014 15:04:02 GMT..Connection: keep-alive..Vary: Accept-Encoding.............Umo.6......W.Km,.....m5pl7)....n.."....F....#...=./s......IQ....{....../......j.7..g...Z....s>YN./^...,.(LjSU....5{........Q.n......og.....4f!3.....-.[..2...Kc..5&
<<
<<< skipped >>>
GET /beacon.js HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.scorecardresearch.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Expires: Fri, 15 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Content-Length: 1140
Connection: keep-alive
Cache-Control: private, no-transform, max-age=1209600
..........mU...6.}......CF.l/.4..k4.<.h. i.\..(.bK.....".{.e..M..".3...sF..(_[3;...J..._..)A.m?).. <..U.V....ce.......R........J.......$........{q.|...x#...;.[,.7....r'.p....p.6......7....K.A.Jv:....eJ..V...vb...q.5..$!.........M.(b...=.q...sZ.6:...t<.Rj".0.X"#.Dd...f.5.n....E0.*.E..tRy.>i`..\.......`!.Ed.^.....}..".~.l.?.9..6....s.1...z?....e.K >..0....W,nd...k.....N.g.G?^:..(.cS0c<..V...P#Bjo....M.....0..o...,....A.p.....\...Z'2T5.........^SrE8.....y....@.s...Y.............l`y..1.,.h.N......d.......< z<....c.g..G.f..M....._..M.3=.|... .r.{-.. ..@.d..]G.<"..R/j........U.F.\..Q.c.A..u)....6_.=?......~q1I0.l....K^...$......f..R..j..A %J4Ip.....L;..m..i...~(......_..A..z..Be .b'.....r..8".i.t&.......a.~..8..C....P&d.....*.M......'.@.H..b...Yp..v/l,.3G9.......2I..[....]`.X8.q..>%n..t..nW....!.. ...M......,.%.....>#k.g.A.jf..sC`S ..v.{[....$~F...|..zr!..hK}U.....N..S&d"...v?$..|.V.4QWy.....T)K2.T.'........Ee.j<Ml:f@...{....i..7...d..Y.7 .;.y..zmz\9.a.....Y..E.,.I....-e/V.%......Z.........../Y....)..O.6.....h...G.8../.9.VzU.....C....P...s....Q..e.;.....>*.k._kd...9.qJ..8.L........o......J-.P&.RY#.l}. ............g...g...".Al.......
GET /b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.scorecardresearch.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: hXXp://b.scorecardresearch.com/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
Date: Fri, 01 Aug 2014 15:04:04 GMT
Connection: keep-alive
Set-Cookie: UID=31aee1e-23.15.4.18-1406905444; expires=Thu, 21-Jul-2016 15:04:04 GMT; path=/; domain=.scorecardresearch.com
Set-Cookie: UIDR=1406905444; expires=Thu, 21-Jul-2016 15:04:04 GMT; path=/; domain=.scorecardresearch.com
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
....
GET /b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: b.scorecardresearch.com
Connection: Keep-Alive
Cookie: UID=31aee1e-23.15.4.18-1406905444; UIDR=1406905444
HTTP/1.1 204 No Content
Content-Length: 0
Date: Fri, 01 Aug 2014 15:04:04 GMT
Connection: keep-alive
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
HTTP/1.1 204 No Content..Content-Length: 0..Date: Fri, 01 Aug 2014 15:04:04 GMT..Connection: keep-alive..Pragma: no-cache..Expires: Mon, 01 Jan 1990 00:00:00 GMT..Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate..
POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:50 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html
....
POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:04:50 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:50 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Content-Type: text/html..
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:05:01 GMT
Connection: keep-alive
GET /system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Content-Encoding: gzip
Content-Length: 219
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............n.@.D.A...P.Qw.....%.k...Efi.V.{w..4.....y.......p....,v=q.G8...%..v..k.>..,..~.T......9..Le..~yJ....>`.Om.6.....X<.......teY... I...L..I....f....jkO...A.{<DE....48rD._..Q..>..8.>.....p....A`.G.......5.|.......
GET /static/marketing/main/css/templates.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 1650
Connection: keep-alive
...........Ymo.6.....[..I.G.{....4i.uN.z..e.d.....!.M...}|.H...8.l@.D..x.{.............}r.:zqlY..G.,.p..j~.K..l.....*g..k.m.at ..-k.fM...CGX.B..T.../. .h..eJ...f......hZ.u.m..b.,.d.D#...Yy..Ds..f-.2<....E....n...h...>... j-P0_.....G.H...o.:..ny.......Y.x8..Q.G.uVl)](.o.o.p~=.\.'...y}.K/....(.t......B....Hk.[....A.....`o.J../....G..&..8.(......I..Nc..%. .....b......e.1...?.t..PY.|1.^.4.......7.c.N[ .G.UG....f.... ..]..3._g.]...kz5l...|U....\^_O.'...6....pC7..x..W....%4s.._..3vj... ....w3.Qz]P1....f@.9~...'.<;.<...1...=...H.........W.=V...?.k.~y.F.`.{K...#w...:O..iZ....!.r.8^U.P..T8.?...;.=<....2.E.....T.g....3.l....1...B.Qz?Z...".....1......sQ.3E..X!.,S...eH.L.."..g..m..E........Q..~{..xuJL(..,%.A.H..Hi........Q.`-.K.n.l...s..O.<.........?..o.x.X.?..U.`/.J%x...z...$^G.h..w..;..W..-fj!.Sr..L...k.....-.....C....Bj...a.....'.j..GG.w.J...C.....8*~7.J|.a.Y...JJ\mV..G..Cd..Q.Y..".n.....7.#..6Bk6;.g....ITE...U......4..5F...5.v>.;"..r5.2.%..aQ...........T.....6.g.n.#.?..g..r..J...H0.Lp$.....e....~8..s....F.%..u...I.v.l...i.......B25.e....D#.....L:.M..l.lZ.Y.8...w..L.".?.sF...yGiKu.J!.UYr8.,1.K.f..R.R..Q.......J......0..6....._..H..;W.{.^_.qXV...j~j..../......}`.%.......D-.(#.b._....v..,..;..B.b.5.....R...}u........gk....R..Ca^9.2.2Q..XP/.y.....m...}. .W.^.*....],...._p.....Kf..A.:.)P.e..:AR.E(.;.j....y..R.7;a.G-..Vh ..........*..-.X.1%.......G....3A...5..W...3....r>!4..|Q>.(.-.,.S0.....g.D.e..k.k.k ....!.u}50...R..h..\u.../...J#.~..L......$.......I.0.......D..).....S.q..dDt.>.......kw..._..
<<
<<< skipped >>>
GET /static/marketing/main/css/gamebox.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 940
Connection: keep-alive
...............0........LW7".7z7..g...$jF$..m....'..$r.......%...O...!.SG..p....S.O>2r72.."...|..w..m.&Szz.9[.7[......j.a..%!8......~3>...h.2..4...soNO..d...j......l..L(.6.c...?.%.,..3.tfWY .....tu`L....%.......0.3..i..(.br..-....K...1..*.....T...U._b .o.P..<...3.. .Gq)N...@e%....).<L.ZT.........#&..$.=N>/..7..$o......!. ..ak..0&i".BOc_.*pD,.....T.....?].<*.[.aD..b.^O&.b...(..(.....vY.-g.........R~..(..B.~.>\=.....".x.?).T.$ ..ED.(.Z.......]...g..{..\N.s...0N.j.R.h.9.l.....'J..yU....u...P.c...K.........:.Q..w.[L.b.=.L..*6zg.R..Wf.....&4..Ui....EH^l]...%..........9.S.e..w....R.j.m.e.v.?...u.D..@].7...do.t.3Y.\.9.!.).Q.......V. ......i..!.9.(.&..N....&...k...Qj.....$...-:T.....{..P../X..............y....o..!o..".....=.kR7.]......][..~.\.6..>.........m....u#y....3...D7...z3...*..=....BG.9.;.=k......~../....%...1....Nh...hM...*...z..x.........Up.....S..f....... .......Y\qY.G.b....a.R.Fr.Qo...S.r.C.^...86fr'.[e.aq...$.H:..?Y@..........
GET /static/marketing/main/css/hover_elements_sheet.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 409
Connection: keep-alive
.............n. .@..W..J.....X.Ll....:....'N..H......f......!..... (:..Q..kKy..<.eG.Tv.c`..5.V.../....Q.w._..]_}@....z.../X.Q]V .I......'.UW..8T...Se...Z..(.Y.EI&.^........!.\.. .t.,Z,..%..j...R\5....._..........7h..f..|...L.I.3I....R..74n.Mai.x:Qp..,..AI..=:...2.gA.-. ...I.B.yb./.T.....?q......\r.|.Z8..nQ.N....Q..w.;........^..d.9..h....'>.,^..b.,x.|zfN...BS.B.gI..C...e.&......".........0..<Fl"....<..........
GET /static/marketing/main/css/download_assist.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 217
Connection: keep-alive
..........}.A..@.....X...etj.@..D..:........[..OW....f...3;q...j..6.0X. .V.......B.*.........2] .V..F...%.:...........y ...%l..^mU,...b3..G.........`...M..>...&...8.DqV;5.....{8k..G.H..d.u...%.YBg..=...:..@.~.Bdq.........
GET /system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Content-Length: 284
Connection: keep-alive
.............J.0...W.;.^9(i]....d.!X.........%%.Ze.....^.D.@ .../.azzr...tI..........gC.|........t\.....)fdH.U9...]...V ..*.q......l..1./h..m.0..m/.ik7C. ..,..~....a.d.kP..g....)#..1.l.M.O..Q..I.......|..9go.h....el....6....\....$Y....,b.#<...bv.=.s...Q...g.#...........{G)....=.?........
GET /system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Content-Length: 46010
Connection: keep-alive
.............W.9.0.{....}w...!.d2.;...'.._.Mf.........Yw......V.>ZR..&..g.g....R.T*.JRIz.......*...].[[.............$..N .w............}..K.pp..G..(L.....Rk4Z:F.d.8L..]8\.....`..s....k....(...u5._.....q.....h|....:JX.n{....N.!..;.i..}'...q;..E......4...8.......,../...#.>.387....,.'......D%.. \r~.bz..g).M.`..4...`....m..Q..K....(.D....O1.9.1..>.._..QX.#)..L/.t..W.u/...I......e.Ys\7..U..^......,:C...@..f)u.>'..f.....'.Q.^s.../_PJ...0I...C...m..4Ip..-.....5.....J...q.*......._J...1..4....(N.K.8^......0..&......*.......@~5g........3...$^.oZ..ra#..B.....g..n....0&.J.7nS...}D...&iB...@1)I.I.`:.m.....FL......(.\.......Aw0.nSW..8....\n...N.....Q._.. ..gq.ut.V\..b.:.o.......b...x.T....X..2..|....(...b...L..su~.X.............t4R*c...... .<.............$V..S.h;.......,...x..'.H....nx..:...&..#.c.k......F.01.0.....&.Yz.s,k..v.}.................kCA..:}I}..7.P .9...Q..>b.5l....8...>.,.Bz.. P........s.a...=%.N.U..'.. .....y...... y.j.F.z.)..j..I.......B....v..l@..*......eS.XJ...ZY.Dl......S..!...*:...X..rf.|.Di.T..uy........}>.8j.`0...0..K.Q<...Fd9......q2...%..!..yE-...1=E..E..Xc.q.....w.=9n..[.v....hM=8.n.u.........^..s.9.1.T..y{f..>...-..Q....6...U"..%...p.:.W(@[%...az=...hc.4.10...pIdZ..\887.^....&.8...i8.0....}..(6.8I.x..%... .O.?=U..?....K#.*.|.......0S5..?*:..8.2M._..b..J@v..D)N...(.$.?.7......W.H.p<....r@1,........}`.0.).....C..A.2.....ls..J2zCN@9G.@.K3..b.^..."5Hi-11a}..H..6..d...\...0..U......./_...&.....16......k.I...&.|..K....x4....Z." B..H.)..L..h.g.g........c2Q.]..:Si.%.&.SyJsA&
<<
<<< skipped >>>
GET /static/marketing/header/css/header.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Content-Length: 1821
Connection: keep-alive
...........Yko.6.......i....Bn..m.'M..@.8............._IrN.Tj........N...N/5.*X_.....i....^...D....UX}e_...=.%Uz.>.x .?....I[../.6. .b.H . .H..b`..,.......*.a.ZJTVw.....c...k..EoP......V...:j.(.....Z\8b....#Uy..)F.....P.R`....&%%....r>.bP.i.1.hp..A.>........R./....*s...G.#o.f<....sX.k....gf..Zn.7.V..M...5w.s..(.......SL.!.....6o..3.p.}4..f..... ].0#5..)Y....7...s.MF0.Y...|....a.b.S...........T.<gQ`..9...'.}G)...Q...y..0*.! .....`.=..O.!..<....9...D....d....s.~.,.sP..q.k_.ok}C1_)...$....]..H..x...=..v.7J./#.M.....<==.s..2R6OUY............bTV-M....N.xB..y..|.RV.gX...`.f..tcf.........&.jk......fSW.q...\l.;&....u.(........t.}.d....D.....$....<.....MV...)I7..l..E.A@Z......DO.Z.CAz...IBZ]-..X....%?a...L.I........C...d.......D.2.....@..){T....8....t......ieUT.H..|nJ.#Pa......i...\......0.q.....n.......gP.s..u.D.Y........dg....s..h7t.{.0..lbF..1:...Cz.me.EgV...t>x .\.E.1.|<....F....0.(................t<...[. Gm.u...L>....xxE.u.....Uvz......X...n....w.....W..[k97Y.]......e. ........j..9..s......c.....;. '.s.de...... t....9).....".Y..9.....(...&...._.* O7.6..C...*.N...k.Y...^..^.............6;A.........m.(..1..:!...u...@(%g...nh.....dO.....h.)k..8..`<.Q....9.\..b.wEws..*{...j...j.V.!.D.u..$V...Y....iQCXNK.l.3......F..2.....y..?T.{...x..w.!...7^*.... *...Hd..NH.....A......P)F...^%...............3(c8..=|..bO4.0.........M.....k.9RW ...z!....T5yH....Y?.Z.....s.&G......6y......Y4B....(<s...c......F.>.@...%.a$......R....6y......a.......H.G.((...K....V........ .G......c...q.fB...3X'\
<<
<<< skipped >>>
GET /static/marketing/main/img/background_pixel.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1591
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:18 GMT
Date: Fri, 01 Aug 2014 15:05:18 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.did:27704965522811E1800CB3176D22E618" xmpMM:InstanceID="xmp.iid:27704964522811E1800CB3176D22E618" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:165525FDC050E111B59EE6C32F2CA589" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................b...............W................................................................aQ...............................?..................$v*.#P DE.;..........7..$P....F.U9...)4..7<QA....TRh.@S...TV..R.0..............Rb.......H.X.R..* ....Vj...).....".J....* <.y.NqEf..* ..@Vj..*......Q^}.&..>(.... ..B..E9.yTS.Rx".E .r....
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Content-Encoding: gzip
Content-Length: 1052
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........X...:.}.J....J=RC..\.SO......p.U..13.F... !..!.y......^......\....aD.lS.....6..K.T/n..8..8~...Ls.O..>|Sw{B..LW...yC%.,....>..XaQP..G.n%WK.>~..&.AI..i.}..mx.J......K.8#SI~.&..J%y....%..ti...(..!..y......`if..b.K..G...nm....\.A.. e.t.AS.....8....&)..4.A*L...HZ..h/O&.K.....R.*u.X.)...........e.P.@o!..St...G.r.F.....G.z0...i........M.M<hgi.L.]x.......K.jBiQ..QWG..P.....k........0t...3.....;n>D...S)....~.`|.....&..N..S.\.%j..N....P3..U..e...d..T]Q..Xt........._..U....7.).........(.{.........&... O........ ......V.\.73..j........;.v...Nrf.l.7...........q..a..M....(.....2..Y."4.$.u.......j.jN].6....?..=.n.....x...0d..k.-.~...,.u\q..%@.{z...D.{....^.g|........F..{S...on....0....?..A....W..|.Q-7. ......v....G[....).C..*<.....}..&..0._}.8....eJ..E.W%UP.........e~...c.=B.....@4..B;..J.A.3.......'..zE..'..........R..U.*..<..........v.............=s{..n.7....j..j@..a.]..]......n.P._C...Pr.md..ti.b....Q%..?..a6j..L..D..............U'.........i..4.T...mI.y.....O..7.U^....sA...L=.8...9...!.jV|..0>..&X:S{.;'....wv.;|e ...J*Kr...O^......I.l.......
GET /static/marketing/header/img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 26369
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
.PNG........IHDR................Z....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B3983B1C9B50E111B59EE6C32F2CA589" xmpMM:DocumentID="xmp.did:D41735F6522711E1BBABC9A21DA171C9" xmpMM:InstanceID="xmp.iid:D41735F5522711E1BBABC9A21DA171C9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5079397E5F51E11183EA8AA91EE6894C" stRef:documentID="xmp.did:B3983B1C9B50E111B59EE6C32F2CA589"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......c3IDATx..}.x....;.]....^.{.........C0=$..HB .BH.PL...B5.....m..\$.jV.]..2..3 i..-2$_..}4..v....s.S....w:~|../...<......&.G............._...r#8........."p....t.~.....#m....H[W@.......a..H...@...4.s<.G...J.7..G.ZW..F.b.G...XO..#.,...p.NO.....?...../.*9`.. .A....._....=?M..i./A.{....?......?._..H:..D..|....w.h..... U..h..G..?Z.Ft.HMX.R.W.....A......8......{.......<$...|...Ep...g9.;^..................49....To....j.....t%..H.q..@V........<h......v..'..d@..b.w...8. .!.............^..]O..s..'.......M.%.Pp.F..........
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/yellow_left_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1227
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A40556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8DAB8A3F556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................]............................................................3s.....................Aq.2r..4............?...9..'Rk...7UD....I........
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/yellow_right_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1244
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D90AF3B556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8D90AF3A556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................d............................................................2r....6....................1q..2.B.3..............?...`S..4d.!s....m.|>\.N..h..L.........
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/yellow_pagenation_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1260
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A38556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8DAB8A37556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................j................................................................R......V.....................Q.....S................?......L.*.{!r......O..M..-...hoF...u/..&V.......
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/green_pagenation_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1256
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8568556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F87F8567556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................h..............................................................a...R.....f........................R................?.........x..TB..w2".&}...>.O....3$.P4.........
<<
<<< skipped >>>
GET /static/marketing/main/img/sprite_sheet.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 272240
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
.PNG........IHDR.....................sBIT....|.d.....pHYs............... .IDATx...w..E...3.......{..J...E.P.... "...P.G,D...E...G.GQ.B........o.-...ef~..so.... .;..k^.g.........g...B..TPA..TPA..TPA..T...Q..........sy..........`.<PBl.^.,..m....= .!.. WA..TPA..TPA..M....n.....2...H....".T.G.u...G..5.m.F.....vk.......!.R...().R........"^.r.TPA..TPA..T..D,..3...t...z`v........_...x.".T...Hk-.Z"m.BC.C.0"..Qd.Z........ .@)..$......qp]...."@E.....*....*.............K.H.i.........#...u<....C'......?=.HUn.{..X...7.....Z...A...C. .a..@..'.T..=.. %8J.9......!.s.<.......*.@..TPA..TPA........y..@......QS..F../....BX...........TPA..TPA..TPA..TPA?.....@l.. .2.....j@...K..?7bo......C'..m.....20...XV.B..b.!p.!..<..<.......... ......\."..4.!0*..A...!.&....c...........[_o).;...~..5.......V....lo/..6...B,.g...(.h...k.....a.!......Rj.y.B..:7q.A..}.....'...:.Z.1..b..l...5.X...A.Bl.Rn@......z_.........?... !.. .j..2.j..,Y..L&..5k.....7.].~......H)....UUU.UUU.........#.<r...3.....}.c..1.\.A*....(..p..w....u..~.....>.8..|.c.a...y..w..n..km*.G?i....O...:.] ...[.....).aJr.'......... .J...k]G.S...x........m..........{.a'._.......R.%K.,...[n...l]..>)...R...K.s.r..a.*..X.G...?.deTl....U.....\.n.WX.9..\1u.......&Z..$"U-".VV.<..i.q.P....D...#...2..|^.(..?'U.uS.././j.;...}..%.....%>....W...(.|`...........J^.N.....@.t...Wn........a...f....F.cJ......@'..o..9$..t..`.......f.b..W...kL..8.......R...Z.`H.x...l.&D).cA......h .....%....".#].^....tK.*.....D....F.#.q.....Way....O....hw.L.......... -..HDi.k.X|.H....Q.A......
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/labels_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1313
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:A53B9BFC558811E1BDBC91B6FE137091" xmpMM:DocumentID="xmp.did:A53B9BFD558811E1BDBC91B6FE137091"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A53B9BFA558811E1BDBC91B6FE137091" stRef:documentID="xmp.did:A53B9BFB558811E1BDBC91B6FE137091"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................c....................................................................................Qa.b....V.."....U.......................Q..........S..TU.............?.....;...dz..r$Y..&.C.s5.H...v.=W<G..-...:X=..rV...Z.QWv.O ..'.<.2...<..&...R..pH0....=2T.z.,I.....Bv........1.r.....4.e..-|G$.TBj&xt.....;.........
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/yellow_top_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1242
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D7B2B6E556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8D7B2B6D556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................b..........................................................a.....V.....................!....S..T.............?.....D.F.......c."Y.i...2Jp...........
GET /static/marketing/main/img/containers/yellow_corners.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 2323
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:AEB0E8BA556411E1A2C0A3AE56E7EFC1" xmpMM:InstanceID="xmp.iid:AEB0E8B9556411E1A2C0A3AE56E7EFC1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5069219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................I.......................................................................................!1..Aaq.Q."R.#....Bbr..3C$d.UV........................!..1Aq.Qa......"2r...Rb......#3Ss.$4............?....e....g...J...[p..:(&.t...k.3.R[.Dwr5.....@.4.4D.l...J.a.....A..2..f..._}._....W.....?..$..m.........L.G .~T....2..h..~..u..5=<. ......y.t.....0.e[\..8e......=..........j..v.z.o...5.a.\...A....A ......
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/green_top_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1235
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F8486FDE556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F8486FDD556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................`...........................................................b.....V..................!..Q....S.............?......S..hH....2...1%..yY.!......
GET /static/marketing/footer/img/footer_pixel.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 8258
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......Exif..II*.......................................................................................................(...........1...........2...........i..........................'.......'..Adobe Photoshop CS5 Windows.2012:02:16 17:49:45...........0221................................................................j...........r...(...................z...........2.......H.......H.............Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..~.o...)*{.Z....z_k..G......uI$.........Photoshop 3.0.8BIM..........Z...%G..Z...%G........8BIM.%.......m.l...F.4..?|.‹IM.:....................printOutput........ClrSenum....ClrS....RGBC....Inteenum....Inte....Clrm....MpBlbool.....printSixteenBitbool.....printerNameTEXT.......8BIM.;....................printOutputOptions........Cptnbool.....Clbrbool.....RgsMbool.....CrnCbool.....CntCbool.....Lblsbool.....Ngtvbool.....EmlDbool.....Intrbool.....BckgObjc..........RGBC........Rd doub@o..........Grn doub@o..........Bl doub@o..........BrdTUntF#Rlt............Bld UntF#Rlt............RsltUntF#Pxl@R..........vectorDatab
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:44 GMT
Connection: keep-alive
GET /free/frg/products/667850/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 13 Sep 2010 08:37:27 GMT
Content-Type: image/jpeg
Content-Length: 18940
Accept-Ranges: bytes
X-Varnish: 1111897303 1111053655
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d...............................................................................................................................................................................................................................................".2B..Rb#..r3$.C....Sc4..sD%....T5U&.......................".2B.Rbr......#3....C...S$...cs.A...4%.5............?....&....Fy.F.X%["..tG...N..F...5q=...Sl..cd...D.0k.m*.\J....n9..7R@........HwD..V........X...P..6Q.......Z.............X.El.f.....s...O0.L"..:.q..u...$V[....X..8.DKn..2svO..fq.,...yZ;...qkV...T....L.@iE.....R.h.C......`U.{..,*.2...j.(..he.$VE(..Q..8.....H!..T..I$.......t.&.....\......X..Gt...g..o.4R.a>"].q...&w~..Eu.]....i%*.......0..../$..B..5..{m.\b.zP..Z...Z..A... ...`0-.W....$.T9.r..E..t.e.9.....$..%uxiCX..%d;k.....yt.E..j...~...J.HUV.".J3k.......b..i.h...Sj.Bi6l.,0T..][.,....F..~......or.o<....\.u2P..%m.XZJ. !.i..K.......j.. Yf.......Ta..jHb.J..0.d. [.0..S....$.J../.O...bY@.....\... ......X..1..u....m[..E.....(....G.6K%..S9e..O......@.$.....C.....6...JA..v....a..*....f.3.*..6..H.. Rt.........i$ni....M..&o...3..a..1.p.....V<.E,Fl5..(.q."...<=.......o...HJ......,...l>..]..k.K....o.' *d.1on...uSCx..$...8.{.o...HcN....9.p...:....]]z...Z..i$#.4=8...i...y.d.`.4S..j..QW.Nb.....D..Wfl..@.<.cq...5.......t6.C..n.....;.g.....9...IJ......l;y.6...p..j........\`.. ..V.$._.L6.H.LU6.. U@..."Y{`....@..p.[..g/..c..p.=..!.P.(.4......=(.<.;.[I'=!.I$eu.|..A.43.X...".U...<r...$@.....ZxF..L....%.}.<........:
<<
<<< skipped >>>
GET /free/frg/products/558350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 06 Dec 2010 09:43:23 GMT
Content-Type: image/jpeg
Content-Length: 25436
Accept-Ranges: bytes
X-Varnish: 1111897184 1110525835
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:24 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................!.1.A".Qa2#....q.R.$....B.3S.%..rC4..b.cs.T.5U'.......................!1..AQaq."......2...BR..b#.r..3..CS...$4%............?.......\....l....)(.*J......oK...F...@..)....^r..uD...Q1...&3h.....Z N.D.....:..}.}$e..9....U.-(..KpR8R..M.$.xsT4..<@8*...P...-k.....2.Q5D...O...we=..L..u..}.. .....pp....}B......"|.<.'tr.X.YO....gm).S.1....&m..:.*....zN8\.].h...Vd..)..D......."4..l2~........h&...-.&...Li.-....5..e.ql...... ...7.(=E"k..c........;-..D...W.U.y.U..UN8...Q....^.../L].m...u.<.@.O.....[h....../.62......8.)# ...Fa...lv|..y..>..[..f...#."z...;.........V.\.0..@S.7....2.J.o..?6.......XY.b."L. .b.b...T./.M[?.c...0.P8.!<@....$..r.O...^....l.^A.!.3\SbI.;.....f:..Dj....%%......'.. ..[l^.........5<.....T....8...z.z\UW.O..'...8..s......d...a.M...N".!8.. ..N...:.%d.f..M.}'...x.FBwDT......Z]h._}....Y.\9....R....z\y..=...e.y.&...Ui.N...Wp..[.....!p.4..^.Z.'.L;j$.=.q.l..\J%.)%.)..u.....O.9.:..R.........h....K.".Cs...5.!........3.}/..I,.....c..>U..y8f'....l...)...5v?..8...!.=e....a.c...n....&..C.z.7<..m..8.....T...........P.........0(!.9...K.4...8..nc....'....rn_.j.e.`...j.. Q...-7....H........M.....fG..f..0..`....#........f..np...y..2|jIA...P....w.wEY.fp............"E..! }lR...6.`....".@HJ*......w.8...o.....S...!L.
<<
<<< skipped >>>
GET /free/frg/products/642550/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 08 Dec 2009 12:23:38 GMT
Content-Type: image/jpeg
Content-Length: 26784
Accept-Ranges: bytes
X-Varnish: 1267047727 1264829550
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:24 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................!.1AQ"...a2#.q.B..R3....bC$rSc%.s4........................!1..AQ.aq.".....2.....BR#.b3..r.C..S$............?....Wf........."......H..Oj.../....Ulg.r,xVOOd......].....UE.uB.E.....t.....E[.I*J....7.xw...zhe.D^.|."..$...jj_.6S.)..).SV...H..t.....^JUK....`.h.M<*.6j...*.....u...E...C...$<...).E......l!-;....z....|.4..|..a9Z..... .&.h..H...}W....\.Eu..1..Z7......U...%.N......}:....U......mU...6d(..h..&...w.D.TM:"..b.....yG..7.......`..#5"....__...u....r_....}........%. dpl.....#4.P!!#1T5.vMSN...../.....R.&...U76..fN.m..nd....mlR..("........ws..cF.D..Zj..aY.VU.Y..nI...qeGQ.s@......]QQv't.^..X............]K..U.wY5~B.....H.C......nWD#..h..It]Wr.u..#........7....*.-^O..2{.b.lG...9H..:%.d..m.&.%_....].^..;u.....e...a...}.W.......].jd2. .q....M....zh ..5.6.8..n.m..B..>......y5...]S.t..VO.h....c ..$A.Zz/.owF.m.^r...3O.......:...........Lw.).n.....&.f.....* ....-..N......A...A....a.8...>....7..'..Q#.&.M.....nEG.SU......rhtM.Ow.........L2r..v...K..:..'....tMS....)k..*...h...A......".....C..A.5..z.H.&L...:...a.W.;.........&..c=*....G.$B.n<.."......Q..KhE......S.YK}9.......L.g.. 9.K/..$...7&d..:..MU.M.....-.V.P.q.E{?p.v..7YHhf.....U.....G.......D..,*.P.........k`...I.U=..Dm.ai.]9........_o_....V.#.\NU:.^.i....fef.|.^U.0.(.I}.
<<
<<< skipped >>>
GET /free/frg/products/764350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 26 Feb 2012 08:57:18 GMT
Content-Type: image/jpeg
Content-Length: 12274
Accept-Ranges: bytes
X-Varnish: 1679730039 1679251035
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90....C....................................................................C............................................................................".........................................E...........................!1.."AQ.2aq...B....#3R.b...$5CSr.%4.....................................3........................!1..AQa..."q..2.....#BR..............?.......\....qOI..uD.JKi$.6..........v....-OU..`1=q..XA...l{........y.....XV.TU...v......1....@.U.3V....c#=.*.$.....c;M..m.. f..,u`..ETQ .....;N......~XB0........G.o.|1.....B..Xv{JU<..[..v.. .]A.......v....ck.Q.m..PT.{.$...f2.h..t.O..Z.\U..xq.....;R....W.T[X.B.B.......%........6.|G..T[....f....|.Xn.H......`^..b?6k..(T..9;.o......l..4.)..Ts.t....<...9@W..C....jv\5.....i..2.G...r.\a...F.q.2kDv.[c..r....WjJ....r.@.s..:..*(Qf..}\....E.SP.Fi.DX......%A.V.B[).....?..../.l*.x....'..s-..{1....c......(..b.}...V'2d..JMR...*..R......).\.....IH...O....T.T...A........B....2\.........f.Q.......Y.'..(e.v.[.A..>...M......pe....X8..`....lx&......[N.[.<T......6[......].LdCA.....b..kE.....t6..O....Z6W...Q.II..._..enkr..k=5....y....'.lHP..V......V$......"X ..;B.l....)L.Dih!A.7.n..mo..'vH.-[d... ..N.Fi....... ,.......P .V.1"....G.^...;...!M.%....R:c'.Fs.).d\nZ.u[..-..94......[RcA..d1..,...).j...,.g..Qn-.xE..b.&......e.'.TO[b..oda..!#6K...y.6....R.....w..6.E..CHv...7C.....%...(.....E.u..>"..;S.Zk. xHe..|#....B...g..f.&.... ...$....U/j.M..f.r...'...,..F..'.Ea7i..(..g.D...rv......c.yIU.<K..
<<
<<< skipped >>>
GET /free/frg/products/710650/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 23 Nov 2011 16:04:30 GMT
Content-Type: image/jpeg
Content-Length: 20072
Accept-Ranges: bytes
X-Varnish: 1156353546 1155589963
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......H......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?...W....s....y..zd....XFd..g~...EQR....X.@.W.K..s...c.............P.....d.\H.. ...ogl."."H..)..K5).|....@...#.....:.... .xA.?O.n..~...p..0S...q.|$(.....^$..:..~." ...L..@....DQ.............z(.a\...,.....e`.\.. J.o..^....J..nh:.......Z]..\.\\1.\...E,.f./...,.z....,.....]F.....*"_.f...:..:~....O>..!.(... |~..Tf"z.z=......n......-.....6K......Y..U..<......5Q...8....6.....q...j$}.....*..5..qip.......9..qI..AwM.*i......8.1.P...).......E....1.....W.A...w.{.6..k.7T..B.B.M...........o.....o.yG.h..u1...{/...1..5...V....7._......z(...|......N.z.}...r.../.G.2.$...b..L.. .Y..R...G..?..N[....d.|...u kkW..i...h>...e.....$.BD......3Z[......@..,.?2yb.....y....Gw..H.kH.......6.<B..vzc.3X....Z;K}S..Z...csB..M(....s.....2...Y...g.n...Km..V.;.Q.....t.m..j.....*.)....X.....|...:]N,..LG.'.n|..*.!.....^..7...n.NN...l.k.F.....G..;..v{......: ....?e.?Fbk3.p$.....V....y...F.|.a..V._-.....(N...W.#
<<
<<< skipped >>>
GET /free/frg/products/632750/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 08 Feb 2010 12:06:05 GMT
Content-Type: image/jpeg
Content-Length: 22958
Accept-Ranges: bytes
X-Varnish: 1111897218 1111532531
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......Z......Adobe.d.....................................................................................................................................................................................................................................................!.1A..Qa".q2...R#...B...b..3C.rc$%.'..S4Tt.&.........................!1..AQ.aq......."2..R.Bbr#.......%.3Cs.4d5....Sc.$6.............?....b....T)m.mCD.....t2Q(...L..{....~Q......:c...A...?...V'...m..v%?..R..h.$...uK..O..?..r1..2...;...P..A..Q..1.K..*(>"..j]...H....Y..`7..F).p .H.......1..(.aI.6..5JQ^..#.u.-........xCC!)..G_.T..F.2...I.....\.a....?...iSE.u.....9..EAQ2.0..)...R.g.....5........6.|4......~;H...z...T..M......s...8!TE..tU.#....P..e.....?.8..I..N..a..hd.I.<I...F..`...#Im'.$.u...5....9....z.~..m...h.a5.%@........D...X....p.....-.~)5....:..V..G..e..VT...B..^...R&a...h...j<...:X"7..*.}.- .....@a 9...YXY...j..#]k.|...."2.4. ........#l6.......|..P..8FA....[~%Z....R].8.-..u.....J.... ...aAi).;S.A.Z4..')......S.?n......}0..OR.|..~.m.9JPQhA..C..c....d.}).......T%..o....*..........B.~...L...#.f=T)....z..4.z..../.c.W....J.>.].Za.{m..jIK..N...t.."..Hrp....u;..G...0....".).z.|4<.3.....O..<.v.FpM.%..:.. .4<.._.X\|5....sj.....]Be....`.....QO..M. .F0.....>......#.......Ec.\...s..5)p.[5..Y..9..n... .dv..}Z..".....G.`}G?%R.....8.wT.F>.......8A7..g....@....O_...w.GP.1......O.Py$.}.q...%...8 .4Fb...'.D9....QJ...[B\.....j...B.Sg}(.... ?..SB..3...H...C.z[.G.wUH.M)....lS.h$.a..\Yq!"i>.H.]....T.:..n.4..0&
<<
<<< skipped >>>
GET /free/frg/products/765950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 26 Jun 2013 11:57:29 GMT
Content-Type: image/jpeg
Content-Length: 49185
Accept-Ranges: bytes
X-Varnish: 1109789826 1108363347
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:24 GMT
Date: Fri, 01 Aug 2014 15:05:24 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE211955FE55656C7D978" xmpMM:DocumentID="xmp.did:BF9ACF03DE5611E29D5CD82168A991B7" xmpMM:InstanceID="xmp.iid:BF9ACF02DE5611E29D5CD82168A991B7" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFECAE02DCAD11E297D7DA6E15F12B17" stRef:documentID="xmp.did:CFECAE03DCAD11E297D7DA6E15F12B17"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................................................................................................................................................................................................................................!..1"...AQ#2.aqB$..b3..%E&'.........................!.1.A".Qaq2...#..B....Rbr3$.....CS......t...c..4T.5.d%&.............?.L:.r..PT0...T.1.2..N...F~-N..us..{/.8....-.7`...%?O-z...(..;b..zQ.....8......h....p#8.......z...=z*.._....YX3....nk.h........AoB.A...........m.V..a;..?@.D.qU...c(.Q9Q..W.:...6G0.
<<
<<< skipped >>>
GET /free/frg/products/559350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 13:21:44 GMT
Content-Type: image/jpeg
Content-Length: 15034
Accept-Ranges: bytes
X-Varnish: 1111897258 1109849730
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:00F0D465EA2C11E297FAE79CF768BDAE" xmpMM:InstanceID="xmp.iid:00F0D464EA2C11E297FAE79CF768BDAE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E1799641E79A11E2A6FFB8C361BB07AA" stRef:documentID="xmp.did:E1799642E79A11E2A6FFB8C361BB07AA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................................................................................................!.1.A..Qaq"...2#...BR...br....S$34...............................!1.A.Qa.q.."....2.B#....Rb.r..S..3c.$t.............?..as.ocgD.r.R..1..........>..W.#._G..yeZ^....O).P:E.6.....T.j...72[/.s#JEi..?~..l.`..&K...YR.Z....tjjmJ.....$.;...2.|....#u....[..bM........C.....]x6..).......J...i.....~.!R.$...'...A.v...D....]............1KG{u^&.S...}..E........e...;}..\a.......e....
<<
<<< skipped >>>
GET /free/frg/products/735250/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Jul 2011 19:31:49 GMT
Content-Type: image/jpeg
Content-Length: 20909
Accept-Ranges: bytes
X-Varnish: 1111321462 1111163977
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......I......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..RMp....CS.s.(>..{..L.I..6 ..}.... I..;.......G...$........#.q...{..f..m...p.;.g.^..........\......d......U..#.s.$A..b.A..Z.Q.TD.1..9...p.w.2H.E.....z.........0!\...o.|....X5x. ..!#./..3.....dl.....5.2.7......g_....c.Ld..X=.D.bH".T..1..?2i.G..k...J...w?,.}..L8.GM-...";....y...FR3.",.._.....=jY.%e%..R;..{..8p..S...j#.!7..js@..2:....c..<^.C..]P.......s>..\N..y..6............Z..z..V....H.....a,.............=.....D.A.....F...}........J...5._.. _' H.4.p...C.!.. .:..........=...M...Za..J..3......E["..."..H6......;..1.6K#...b...a6.2*..<..K....`.........K ..0..q....=f3......Jx&%|...W..9%......F....=Fxx....L.i.8I......O...^...kb..O.~../..%<..,...;....e........x..D...}.........y../...VE.r.\..pv..}.}...OS.....3[..C...:>.......a...#...g...9.....q...z..d....(...:...]&.i6...2YZ....wgk)..O..FX.........fF,..hH.:..a-6H.)D.y.....Nd...$n68Sj.;...R..-.....}.\$l.h.ku.*.......T...d:%h.
<<
<<< skipped >>>
GET /do/gatewayCD?sId=&subId=&actid=&callback=updateClientCookies&_=1406905525155 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:16 GMT
Server: Apache
Set-Cookie: JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52; Path=/; HttpOnly
Content-Length: 166
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
updateClientCookies( [{name:'143_TURNKEY',value:'Default-641406905440442383',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Default-MSIE 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:16 GMT..Server: Apache..Set-Cookie: JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52; Path=/; HttpOnly..Content-Length: 166..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1..updateClientCookies( [{name:'143_TURNKEY',value:'Default-641406905440442383',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Default-MSIE 7.0',expire:'7776000'}]);..
GET /free/frg/products/450950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 25 Apr 2007 20:42:32 GMT
Content-Type: image/jpeg
Content-Length: 30468
Accept-Ranges: bytes
X-Varnish: 1111190532 1111049418
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................................................................................................................!...1".A#.Q2.aB3q$....CR%.........................!1..AQ.aq"2.........BR#..b$.r3C.....S..cs4%.....D.............?....q..V.B...j<.....>..'..:`U....%#..2.zv.I....BH:.....*h...._#.F.....W....^Z.1,%3......9L..aXw.dbz.....l.....<.TT.F.\..G#{/.u....^.......t.,....'.....z.97.d..A.%c...j...c....<.[4..:;.....\....kUF.dO...[..\L.R. .(.@i3.\g.(.c....%.f..~.?..{x...Qo.$.=......t..2..z.]c.q.....M.....%e#.6.y.,|.........B.P.........N....9....I.r.k...y..qy.d.....F...k3L...)n%.#A..RI..-E#..=.~.Y6U.....r...4.......3.S0...-...G .X.6&...._...,.k.d5,k&..%.;.....D .g..5x.D^.....uf....EMp.z...I\...#I.x.......U=m!*.:S.......>i`...lP-y..U..j!..7.....=.TU..M]k.Z..V..hH ......@...........v....E4..U.A........{H..U....n...S\...mn..E.?....<.>...z.vU......;"`..c.LK.......\J.}.f!.a...^b....1......B...2...Tb.SN.w...[Z...EL\R........Z..xa3...6-....E.z...I...?D.pl.~...`.....(..(b.%..v1.zn.z.I.......Q4N.......r..m......[.a....".n.[x...I..R5{../.)\w...... ..2.!O..#Dv..Aj...DT.M......K}........56.-H.2.......c.......\.....c...d..<b..rV.s..h... o....U)...4g.u!.n;...C..[J>......EGOmo..p<..p...&.....)..*j..F..j..._..4.j..#8.....=..J...z..{.b..r.....s.......B. (.o..<."]...d.@I..ysZ). .........@F.8...e...../T.k.m.@....)..<....-.\.
<<
<<< skipped >>>
GET /free/frg/products/661050/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 13 Sep 2010 08:36:31 GMT
Content-Type: image/jpeg
Content-Length: 17879
Accept-Ranges: bytes
X-Varnish: 1111190609 1110319050
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......R......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?.......n7...5.9.}.o........9.`.... v[-.......1s.0...U.......[..7..5,_.......{ mZj........[q..}C..8.bW.f.....>%..._.....3.#....c..7...-kK|.f.mA~...,.V6$.i.j...U>u.........V.Nh...&.....3...4.Sr....[....Q)....61'..........;..k{r.O]z.d#...,..JrA.^.X^$.Z.d..j.UHf...s.!.. S..=.*.[....3.3t......R........n..q....G. k ........ ...&.,\.|......>h...........&..~_._...;.......X......B..?...I.....&..U._L..Ei\...2}.onM.=>....`....s...|.X..qBz.zy..!......2~....a. ..}...jX.......MIe......^...x.....".._... .r.HG...sp..5..{|..\.Q..}..?.[...-.<>..ZR_../Ox.C,.H.X.^-.....w.5z....w}.r.t...C....y.4&..|.d90.....k1".........,.... .R.."N..l.k.. ..AM...........l......n%..... VQ!....|...........n.... ...z..\.`.k..2........H..&..X....M.X\|$..v.....9..x....'....................;......K-W.~}.k..?#..u....G.r$=......I..Z........o8.8b..h....Zf..H|...C.....I...y<.?I.*A....%..KF.<....._V..@L.Tm*
<<
<<< skipped >>>
GET /free/frg/products/680950/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT
Content-Type: image/jpeg
Content-Length: 17864
Accept-Ranges: bytes
X-Varnish: 1109304790 1107277168
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..y7..k.5.......P .$...................^.D.......=:....V...6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e......6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5.........Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... ....z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5..@.sq.}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q....^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb ..6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2
<<
<<< skipped >>>
GET /do/gateway?sId=&subId=&actid=&udom=partners.freeridegames.com HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:23 GMT
Server: Apache
Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/
Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/
Set-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/
Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:05:23 GMT; Path=/
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Length: 38
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:23 GMT..Server: Apache..Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:05:23 GMT; Path=/..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Length: 38..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1..({"gateway replay":"{'status':'ok'}"})..
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:49 GMT
Connection: keep-alive
HEAD /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Content-Length: 12146312
Accept-Ranges: bytes
X-Varnish: 1926374319 1926325909
Expires: Fri, 01 Aug 2014 15:04:01 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:01 GMT
Connection: keep-alive
Cache-Control: Private,max-age=0
GET /dc.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: stats.g.doubleclick.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 07:26:35 GMT
Expires: Fri, 01 Aug 2014 19:26:35 GMT
Last-Modified: Tue, 17 Jun 2014 01:05:58 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15758
Cache-Control: public, max-age=43200
Age: 27528
Alternate-Protocol: 80:quic
...........}kW....w~.....;.$..&.Y@i.-..ZZ...Y.CJpB.p).....H..$t?....M,..~..F3c7.'"....{...E....A$.|...\...L2..`?.{I/.g....N{Wr0.X..^...d...g.L. .........r.z.#..G."..~%.p..e_..p.^8...'.i.._.J.=!.6.....9./.....a}....`.. ...>..t..ox..q....D..(v...W<.P.......^c....... ...F...@(p.....NW5.a....`.n....l.K....:..... .h....!DO..~.r>.E...F..=. ..e...h0.].}..#P.0.ol.....K>..o.....%........{.....&.@.q..:......{..c.nzP*..n...........[9..)Ta...m=z.m......(....N...&A...X.KCV5.R...<..._|b&.$/l..3..1P'..O...s...x3.E..J.....[... .......8^...:z..".7.y.2.....,C..Y%.0..4...^.V..y.#..`.6U...........y..w...5=...N..{....o;.u E.iPs...........$rW...._.m.?..@<..W.g...L...../.a./...x"........a '.......|.n.. &S....Ea....r..P.......5.89..lto.$....z..s......|*.;N......AN..mL..*..(...U...f2...,....J...y.qqA.........BTo.../k$..7r..9P..H.J.^.......b..=..A..&...Qo.A?..W....l.........'".. ..D. ..EA.........Id.s.....2.9.k.f......aZ.0.r..H....n0.#&.|xo.]X..-..-..5.....4(.x..4j&..V..p.N)0..5..Cv.K.!........&A>...I....:>lh.A..>...U...J'..........B.q..y....()..3. .... A".u{{.;.......W.....k-..zF.\`Q.0........\d..a..A.1....5.y...`-^.F..M"tf.GM. .XY.YU...T.._.lH.......A=1..N....?Z..R ..{...(.RS..^...)...8Em.e.EU..^.....<I.H..C.....R......%...<$.........S......L.,.{..)..b....-E&.7...f.V.j..(...Bj.l..!..K...Z......T......B..NU3%4.i...9.......a...>/..kE.`_.$.;.Ld;......x.H....\.8.n....D8....@V..K...Vu.v....V1@.-...k..Z.....J..D.R.m..J.5 ...U...$..jG./..>O.}.,R.....0q..l.;2o'oJj....|]M.........:!X...&![v..EO....E&?.N.$
<<
<<< skipped >>>
GET /free/frg/products/633350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 14 May 2009 11:41:01 GMT
Content-Type: image/jpeg
Content-Length: 22203
Accept-Ranges: bytes
X-Varnish: 1111191246 1110490904
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d..................................................................................................................................................................................................................................................!.1.A"..Qa2.q....BR#.br3.....c$.C..SsD%........................!1..AQ.aq."...2....BRb...r..#...3.....sSc$.............?.J..m......_V.$.|..3..#.....HE]GI...k..;9SW....'m..k...b.._m....Y.R.u......BZ Q.$.j%.]G&..z#....(.....=.....s..........I.%bl.q7...8...c.A.].m.h.,....[H.N......x..[.\......t...U....W\..G`2....`.{....!.sE.D...]1..&:=..R...y...,.....RU..i.~b..ie.q#.5...SC..U.,.IT....N...3.w^......v......;.l...".K%..p..$..v$P!..r..:...T{d\0'....K..,....rT..P..{....qg....P..-.o..$....[KIR..@-......mL.-.....^.I......n.6.........,...-?R.PG...;.h;p8.55.4.W..w...Tii.;...r..&$.TQ.*.@)...y'}...pEv.UO6w..3N.j......&E9i..P...2).MW8.o...."...i]|u...*2............R...qQw..c....O5s..5.3...d...yM...>......dM`....9.|U...C.......5X.a.n..?mX_,.....N.{..g...ND.p....@..2....!.l..<=B}4.|.j J.."1(W!%t.%iS.B.H\.#*!....&.y....X\... ...$.K..|:....s.N..jhd.K^...$B.\..(s.....BI...0..w..VY.I.\o.n.j........T..Dv....m.hy).....:M..|...s..#.......w0.<!.s..Aqih!.....v...Yx...d...'...z..jr8...K...UN.T.x...^..3....DN...S..8...qZB.$..Q...(..>...a.fI;.......Y9V.....&..Yu.eA....eI.S...Rv$h....X.6.^...G..e.P.,2.:..t......i..B.p(N`....l=...7.6..5.....P....1(...^.......GPz.....;.7.....I...........W.-.{1.U.[.cl..<!!...ajK@!.iZ.R...B.|.6..mX.7.Ksa...qn'.
<<
<<< skipped >>>
GET /free/frg/products/619350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 16 Dec 2013 13:51:05 GMT
Content-Type: image/jpeg
Content-Length: 16168
Accept-Ranges: bytes
X-Varnish: 1456967477 1456500431
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.............................................................................................................................................................................................................................................!.1..A"Qa..q.2B...#.b.R3$..r...%..C..F......................!1..AQa"2...q.....B..R..b#.r$...3............?..H{.........M....5J$..4V..Q.Q...1\On.#R$........xE......5* .4.W6TD...g..-........L ~]....J.X.s...:tI...T..C........yZG....X.R.A.N......0...%w..............P./ k&..............~:..{?'qb>>......c{.R.:4..7o..4..|m..~>._.y;rG..I.....-...,.~.. .....I..8..z|j..M..)....:.Y.2.82P".v.TS.........9..."..#.T..v..X.......7l....n......`......J.'....F..=.../..B.^....{j..z.@>_..k..H.......cC.....!..u..iC.o]..Z..]...a.[r.|}.....H..|..........u.SB}..Y...:...gh..#..w.^......{f.......?...Q....'*7H...|.no...$r.nc.:.....IYD7....%....E]......l..&m.q....B..&...F.........3.....X...h.<R...PF.d...!_KDD..N.....9f....._...$.L.x..vN1..Ui.Y..b"..k..i$.......YT....]..,$..b.B.".......U.......&......)..._.7..V.D.G.U(._J.qM.k...U.Y.].j..r....K.... ..8!{.........X....S....=& x....={.'...7k.k....d.}...5.}..[...zn=.B.0..W.X.r..-Jn.*....0.nE3..(.x.p...u)..,....y........uN|..SO...G4....bE..#.RG..q.T....$.65>.6.]............o.."$..JM#..T..Y....h....#../.M5..[L.!H...)c**.t.#.......I>Q...<.[...W &H(.EQN.H*..Nco........s...q......c........J.....;-.o...\.\ZPN.F.%Hp.....*.'......n...cou..)..J.R...j=cY....r..x..q,w.'.....R...Z...,B.s.........{.
<<
<<< skipped >>>
GET /free/frg/products/701650/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 15 Sep 2011 12:15:52 GMT
Content-Type: image/jpeg
Content-Length: 18010
Accept-Ranges: bytes
X-Varnish: 1679378593 1678835593
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......F......Adobe.d................................................................................................................................................................................................................................................!".12B..AQR#aqbr.....3$.....C....Sc4%u.....d5..........................".12B.!AR...Qabr.........#....3..q...Cc4$T.............?.|.....w....|.u...br$>.4$..k..@...\.Z..."#Y|;U...W..5.l_.j..V}/k..../0..5...$6.....y.onX..P..]......M Jf.Cc...QA...)..rV....`....<.......j:.="`o...ku...yHGj.<c.D....i....c..t...z<gePO.L...P...N.V..............;...8.y..L~...av.e.dd;1.l...)...n ....J....;..M......?;G...wi...w..qU..q.4....\{.N...[..ml..O{............=?.1z.qe.-....3gjA...7D.3.p.8..._..x..f..[..j.y ..a....r...<. ...&.n.SMJ1.6..`).M...u...Go..E......M.JQyd.{..uE..2....&.M.n..t;.....&~Q...I.*.'.?...2Z.-.4.@.V.{.q,.n..=..Ejf....7H......o..U.w.o..&.....................V...W....hfP..4.^\TI.&.Lo._Lb..ov....V....33....V.).....S.zV.-./e.....Zwb`.*....q...Xpj.... ..x..................7Hv.kj....vA>.;..4.)R.|...7z.a...v../?.O.Xv.....5u...j..;...[...;e.5tj0.....<.4.5.D....($j....|...f.4..Y.....H.M.......#......#.....!E..8..(y.L."...(../p.|.....e..O.[.. )r.'...a..;t......D|.F|........Xz......^....W....$......^.!...i.....is"@...F........=...y$..Z=.^....19.._@#L...V;y...m.....b!/x.b......FT.4..u.~....G...B4.3...D.o.D..\.H......s.D] ............s.9^.........*...N........PVm.a.C1...k../ ....[m...V.. .`b...S......:.....D='DkT...G.m. ....
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard/js/defines.js HTTP/1.1
Accept: */*
Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:25 GMT
Content-Type: application/javascript
Content-Length: 1371
Accept-Ranges: bytes
X-Varnish: 1111625342 1111347017
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:02 GMT
Date: Fri, 01 Aug 2014 15:04:02 GMT
Connection: keep-alive
Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Markting = function()..{..};..Exent.SDM.Markting.Defines = function()..{..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/img/",...freeride : "http://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.userAgent.indexOf("Windows NT 6.0") != -1) ..{.. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3vista.jpg')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}..else..{ .. .. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3.gif')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}....
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT
Content-Type: text/html
Accept-Ranges: bytes
X-Varnish: 1201441805 1199270395
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Content-Length: 1615
Connection: keep-alive
...........YmO.8..\$..7......i){-...tp..-.;.'.&nkH.(v(.....v.B_...]..8v...........^...ct.??C........c..4{.}.?..-.i.~.#N.e..m...q...?..P....]P............a......it...z.....1!.@b.....^.>...'d..0...../.\.......k.hg'........o.........7....F.[7@.o.....Qh,D..m?.,rO"a.lb..B.....Nn...H*....G.N.k.i8.j8..SP<O.:.lo..C..R<.....Ws..u.B...N...7.C.<.tK.}&p.V8,......h$...h8..f..P...R..^t.U/.F...........!.N.C..C.....F..L1...0%...U...J.A/..FW...N2..E...-.....D.DKJ..Z..n."=R.,QU........... .}...C..A.h._...0%...A^.....T....Z..-...cNP..MT*.........!....).n.r...j....b.t........ ..!.e.[G...:...i.X~b........?P.@:.0i3...=5F$J....C..~...$f.O@9.}.z....9.7H........Ni.'#w.(...B....[o.yk.).....!.o..K..!NC.Q.... .Y....q...G.4."6.!.8...h....)/r..I....<..|.....T....sy..Y..=....g!../.i....9.= !.Z..eU.P._H.'._..P.d...0*e.Y$.D.#s.;L.S ..Fx..${......r.{.....#...".p$w.....gQ.^E..#! .Q..u#O.2R......'4.H...\(. .)O.K...$.i.....0.l......Bm'i.u..U.....k..v*.&.Q......\.Q.W..L.~....[E..[..i...,...*.S..lj..DU`W7......usJ.1.>:N}L....a(...8.f.....,.A=.4..............fD.@.P..K>.gc.=......... ..D..5...*...g8...H..j..|/..Y.....Stp_..?E.. .....z....%.;.....A......Hv.23.TT..Qe...Dw..]..t....r....*..v.1.U.n.). ....]V....!..v2#j...1..)...S...},.4?..]..A.u. u....K9awP,..R....hP7!;.....!.U..L..L).i....$.(W.FM.f..AQ&.....U..........w......o....|...F.............n....v]..<......0.....mD.:o8.....G..$.*....<..YG.^}.V:....c...f....<..=.#[i...'.FZ.\...dO...qp...ei...r...:w.|...'...|.`.j........,.t..s.nn7..f..w....L...w...*;.......X.v1H}a..>
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard_2010/js/defines.js HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT
Content-Type: application/javascript
Content-Length: 1376
Accept-Ranges: bytes
X-Varnish: 1111680727 1110770841
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Markting = function()..{..};..Exent.SDM.Markting.Defines = function()..{..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/",...freeride : "hXXp://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.userAgent.indexOf("Windows NT 6.0") != -1) ..{.. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3vista.jpg')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}..else..{ .. .. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3.gif')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}....
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/jpeg
Content-Length: 48259
Accept-Ranges: bytes
X-Varnish: 1111680765 1109735540
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|..............................................................................................!a.1.A".Q.q2#.t....B.F.....Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q...?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.
<<
<<< skipped >>>
GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=4858524-7287785
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 494852605 494804948
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 4858524-7287785/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 494852605 494804948..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 4858524-7287785/12146312..Content-Length: 2429262..Connection: keep-alive..Cache-Control: Private,max-age=0...>.W.O..Y.'...n....1l...^.YR...'...-..<.._...........'..,x.....`........IS.V.....(.a.....i$.|.^.....W...P.(....&.....a...c.C......M..B.4..3..y.R.....,x..O..... ./HT*.]..5..Y.W=..f.7....y.vcs......H..)0.h[m...Z..ce[.XY...n...S....G..t.vD'.. . e..<...#12....6....W....<./{...W....8..pk.VoaN.9......C...g$...........'F.......2..YZfq-..v....fd~Cd..-...s..T....t..S..T...9.S..Q/.0..l.=Z...p0...F...}7....e...G]:~.q...l."...vv..~.#......S......=1......4.X#3D.t..Q..........I..4v`.. .=a......ix3...CK.a.&....o.g...X.n.)..z....G..-.X.|%S..8..&...1}....../.\.)..L.@wM..<P70.....b..hR..B...O.#.l5f.....1..op{..8..)... I...0.O..}5Z...Qj`%f....6g..u..-.|...O..m.A..... *yV.i\...=...Wj...v..p? ...v....:.......iKD_.t.k......|....68.6... &a@..:.....I....'...iI.L..._. ...j..:"E...i).0R/2G&..w).fet.,.....#J..m...X/.......i.;..E..}..c..Z..>..Xi}.....`?.....N..i..i..qY..!r.Ji.n..p....oz....<.U.:..Rur....Q....bE...F........zC.4.......s=~~..!...z.._:.-.z.9b.......1.f.......^?..'...I.(.>P.K.....B.]5..;..m.e.!.........&..]...b^K...LCQx......Y^:.....ofd...]..`..aR....o...p....h.e..l.... ol.lt......K.......,...r...........h.x`......|
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:55 GMT
Connection: keep-alive
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:23 GMT
Connection: keep-alive
GET /free/frg/products/624150/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 06 May 2009 07:47:22 GMT
Content-Type: image/jpeg
Content-Length: 18319
Accept-Ranges: bytes
X-Varnish: 1679200751 1677933599
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d...............................................................................................................................................................................................................................................!..1.AQ"..aq.2B..#.....Rb3$...r..%..c4.......................!1..AQ..aq."..2.......B#.3Rr.............?..H...7.?v.f......X.o.6....t3x.ZT..2...T.....?r9*e=W...[vd.w....kq....D.-_.e......\...a.?..k]E................{X...o..c..%x......X.@..).C .p.z1....t<1.....5..|.%X.....~.[...^-......g.R.K(.....MT.:s..F...q.......;.'/...;....:..}k.............Kv#..ml.!E..j..6H7<..B?..l..@u_v9.]p....*....A..?.|..*._....p......r..O.x..r{e.^>.......T..........t...[..V.....=E.9g...o...gs..E:..G.W.!.s.?..{.d..a ..`....5...... ..6.....~.,{.a....=[E..K ..2..C...\...T.c..?........6......W....z..z..l<..........W.kZ.z.7......U.s...w.....#..T.$......z...[.K,k$1......$....\..9..Z....]`.P........1........L....;..[.p.0....;..q....r.h'.te......O...L@.K....<Qk.\..x...S".....yFk..q....zZTGl..k..o...7.....}G..q.\.\..yv.?.............?...[p..S..b.....,......D.v...fQ..Qb..[.......J\..8<n-Z^...F>..e;G..o.{8.a.....r...zn..T$5c...Ze..|....g.......x........N9.;.F.~n.1.@.Y..h.[p..a..(..q?...F.m........'.G....<g.....L~3l~R...P...e`......B.}.....Y.DG$Z..o9bo0.........Z/...Y..I.VZ.L.B...PT.v..u....7...-.G0..g.4....M.m...L?......b:...VA.........1e..0*.9%6=....r1f.Fd..|..x.....'4..z.......^.8.;.qVm40.mkwG........vS...q'H.;y...\..y...<g?..6.. lL..
<<
<<< skipped >>>
GET /free/frg/products/674750/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 30 May 2010 12:08:35 GMT
Content-Type: image/jpeg
Content-Length: 13779
Accept-Ranges: bytes
X-Varnish: 1078423183 1078015529
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......W......Adobe.d...................................................................................................................................................................................................................................................#.."23CS..BRbcs$..!.4Qr....DT.a.......t&.q..d..5e.........U6.........................#3.."2BbRrC..1..S$4......A.c..T%&7.............?......t..Z..[.n....j.9.H.R. R.d%_.....2N..I..8.I..a....m..X...U?W.A..`../...E.V.~..Z.....5..EQ.rxd.........>U.x)>Q.v....f..R7.xJ.P.=$.!.{?#..]aY...\8..t.O6.u.....U...F%S.).4.....@..<y..5......k.dG.ZM&Au9...Ov.J....M.c!.....\......Q;z.~.y.....vt.....B.w%=....-..f.v..O..Z..........S8%ot....z......P.......!..F.u..:0....*,zA.1..R....w.y5 ...C..a`...wb.V..p......:.....w....L@.$].=6\m......*;99M..x..U#.k.O...Vv....../.k......T .#.z.t.F.\...Q<.......'.&....u....E.m7..d..,....^....3..tN.R.......!..*."%v.2.1.T.U...Q.p.P.......y.y...H.E.l....kU.n<[.R....H.]uO.71.~>.;Z.....0...n..P.:i...wmN.R.ZF2H.B5......k......U..g....q...I.SoC"..It.I.'.}z..^..Nd.`.....?a.$`.i./.).r?.D.....PB.{........,.B..?....T...F..^...o*...h?>..D.G..aZv....i.3.ke\...B...FBhP5.......a.4#..x.......c.&....:.W..*o..S..@...xL..b....Um....EJG*....(....d.|..rb..<.Y.^K..Z..`(.:{A. &M..b...D..Vxr...[@..X..K^.)6i..>...'...;H..........U#0.=..\.JE"UI.''.jI...._.2../....-95.R.cSV..Z[..i.B.r.y.k..O.:...{.s%...I...B....(...g.'....a..:.p.r<.#..n....!..../-..hJ<.a\3..C.....V.k.y...r.....Uv..4.3..A..".._...#BB)...
<<
<<< skipped >>>
GET /free/frg/products/575350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 25 Jan 2009 14:27:04 GMT
Content-Type: image/jpeg
Content-Length: 29740
Accept-Ranges: bytes
X-Varnish: 1679729950 1678424226
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................!1.A"..Qa2.q.B#...R$....br...3CS.D%........................!1..AQ.aq."....2...B...Rbr.#.....3C..c$d..S.DT5............?.Z.......-se..d..X..:...b_.L....'.B.K.[PCm....N.......Sr....?.T.%...K..8..09&T....s...kb.5f.....@o..=2dZ.1..-TK.RTR.MM..t{.#.ey/...o$.{..$p.P4....*N....n\}...s.}&_...[....2.x..S.. ....'.kZ%*.es..5........;.E(q....<.....-..G"],......'......A_'zk.A.o......"".c..........J..nT........\[g8gs......w...u.@}a.94%?..HI...5..'......N....T.=..'....@....~|..6X.......LiKrM.$.....A..r......#p.oN.1..a$..........8.#.N\.../...6..]U..O!c."K...C......@Qi...%.%e*. ....4....A ..Sp......((W.^c>.....#.4kD.7.|."..u.GVKt},0.R.q)\..h@.....SLH.$x:.n.....u...^S..xe....e>..n...... z...Q...)i.....m..zBI.4W.h$iW..../*8.&[.c...U\I. >....u..8c.....C*..2;.K.*!.....rv...^..e....'y..c.\.VG'...W.>}qe.\...a..O......}.'.T......J7S4`.......%}G'..........t..S.........[U.x...rI...L.*...r...h..%,A#...?mS...}.TU*.....5^.2K..Ql..........& ...#.......^..~...s.;--8.3g............6).?..:.....`H.;.~.C..R...#...<...U$.m.....4.FEs;H...A...a.~2v..r...i..L./w...|..2!............7T$6.....%B.u......i.7p.f.{Ms..........Y.'_..#Dr6Ap/.D....*...$.k..bp..{N}..1... {..4....q....S._/........u.^>... bRB.i...).........4...R'b.....%...K$....w.J..7.#.
<<
<<< skipped >>>
GET /free/frg/products/766250/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Mon, 19 Mar 2012 10:53:17 GMT
Content-Type: image/jpeg
Content-Length: 11446
Accept-Ranges: bytes
X-Varnish: 1111897285 1109846362
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:25 GMT
Date: Fri, 01 Aug 2014 15:05:25 GMT
Connection: keep-alive
......JFIF.....H.H.....C.................................. ..& ..$... 0 %' -,,. 150*5& ,*...C...........)$.$,-,,-0,,-,,,,*,),,*,,,,,,,,),)),,,,,,,,,,,,,,,,,,,...................................................B.........................!.1A."Qa..2q...BRb...#r.$............................*........................!1.."A.Q#2Ba34R.............?....hQI]....<hh#.!|.=.........m.>..U..,5.zZ.?tc...m.P.TanG.....i\rR..........z;..|..%\."...9........{F.N/a....o..:.5....=.I.Z...^;c...BvP.....G...8p..q.l..S.r....*~..Z(..%.y.....6>%.._.............d..h.K........c.h.S.h.......%.G.......A<...A.3..fy...;...~..U....*.&.t...M..J......-~.j.Jb.d.....C....;..>.nw8K.`.9......],[..P. ......'...C....8..Y.u).Ni.X....P.v.....lv...N......$|.R..#..%..'...ZK..R......X....r.Z:O...8...m,LdT*.{..{..)...s=....qL.pAN..y#.....Z.}.>.A.V..q..........h\..!c.X....1. ...M..r.'..x.{..7./.0,-.Dy.y`BH..t.b.O.}..........A..dUe..<.|}$..Q......)...W.\F.....G....F.t..B..u.QCNV.OlP.........v........<.x....2...".@=9.8]5.-.....7.&oE/m...x.X.....'pw.....I.....FGP.S..n......cr3N;f.%..)A...z........&....m.I....N.K./..'a$50Ib.&..2;.q.....M....j,.......;.o..Qsr.4..~g..i...CR5.E;.OK:'.P.o....\5.~@...u.NM$c..m=md...<...;.g...u..B..n.<..M.ql..W..kUH..Y$....v....A.G....G.Q.....3...#.k.=<....S....."...v.7.-....k..:.c:Yl...D......4..ml.-0j..*...........;.Dej.e...pG.........T.....?\d...I...Cd|.....I.I...~...^.......*.^.ceR4.v..u...D..h......4......J.....$s66..J#.m.S'.....n..,..@R.._.$.#]..`..ze..e.m.......6y...~.a._g....fI.$
<<
<<< skipped >>>
GET /connect/xd_arbiter/oDB-fAAStWy.js?version=41 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.ak.facebook.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Encoding: gzip
X-FB-Debug: ZB 50aMstmsTvc/Q8Bzyb3YkyXotkTC nMtFOpOrjd9HqCdP06SGvCzueP0UYwZvOqczfcXu59vy W3jNMO3Uw==
Vary: Accept-Encoding
Content-Length: 9227
Cache-Control: public, max-age=30665886
Expires: Wed, 22 Jul 2015 13:23:26 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
...........}.z.F...<......")/.1........mlg........D,....H.g.U........-...Z]U][.........../..........yQ.E./_1...tj...<?.).Y.Xoy..I.L..G3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'..zz..w8Ys..=X.?.T<vz[...Re..S.8.....g..p....fsvN.....5..4s.-..06......BR.k.f.@Y.0....zbM:.`r[.....ta%|a}...Y.....e........dR.nH.....Ho..'...E.k6'.&.X@Y.B..dH.$..."(p'..\O..8. ..%..r.|ga.DX.x:6b..<#....D.rLT....@P.....-`Ep..T.qDnZ.y. ...]7G...x.".K...&h......b..)V..BXe.l.6....W).{R.l...n.N.Q..3.....l....OcN...w.....jj.<..0......).Y......x.....E...t"`../.F.;..vz*.m<.(.4h....#.F,/^K`6...q..f..q.......<..X.\..z..L.O......R...Wb..,.A.6H.F... .\^^...LH....(.wP...P<.k..$.B..a..._....A..4.....;9 ...w=...gg....;.Y.8..... ."Z3...}...5l...K\.....V......=.r.q.i..Z....<B.C2.&^...\....Y...#.,..H>d)X.....I.%..d-9.....)v......)... .z........G."$.. .!..EX..n HX.,..X4.v.g&...c8...@..h.....K.9;..G.-.Q....'V.V........z..X............y4n]_.......|.l:r.Wj,..#...Hy........j.....x....[(..o...G....X.{.-.=...SF...{N*..;Z...........`..0.J|.Zl6.V...,....}0......\....W#...x..A0..;.Z.......Mgd.o6.V"..sE`..M]...W.U.Xvs.4....7..:....wb........LC.....0.W....sSNqsq...;v..{#,iEW.r.....7..`..O.I...2<..Q.<(JB.>......W.(.'g`.4.3.....m...T........w*....\.tw...y...}.@}_....&...[9P{k}7.G<./.1M#...BN.'(..Nh...........:.3qy.................N.;..1.>..xx$.~.....a...;.c.\......L6.4.K.by>.,.2..g....}.,9...# ..~]{P...o.q...X...6....6.]......[
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:01 GMT
Connection: keep-alive
GET /free/frg/products/554350/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Thu, 11 Jul 2013 11:07:11 GMT
Content-Type: image/jpeg
Content-Length: 16660
Accept-Ranges: bytes
X-Varnish: 1110726342 1110402620
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3EB270A5EA1911E2A262D7F48EA80A8F" xmpMM:InstanceID="xmp.iid:3EB270A4EA1911E2A262D7F48EA80A8F" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EAF28A94E70E11E2BDD183F16790EF49" stRef:documentID="xmp.did:EAF28A95E70E11E2BDD183F16790EF49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................................................................................................................................."..2.BR.b#3.r...C$....4u61S...%5..ATd.aq.cs..D.e.!...tU&......................."2.B..Rr..#...b...3S4%5.Cc.$d....s&.!1Qa...D............?.....$&..JH..g.$.6...-.VK..j..ls0..$..s....M. ..../,.u..?..}.(..;...........z..|J...8.c. ..........X.... m.]b..w.._....'.:ET..6O.u.i...T...^..^..z....c..`...T..Z..X.e.......? ..,.[......u.s.Q..\.5.......W6..'..W..9.(..W/.FlrI...\.: .M..u..
<<
<<< skipped >>>
GET /free/frg/products/616550/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Sun, 25 Jan 2009 14:27:28 GMT
Content-Type: image/jpeg
Content-Length: 30153
Accept-Ranges: bytes
X-Varnish: 1108941155 1107966858
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d..................................................................................................................................................................................................................................................!.1".A..Q2#aB.q.3$..RbC4%...r..&........................!1..AQa.q..."......2.BR..br.......#3..Cs$Td%&.c..4t5............?....}...~P.............pj.^jq...Qt..B.1.R.....4L>._#f.......z.....36.8...8..E(I...:/Y..z....W..g....h.'.@..;.7..WT=.]...QY...9].;v..0....|.c...............9..p....~L....\...xP..Z.qw.."...&..MG.W..f.Vp...w.....d.t..-..#oE....]..!.....Mc}.RHh..}.y7m-SB.>..z...U.$....o..9...1......X...&9..d#....w.l.^u.9o.s....R....U.~..C~.V?.8....O.D...G5.9....Ja........c........U...c ..wy{.....m...zWs-@..?..W.5...2...6...^...1.....T.|.zo5..-.y.m.Q.M...}A..Hy..d.^.M.H.^......E.M...j ..66...^Rh....[Kq.hE.H.RC...&...ut]5#y.......Z..v..~}...`-..J..p.C).................G..jZ..wm8..P./.9....,.<..T.!.Y...}.S...@.......v^. ..l^{i.|..."...u.m..r...2........VT "t.,..D........EuKM&.S........X....q6....2Zd...wkm!.wR..@..zd|[....K$..\^.b.-...f4?=.pk......PrG.v_zPfa9..Y.V.Q...Cf.vI@...V'..MG.V.0*hE.7.....s.l.F..K.i...i.BWy.}..>....U.O.N=..C.......4.U....mk/*M..);.....k..'...m.V.a.Bn,........{..>,l..I=.jFA.9<..<.?!.... L....3jV.]<..q.;^7]...V.r3h...U...bsZ.!.A...t.]..>....].*.&o.......q.V-.M.Z....re................ ....zz..0Ck.m.\.60.I%1....&w...G..,.yS...Xq~-.Y).5...1...5..#7..q.x\....../E~.XKp#......T........R.
<<
<<< skipped >>>
GET /free/frg/products/608450/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 13 May 2009 07:03:16 GMT
Content-Type: image/jpeg
Content-Length: 26064
Accept-Ranges: bytes
X-Varnish: 1111897183 1110386755
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......P.....&Adobe.d...................-...E8..e............................................................................................................................................................................................................................................!. ..01"#$A2..@354.......................!..1.AQa"2q...B#....Rb3$....r..C....ST.c 4D......................!.. 1A0Q".@.aq....2....#`Br....................!1AQaq....... ...0@................................D.bK.eX.U...:..H[z..k......h..mM.8......M..U..1ur_....N...q ...j$.x....Y...Ct.c.u.."F..1.O.Q.......l@...f...(....9..Y.f.=J.......$X..Xt.....YN..*.@.0...#......U....EJOE...c.T.4 ....4.k...x.H..Od.f.C.$z.6..R.9.......^.e.{*Y..2.._....<.5..5.hn.q{"....X.D...p p.N.\.o.?..V.....\u.6...g].^.....kg.d..A..5.n..9.c..=.A...uX.)....b..d:..y.Y..._.........z......P@D/..S.`..f....W.O...vr..co.]#..k..&...6qo..T...X....R....e.tR.$..6..T... v<m...vH.".NX.s.-S>.....K..to6.g.P.vi..H..c.O.>gi...c0G.....(....|..A.....{~u..... f.;X..w..=..e.....E..F.j.R.......M...c}-Z......\......Y..m....R..OsFK...............mM..d..s..].]=..............W'..T.#2.1Ku...>....j..cw9.&.CR{...P.-^.;]..E..Z..S.N..t.X....J..cdO.r..J..d.)}@r...x&J.T...^..leHP..Z..@=>X..Lu...I......1P@@T...S..t.....BA.B.7"........../...l} ;eda5".EH...l.....u..M:3.-...8<!......d....]).k.....Cc.f.*U-#e.... .Cu1.gHWw,tnjT..C...S...?..T{IsZ...&....j....l)6...ad[...,....=.N.]..5./)z..7F>.P...r..... .:.....a.......U.j..^Gyc<..]{$...9.L%.{..-...b.
<<
<<< skipped >>>
GET /free/frg/products/631850/boxshot.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: img.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Wed, 15 Jul 2009 11:11:31 GMT
Content-Type: image/jpeg
Content-Length: 23693
Accept-Ranges: bytes
X-Varnish: 1111897182 1110402691
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d.........................................................................................................................................................................................................................................................!1.#$.3C..AQa..."R4q..2bScDT%....Bd...s.5EU&....t..6eu..'..............................!1Q.#Aa.3$..q....CS.4...cs....DT%..d5."..t.62B..&...Uu...............?..<........k..c.E.6@#on].3.....( .._O.....&..5B..^sYQ.......?>..." .....8q[|.....c..C.~.....2....../N..1.}.....0].D.M....d..~.Z./........".....w..$..I............8.5..D8...N8..1..>.V .=...d..%..X.1_.......\*..<b....i>......A...]...^!U..~y..dS&F.d..........>f.....j.Ei...g.....,..<.y.......z...g.E....8..PUX#,...ws...JQ!."..B.ZJ.m..F.t...l*a...j.f.._. ......_......>..\8.O....5Ys$.o..y......&t'.z...).|....i....z9..M....3LK..!..>......"O......Q.5.*..;....)..C.:..4.V.^`..W..P..0.</...)i........E~}...#l}.|...]......R)r.tY.../F;)9f..6......6g.....<J...9.q...C.n...5..`.0....8>.c..yCve...8o>}TJ..KT/.PB.,.4..2o...}:.&.~..p.{._.B..&..........=.UF.3..7.~.."W.2.C..L&....C.."IvwqQ..%.iz...{r{......0.........)........r...z...6j....U.F........h.....`..............{.J....:...I.....b4.....3.M..p........{".TI...r6..kf.`.n....o,3....m(]n9:M.s.|..J.\...z...X...EP.{..d......S;....7...<.4>.#.@......< ...U.......R...kA....F......Mm...]...-....7.5qn....'c...&.o....}['s.G..........<...U...5...O..a5.....")..^..j...C..kP3.....[)..6V..]..Op)..
<<
<<< skipped >>>
GET /js/plusone.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: apis.google.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript; charset=utf-8
X-UA-Compatible: IE=edge, chrome=1
Timing-Allow-Origin: *
ETag: "418518750ca35248ccdccce02192455e"
Expires: Fri, 01 Aug 2014 15:05:19 GMT
Date: Fri, 01 Aug 2014 15:05:19 GMT
Cache-Control: private, max-age=1800
Content-Encoding: gzip
Transfer-Encoding: chunked
Set-Cookie: NID=67=VAwxPeEWnf-V572H3NDhiALl0goy6niXxd0X8aMQOSMmv8znUA6vWNcHu3mNN_oKf9zeHEjjr2xL9e77yJGxH62Tk0ph6xiK-6jNDi6arNC357sOEXOSJ6HVXTyHx-Ne;Domain=.google.com;Path=/;Expires=Sat, 31-Jan-2015 15:05:19 GMT;HttpOnly
P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Alternate-Protocol: 80:quic
1298.............Ziw.F..._!a2..b!e;..Btl-../.$.I(...h..@.."......n...<..93.,5z....}... .m.X...a.'..z{:..u.a........ .n.#Q..c.....y.&.n.]A...1O|...x?..I,...UB.K...F..........2.F......F!z.WK.<...W D..g...xT....}J.X......<p...c....oG.g...1wI.....\.b.^.-R....G.9..Ln.e.(.x....K?.S>3.%Y...&.N.{n....A.....^.i.C]~b..2...uU.j.L.*.......i.R{}..WI.o.L.{...6...4..f~. .].hx......]1....?.k.b]..3...I.....k.F...M....D..(2."......*m.0.!.....b3..{.....F3.f.t.q.Xu...Oy..?...=..M.X3[U3..i.....Tv...L.M..?..41<......I3.{*F.7.........S.2>.....h.....AA..5.....{....P....-n....S.n.F.M....z;}c....^..-.`..j.[y..w.....c....]..#'c...... Ol.N..L.l.f.........@.vy7.J.^@.....hP.v.K%^(..L..I%^).R......yE.Q.#....G.....C.#Ao.],u.Wv...!....T$.-...&v|.tO~....=I^...%c.9..V...S......Nk..94...b.g......B...i.B..\.$... .V.=...l.X..kB\.C..^-.V3..&s......4...u..vFXR.Y _f...q.bo....|Er.d...a....s.o.a\hM..i.-..:.....g.......L.k`...4K..\b.,.{..d..PLl....o(Gr..]-.......1q...#L.<.q7........y`..`.le..c2R.....GP.i.....o.u..5.Ns4..hM...@..p.......1....{..qpa..F.[..il1pa..ls.OC.h..........0C.]..2..%....H._.r... ..=......}3r.W.. ..`.j.....@i....K....T.5...no..F....H.%g{...6W.\F........V43?o...).i...n.*-..X...r...%..s.c...bs.x.....y.u..`.i*(.sg..l...X.c..>Z}.....i.....S.D.C8u.e....i...gS...h..d.............d6....L|........U.';5.{R<7...Bc3].nh..xn..e......d..T6.2.&...U<..#.mHP..8q.dyr.'.A ...>..h.$N...P.l\al".i1q.[.a...d...../v...Xv..e,s,r..P.9.ts.1[..*.H..].E@QH........._.A..;....]w.u.....H.l..(a.p..........8y7.......=..(u.@4z...-...b
<<
<<< skipped >>>
GET /static/marketing/main/img/hover_elements_sheet.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 29426
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:23 GMT
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
.PNG........IHDR.......A.....'.V.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<
<<< skipped >>>
HEAD /check.jsp HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: Apache
Pragma: no-cache
Content-Length: 32
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=ISO-8859-1
Cache-Control: no-cache
Date: Fri, 01 Aug 2014 15:04:07 GMT
Connection: keep-alive
GET /my_games?gameId=595450 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 15999
Date: Fri, 01 Aug 2014 15:05:12 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........}.v.8..o.9.....H..Z.or..%..l..L.};}y(...P......>...}..$...I..%9v:VF..M.@U..Z............=..........{.....1V.._......c....Wd..l....#7v......7.1.q<.m4nnn.7k. .5....j...AD.N.....~=...r....~P.#.6..E.......n.....p.(.....x. v.......I{.!.2.5.m.....C.0.Y9.n|/....)%=....;..K....Sx;w.J^..J..G:..B'.H(...2...... ...\..~............/OW. .:.A'.e*\...j..x^pS.M.]h.....P*.E.k...y.........d.vH}.2..}..._Z......0..4..m.......KDVZM..lnmmn.n.mVH.@_p84]G....n....5w6...`...JR..,.-....7[F.......7SF}.......A.. X..k..]...bF.._...`...G.yxs.1.z}..-.....v.....{..V?.....A.. ..<..b..-.]=9=<9...l..non...nm..l....^...........%MMG.'.0)4.7M..... ..k $.o_...i.FF....g..0.i..5/.-..R....._.^...._.6.T..G.<yslr`.4.1.a.%;.....n..,..HI......L..7xi.1.7.K.......;VR..`_.......W.D..6..8...1...G...Z....u .:........!5.Q0.mx......~.=.N.A.j.m..R....F}.....@R....{..G...(a...a))_.....p\..5.....=/.X..5....1.......o...>..1..o.B...;..oG.....=h.oF....A.."k..G.~C..... j....H....k.o.).0...``...k...oO G..K..p}..9.E....,!3.....6v5b9.}76...[[k.-....5[-.2;...\..].C;t.:.....f...?.Ck|......n...(X..~....?...^.9...A..M.1.V......J.Oz.#..GQ..9..d..8 ./.Z...g.n...\.....N;..0g.!8.U.G..#....v.5.C.c...}h......].0._.......h..:.D.....-I.o........../.6.^.......<.z..~.z..*...GQo.v.......4)...\..o/....z......6....h.B.H=.z$....5..EZ........_....J.w.GQ....]......o.6[kfs.l.'|...rnC...-...K........Q.*...*..BR%.w..s4...~..R.........e".......o..ud4i..Dd../ip...e.RI.!..(U.]K.h......Q......*Q..BZ9..7.87..s.*........Z.\.2.\.yP...._........<...n.~.S........:.p..;.
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:12 GMT
Date: Fri, 01 Aug 2014 15:05:12 GMT
Content-Length: 5435
Connection: keep-alive
...........<ks.8...j.....J.L..L.F....8u...)..\..TA$h..H-..u.............J.".4..~.......p-.|5.........G7I/..Y.?w/3n.|o..w..........T....o...c...x,.....~<.*.........[q|"..........|z$......'...Gq...?l.S.z.q..2.f..l.f.K|%.ERD.. ...0.....T._..d.Tq..._.k.yi..]/M. ...^.......{!...7.......x...;;9.p..W........X.~|....=..N.?........b.......Z|<;9..mL(.#%.T.\eB..(..H .D2.T^.S.s.w._.|.......MD.....6.M..X.4S..x.9m.....5.).Iz*..l..a../j...x#~......._d....|5H&..i*7...2C10...0.a.......|!sX8....DX$k....."....L....Tw.`..t0"p..........b..H..5kM..ei.;.l.<D).G%...........f..,`....T.$.....$Y.9|...\..b.FQ?8.6.z...!0L....J.^..i8..p).b9.~.....zf.B.;... L6.s.@.%.E?.H].....\...[...g.;.,..x..^9...i1a.{.X...#.^......7..D.%L.../<.J.G"z.&K|...../..W..E..=)bX.0 4...#...U...@.<....."...H#..U....)..|m0p)..8l....n....4.Q._j..M.p#S.KS....@\...3@...u%C#.Vm[.~cMa..>*.E.#....2EWW.VK.'P.f........R...,.B.k...Z.1.a.:I7..CV.=.....W7r...H.".-..-.....q........y.oV...|]*...e(n.e....qo#..cDz.....]......Z..DJf9Y.?...s..1..X........s.3x...Uw...iW@!.....>{.....J..!|~&.]....L.......:>...o...0.....=......if:C................._....A..WM..M.2..r.!.XU.fm8K....p..........AZw.........U..4...I.x.H...3...G....7tcC.U....j{....!S..^.v....../*|...6...o...@.hM..s@ .vA4.a.>7.-S....[.....u....bi'......y..\<..V..5.QH^J....x.G.oo...;{q..&dxH....V...d0~Ai ....h.l..B...."..=..<..{?MV ....4;.......6#1.(...,K..,)e.3,.~...L1 .=.....g..b.f...F...^l.y.W...'./.....A....!.............l......_.6&D...!..kyi..^k....*.h.......d....`.P...>.........[. $.
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 3350
Date: Fri, 01 Aug 2014 15:05:12 GMT
Connection: keep-alive
Vary: Accept-Encoding
............io.F....?L.FDA.%.......h..0l.E.I...I.S...b........P..]`w..".=o.5.>........dCv....0..i....yY.l...<.K.g..e.~......,....!.....`..b../.X...{.qq.{.......,..Y...V....T<..s..D.....z^U<.O..<......C.sR..~...9vx..<G.......... ....?A.K.sX.|x...9qx.O..,_.'..T...`.C..V. ..4.(/...) 2{.Ky....!<....P....N..h...Z...|.F1...R|.@..K<i;..^........JN...oyq.I...B..jPc1.Y.o....R.ky.7.........< ...4..{..D/.:x......P.P.WO...h...e..Q,5Ob.25 .xT.7".....Y.O.1.U.1B.ES.............N.K....4.AG.C.........?.6..._...^S..5Kx....../...Z....4W%....).S.j.<.'.e.E..E....b....%F.g.~9......g.....,|....'y)!2....4em.R.[.oRNS.;..L.....m..l>}?..r...G....>.q.I.j..K...Z.63.7X/..#0...F.."...J.J.a..?qT...r..Ry}.Fb.!K.(y=. .M{`....7..q.G.....]..4.... .E.C.....P...\X.E.OQ..H....Ws}..H..E...2ghg.5Q...'}o*..H......@..(-!;.A..L..hY.....,..;..y....../`o..6.I.Oe8G.v!-.y.......Y..g..LmQ..W^^.).....8....5........YeT.y...3....I.(..Y...^.#.'~........[Bb..}....F.$,.,....e........_K..C......O..._....\.V.z.w_.PQ...N.O..z._{7\b.iK.j..9..l.C.PQ..=.d....E..O.........E....G;....2...a.....B..U...V@S..H..)8.l.G....B...^.".r....,o..D.......A...5W.......]...;?=8;~w.{.,.Z.z..P....}v..b.T4.L=...T{Cu%.f3.%.....lsS...t[#.4F....$.Z......:.iX2..L.F.^t....N..F.)u.-.k..(b.... 5GyLq.,..j..3..e.T?M..5S.l....X........q...L..{.(...@.....I....:.....ya....zXAo.Qr..l.{...%{..d{.y...A........"...nW..v.9.2....z...:.C........'.lmX....t.{.*tES......%/ja..{...e.%J.......).:....~...HBsd...Y*J.........B..=D.......IT...YU@.....3d.}.;.._y.d.,.7<....w...J..
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 33690
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:13 GMT
Date: Fri, 01 Aug 2014 15:05:13 GMT
Connection: keep-alive
Vary: Accept-Encoding
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[..r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG...{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U..44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP......<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.lw.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. z......\...:\.%.p...AB{..@.u......9..fC.{?..d.[..dC....h...!X.V.w.[Q.....:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....iAJZ.{...?.f.......@.JG.}0.........^......&..5.....`.F.Y....<...........@..@..-....1.Dg..`......V....78M.X yM.b.x(u....Q..f.l...f....E....3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D...S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....<...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....tUD..V.h2..........].Y4.N5........7j.}...3. .@gN0I8n.M..}n4Pz..5.....h>...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 436
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:13 GMT
Date: Fri, 01 Aug 2014 15:05:13 GMT
Connection: keep-alive
Vary: Accept-Encoding
..........uSMo.0.=;R...r...M.=m6..............d...6....].Q9......<.Q.U..`s..^q.NU.....,..Eg34..0<..5l[.t...f/......~..&..Gm.aA...s.-.D..B%..gO.wc..\...)..(.....m...cR"..\..c...`.,G..a,.C.*.....To ."..I....s..0.....K......n..!.q0\....8;./..].Vd..\..niAw.~.Z....N~..b..I...b.Xm........U.....2...,.S...T..R.C"....w....X./.F.iB....F...(c1J.'l..5.N,z!.wO......M?.H.C...........%j.X...HD...\....EO......1t.& ......ML2.L#....y..Th._.>..K..........
GET /system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:13 GMT
Date: Fri, 01 Aug 2014 15:05:13 GMT
Content-Length: 4815
Connection: keep-alive
............ks.F... .............7I...9.:.N'..Y. .1E*$e......}S.,%m.........X.......5...DT..P.f......4g..d.....=.].u...i.WC6......h..*..s...~..x=.9.........q%.*.....tCv......?/.^.d......D.....=....#.?.c.H......g.],..~..H#eO.....@...N..}.ds~...f.J...b.4.L..aU.....Y...`....2.I.(~U(.Q.......M\8.k"X.~.Z.....r..$P.........G@,....w*V.....m..._.-c>..3.b .>-......*.:.....I....,IZ.e:Z...4e._..X..:..f..........p.r...W?.a.\...........O......o._]..........W/"&.M...[.H?..".E.....#....W.1N'....O.|*....e..a.Q....Y.y.`..yZsR..M.2..p..I?.....{..$....3f.X......f..g.f.P,.....J.]Q......f...X.."OB..C...b...EN.a^).e.........t..../.".4..[..o.1QF.q7..e)4.....b|.2q 2Dt..q....cg.a...z.x.fI)`......08M.[6.xU..H..U..........[."...9 .E.xOS......D8C..E..L...T.o"T`.4......../8..g".....?....j^".b..z.....L...........$....N..}...acB)....0`A.........o...Z..&......~.r.j..T...D....../........)....H".AMo........EQ.R..0Pc.1...}.q:@p0.o............-.......B.!..d`;s....p:..M.r...cJs....p..F.M.[....\....o....r........%.2QK.5.S..79xJ8z.=....{.|...g.'.Mqb..y...5...5..=mb...$.P......p....q.P.(..XV..: ...A.....>...-..u8P.(s5.Y%.~.WR.9......j6...Q...Fy.$Q._H.b_}......@.k........~.....j]~.....*0.`y.yf..1... ...zDr.p.\.FE[F....A.iRp'..)...}R.s...a..tF...'0.je.....0IK=...,.........>....>..S.5.,.......)g.,..O]..SP..($...d|!.9`.z...,..Q....JT../..a....Q)...'Z..g..Q.h..D......y.....=:...........Z...<&.A..O.3..3$l\.'g_J...p..>.\..qb.t.../xY.....f.kKi.16.u).().B..m5..a.-..4.l7..q`....F....S......`V..D.`....o..e......PC."8..R....:...HC...@.i....6
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 1417
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:14 GMT
Date: Fri, 01 Aug 2014 15:05:14 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........WMo.6.....P...5#..z.e.(..m...h.KQ..E.thJ.(;.W..CR.%....:@l...7o.3.......%.O._<g.c..`/........i...r.?y...V.fy!R...i0.^_}.4.{............i..\.l>..,Y.4.6.~...\_.s&$.....=."..H.)..4.|.....T...}..,...L.nq|>D..P.E.....S....)E.z.6..._}x,U..B.......U.$...irJ.be...`....s.%U...._....MU)...';R....'I....'..A...|.....Z.....Q3........Rbk3.zxQ....U..-..b.....PW9...,XX...6....!."^.L....`.e.@..l...;z.....#..d*......q.KVU..L.3.&...9.-.|...7Ya.0.....d.3...._.NC$VE...FFEq.>m1Z..~...i.."z.....J..#h....q...$'.u.m.....i..H..1.F..tR.|9.q......*Kz`>..!...iai..U..".V..{....7e...." DQ..e.&....W..d..9..-.l.\..<..gAQ4z#...-_..Q....c....K.C..Y...k.C...y.u9.k58.T..4.C.?..........9......M.d.|..k....]..vf.....y..#O%[....b.(..1u....W..t.p...vV::...r..go....J5|C.p._..B.1T'.r.......(....! .....~@.#.~~.=n3......j8.f]].../...^Y....?....BKf.y.6..{....O.._."...6......A."./@..A... ..iz....X.....A..6....?D..cn....L..8R.ds.(.....v.U..A.....)p1Amkn..Sg..w5;.R.K\5....bQd2:!.#l..u%....R.j.. r. p.].Q.....j..|Av.8.f...gI..K..\.f...g".p.'.@.........)..pj...n.N.%.s..-.5plEw5'o...{Z.o..{.S.};...v...gw....nO...\....j.{Z..g2E..........l...w7..*V....*. .J.1.@..%M.f.\.....P.=?;*........03.U7.C5.9.>m.......ye1...l...8x".#..Y{.W.:.'.Q.....G."..f.w..X.).i.E.35Z~ZL...].....NtI..%..{..kN..M.{.Z........N..ba..$D...,...n.#J...1..ih'.z..u...=p.L}.4..2Ms....fxr.!M.:1.H6...a...o....tC..Y.....y....p..E.^..p.Q..#(...]...Mk..Y..[Y.....'}..8....Y#Q.......
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 2559
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:14 GMT
Date: Fri, 01 Aug 2014 15:05:14 GMT
Connection: keep-alive
Vary: Accept-Encoding
............iO.H.s.......I.KJ.:.az....h:...j5.Q.......6...{..WH`....\.....go|...[^.|e...v.........ly....o..?n...>|a........_..~....n...?.X\2_...07..A..*..`.p.U!..B.FS....&....*Vb.r.pSQ...,.by!.".J...$.............._w.\..J...^x...t...v.hf.*..........D......RL.........@....UU..J......@.5.....:...5.d..6........@ Y.'..@]7I....,..;.3.Y..B.]3 .*..X.Y kE.....A..} ......"...gb..6b....N.L.n f.v.9..m.D..#.efT..Y.):?v"."..L..ZM./...d.s.$[......I.......[.l.*.c...B|.yqt...7..Z9p.{.9.........w...".....d~4R..f.q.yR".h........Cf./.6Q.D...`..0N.......dC,..........M....fq.V...G..o....'.f.a.FjQ...1.f...Hf.;.e.?..."\.qPE.Q.x...<X.}jk9g(..fl....D...b..U..X...7.....D...<...F....=...J!..... >&..L#...5g.`$.,..T..@/.h......b.e....[.....Y...9}.9. .K4..[.wC.T...!.?i.'T....</.j..y.W.@.5.(|ZN....7...WQ..f........;9....YZ.GfT.y.DNS....y.`M.6. ..$#U...:C.....gJ......)..D8..r#....O.[,.T.Ue.....r.i.M..R..J.;K[...W.P.R..#.I%..Eq...1....oa..13\....].T........sVG}.iu..&.r.j.9.......".{;.7...)...~......Q.U%....U...i.h.}..{...%.9Z.xz.y.B..Z.......N..'....Tc:..H.o...Kk.M..&..=.I..fjO............H[.94.F1...qh?M.....&g=pE..B.=..U.E.(}d... ...u..^...k.v....6/..c.5.....L.......["....j^??...s.....1...*/#3...H.,|..v.bJ.."..dCD7.....'.y.xn.0.J..aq....E .~29a........w...{CK."\...\..o.?]WU...k%.j...n...7?.y....w/|...c.... ".\.j.28z....Oe...Gn..<.'F.=X... .q......8...K.....`....b...X...q.b..b.?..#....}P^(.......a.6Nh.. .....ALQ...j}..)..m@.....^.........1..".%.p.....[....0..h....]1.....B/.;..A....f....f.0..L.>..$......8_.h..SJ.P....=...v.
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Content-Encoding: gzip
Content-Length: 1037
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:14 GMT
Date: Fri, 01 Aug 2014 15:05:14 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........V]o.H.}&R....V.S.J}"...S..8X...jeQ<v......Z........6i..JE6.s..9...#v1C~.24@....f.._P$.}J.F..3.>^.....K..)%...........;.@.O.\O|4....Q$..>...6..cZ?.qB.[LVx5..8....Yr7,....C..,C...w......P.q0..i.......<..@.H.L.....a.RB.S.8..$.....pr.A.6N..$1..F,z..E.p..\r.0%....... .=..`..Z,...N...(..L....F.s&7..E..0...X6%....X.........X..<...K ).^.^.|..4w.6BY.|.U\..%Q..^...0F....[DV.........%....6W..S..m:..<3r.un..*..=.d..... .CX.X..so^D....^.c.\..4_.y...U..:h...._.....*.u{i..N....V.G...v....../..Fm...QE..L.Q......)....f.ej.p3e...zU.j\..T.jtE..$.|...!#..x..:s....ld1.T..&q.......=~S...........B....U..h.l.d...%...Qx.vy...q7/XJ6.zo....d....9%j^....%[.T....A..-v....=@..T........z3@..2...F.X.$(\U-R...p..'..J|...zZ......n"jK..i..l.u.IZ...R./.;.Uh.X...$&..(.......2....b......"......8...V.C.l.0i>..aY...a~.LSr.......~U.. .gR3d.k....w.......a.S]..y...$...X.F..s._....G.J.N...y....5.#.6.H;'E.i.....=.p[ .\.,.5..j.....W..........I........l.V.......w..?.&.....}.@.....c...J!.S=q.=......|h.j......>...^..........i....]......?.k~. ..J..K...../H........
GET /system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 2522
Date: Fri, 01 Aug 2014 15:05:15 GMT
Connection: keep-alive
Vary: Accept-Encoding
............ks.H.3....s{F.....-..E..K..> w.uu...`k#$V..}6....!......GH.=.=....o....V@.~.....9....y&.."........z...>.?....%.C......~..c.7....z...S......}:E.)ZK.Z.9.S....Cl....|o..)...g.........].*F.v.D...:C...............m..o4.....R..l.1.F...3...'...._.&....[..v...(.D...hL..A.........:.../......3#....t:.[..yy!.......$..2.$st.{...G@.S...3.}p..>..G.....b"F.TF....I-..^D..X.T...ZR...X.\r.C...;3...'.."CF...0....I......%...kfF...U.V..%E..............CM{..PC.zx.........j..<!..Sep....A..._...........F....rC*UC.....D.I...x....b.. N.6.\.,...}.*6F..........#u!CU3...p..|o...."%...G..........R....G....`.=..yt!E...X.3W"T..t...0..y.p...M.U7...l#).k..^6-...Rb.A...O.....F..h ..2. ..&R....[.~.r.YP..T...Gs.(~.i..;%!M...H.L;.b.Swl.|..*..@..K.)V.M.X"l....4...0y....N...1zri..ej.Z....K9mX._K.?.........h .E....3IX.UUj.~.....l......o=......i.....z=.2_@#K..*].*X..G.# ...N".U.'..:......C-h0.....B=.YM...d%K.g.7.9E..p..J.R&......-...Z.._..Y.6.J.t...0%...Y;..........2#.P..`.r.3...|s.y.G %r...R......>..f>..0.y.._.yi..<....<.9..ex..9.*.N"u..ae.>...!.....|.#..0.U......S..V...Q....c...."..0.a....b%....f/.....i..r5.$..>...........V.R{.`.....s../.z..<.'il.....Q.\%.z....|.ueB.....Q3Q_<.......g.eU*g.'....0.o.I..cLS.J.(.......}LP..Fw..v.w0u\...i....a....Z...5...*.9G`.L]j....LGK.[...|...N....{a...W.K..K.!M..".b.f..`c....wn.,%.^...<F...1......h.8...........j*.....T......6k....O.h..V.EG....U.-5%...vK>..y........a..$.g..Bi.....R.s.[.5...Q.....:}a>p#|.f<..&EQp..H[..`..\.M...Y.........h..Q.%~....l.oW..0q5...w
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:15 GMT
Date: Fri, 01 Aug 2014 15:05:15 GMT
Content-Length: 1228
Connection: keep-alive
...........W[o.6.~v...Sa@.F.....WOi..X..)......e3.I....E...o.-_.....X".......y...P.....*._WB|g4...5YR....8=.=.i.........C.....gU..^,.U..!V....!....B.z.(.%.zPX....g..... &..?I...1|.../......./..~..m......'.U.,>"?V6.^..j...... ......VD..a..Ud...z....bDOAT....Fy.....=`....c..I.5...........A...3=...I.k............,h...}..qK.&.....'a...=....qs...1D.)F.c=g.....cl.b.....X#...q...1'.....e..V.............0.....Q..q.X.TR....B......M..>&._E..........,.h.<.....p..z...H...R]...8..o..*...8.:.,r.[..j....`xK8..@.... .8.....kl@.IF..bKu:...U..Bc.X.4MV...ox9..VNcY.L..]q.oM.......v......F.z......t.....t...}....mLl.*...._g..7..{\.4U..n.2-..;.=CF.... .....N..O.~.*.D.....F..'....V./_..W.Ss{..J,Of.Z:..D.m.j...%R%Y..\..KI6.g.j.........(..G.u..Ri2..L P Z..a.3..}.......t..k.4~..*..U8..........Lt..83....z.....O|/5M.....M.,./..m..v...fq...]Y3.J.$.g0.h...C[u8.?.M}....f..T."6.M.3.77m6..X...Lc.Jc.....5.WD...d.........F.V..6.?p.......C.......S)..}.3..../6..Z`P....\.Q.....-..n(A.....h4......em.Gj)...snr}..i.D_...._.N.m.[.........v...3p.`..}6..@...b..}F....~..\E....}..n...V....".B[@<9I.$..... ....-.*!m ...L.Xj....30.|..'.....'N..fN....6IW.....x..p@.I..{x..v...^..`/..E.\.Z7j...[wj..:8m,.{.@4).'.........r'j......u. ..o...<.UFS.|...y`S..b<`v........
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:15 GMT
Date: Fri, 01 Aug 2014 15:05:15 GMT
Content-Length: 3944
Connection: keep-alive
.............w.8..........I.nw...%i..[..I.6.{O.......4%..oF.?!..]...h4..{....t......w....<h.N.d.i.....$.'>7.p.....8.........F.}.b.6....F2....U.... .9..je.s.....f.M..D..3/.U.s>...'...,j...."p./.4}../)...^.]bD.H4b\Rr9....[.. ..Sb.Y...Y.../J.|.G`.G..n.!..%.'......<:.b.. l.D..wq...LY0.... /p..qC..Y.x........$.. :f~...t0..!.....q.....83N.......xm.h.-.....1...y8n........<.;ww..fs.\|rw.&...W1..M...L.lJ.s...x..3... ....5..an..d.F.....>j...f..D..Ni.... ..9%.b$0.....[/).Gs.. .....8..p.....D.nk.nK.6.S?..'...y.Ot.#.i....^...M.`...C..h....7../.f....e.......H_..2.ty.D..e......)(.......Y.......0y.F>w?........ZR!..5.U.p.../[....tu......T..<....i....,.d......-.]L.(.\t0.....v...f..).m!....^.Vg/M9\q]H..<.._rK. .O_'...~..|.. h.......s..<..".9..GK.. "".F.....<...$.i.......I:(.....5...M.....4...L......'.(X..v.3............X..J.q.....4...-.=.z.g...kI&......H...........s.'......P\.mw.......eox..c.@...k:.`..^....\.l...yq.....m.5...w....B..K..B......f...V....9SAA.jT...Ua....X4..96.....].D*....$..k.J.m.m.< .|..../.(.}..|..]....1O......Cm_.LGQ...x.q...w...n..W..%...Y....cm...u....mwG.......A......].T#............cv..Y........|...2qK.~6}.L.i.".. ..u.C.k.Z.....".........`B.......Z%...P..l..M0H..@.;......f.}B.e..4<....D-..@..!d.$2_.h6...J......HA0..S...6..q...d.}S...-.....UY.....e&h.q.D.h......4. ........l_...P....~9....=G........3... ,db..a..M.~.h...M... '.2.y..y.T.d9....5.E'/`... .....!..'...m8`....].:9....s.*........Xe\......j.%p.w...:`ub{.d.J.$!.."..c...PD........V.m.[(d.:#.T...k....g#dM.g...,..1...
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:16 GMT
Date: Fri, 01 Aug 2014 15:05:16 GMT
Content-Length: 580
Connection: keep-alive
...........U.n.0..i.....(@..t.:....h..]..`....&....H..%E..m..:..{.xw.....Z...........#m:].4.....\.....g._J:...y..]..7`...I.eG.....4.? #`e....|..Y..<..V...p.b....R.r....k....;6......eW...O..`yNC..........0#..._.9.....]../W......y(.2.., v.:X....ggt.p.@..Q....C?.V.@,..&.t;.u.eT3...|..;.....v.F....DQ"..D..u..}\.ew.".-`g.XU.a.i.3.......{..s...:..N...`..h..4R...?..s....Nav..i..,x@R.i.JM8.....DR...K7..I.Ff......r.Zc.......K.Sk....7..sE.|o.y..i...,......J.{_....;...va.....K..t.|.W....t.A.|u./l. /....:...g.TT......E).be.;....... u.....S.....'P5..JE'......u..pq.7..c...N>......rp[o.......
GET /system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:16 GMT
Date: Fri, 01 Aug 2014 15:05:16 GMT
Content-Length: 1394
Connection: keep-alive
...........Vmo.H..L...9..v.Lr.OP...E.W.%..S.E.{...uw.&.........^....y..y..i.y...o@?.,.0IR..~]&..H.9.2...1...p.k.0.S...3.O.-IS.,.*.U..#...f.;.lA.L....../..-.d.~.i..........%O..'........2M..{F...<.Q.{....;...G..?.t6:}8.....p.k..=%.>..{....h.xb....).:....fp.......?..=..]...=.O...X>n...cvs..Q%.L6U......g..x..?.^...%..-R....,.1!3..e.X..gB..2.....*{..J.J............2...!eS_..........CL...}.QC....u....z.o]$.-.$.hX.D....?.>.o.G....Z..|x}3~.p}.76....[."9qm.n.z...................-..J....I..ZY.,......7e.|....M.q..........@.0._..(,.!(..,............JUY."O..7..F:a........;...4...~.....'.....%.Du..K..$.....o....b..ZiT.9n9.J.o$]..;....U(.....,...z.~.G.~....%...*...h..|j.T...d7&v..W`.m...v6....w.....PC^..l.b.;.........BG..h6..)Q...A.8I.t..s...e.#7...f.....|J$1.(cI....mW..7lW........N.r.g4.......]Q..!.-Z......[:.kjKP.m..t...[...MA..b.l5*.}..f,.k...~.E(K...b.....E........u....?Pn.B2'/...H..^.-%........1...v..W9.4..eyS/.W.U.W.#.....]Bi.t.*...z.....%9.c.-..$....._..O[..^.........b."|d.......%.<'.O..G#$Rr...'x.u.9..V.......N..C.DcSG.N....z.[.......u..bs.\Y[..)DB...8Ab' ..e,.^)%yN.x...@.[..h8..^`X.m......VD3.=..7........9.$X..p..&|..:.[...@_....v...mAq.... .....o...\D_....9.-MG.......Zv...e..2:..?.YZ.._&.....Q.}g.w...$...t.K..E'*......=(.Xo./6.&....'j....n.T.....G....,5t.i.%.~!.....|...%YR....x.....>..F.....!U....jt...^S.,].bzx...q.......QL..]......u./Z P..k.....\Pw.9..V....2.......J......W.......
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 4875
Date: Fri, 01 Aug 2014 15:05:16 GMT
Connection: keep-alive
Vary: Accept-Encoding
...........<ms....u3.../9Q'...K..-w..I=u.._.v.WC...'......>..... E.oj.>...E`.............KIp.{.....................qr..\.Q..a<..........g...#..W{1....m...........j.n..%.O....}:...;..CQ=dT..... ..3...."9..".Y..v... |f_.q.\.....Is.eS........L[...x#...N....98.....Z.q...2PJ.Wvk.{o....................G......dK..a.2....&..i......F.I.;...~.1....c..d.}.7..{t.;.t.(;.g4Y0s:d...#.zA.{.h...i.I.q-:.. .J]...'.yD..(..fns.....v.%.b..Y.h.../..J.7.~...eu.....<.......e..`.m.%Xb.pLl9.....3.r/.,.E.j...2.4..........{...M....K.)p..,b3..%..-.Gr.L.Z....:.m..%@...QcSJ.i.2.......qkh...Q...rm......^!T......b...4.{0....W/."..=....E.)k.NR......4.....#:Z.1P.......I....._..%.4x.&...;.&)... a.8.&.....0IC......=B......L&....<....x..NA...|..]..T.,.s......3.h.q..<nX..Q?....2....O.....!....7p.0.].=6u.Q..j<....V.;M.i...4bir.ms@~%.!V.j.&Wu.....CT..:....7...n....R.H...m.z&.]........].u.D.....>$.p;K\...?...S...:.......o..~.....*c..K..jR.W..[q.U..T-{!N......h.Q.>zi..-..................."..=......nhH.3i`B..&...>rk`.....X...=M..'....2.i........|V[..&.s..4Tp#.mn...7...1NGo.&.k....D.....$.....S..R.L...?..^G.<..l......))..%./X.U# f..}8:.X...6..F0.D........h..)W......E..z.7..%...i..S.0.#..P.4..%......(......@z..OF....5.92...C....MbzI..d.......{.....&V.c)9Qk9f..2.._"cd.e.Y$..J.7(a...0..W.vddD......7.H.E.. #:.f$..q..<hM@.........ol..5..X... !..\z...i..Hk.AoJ.3.-.b3j..c...kuie<l'.. ..#^..d...~.........^.....v..P{i..~...._c.my1p.....6D.....X.....AY.i9.....N....g.2}Rw...E!Zw.A.ZaLmV.m..#...MO-....N @.ME-.x.~D.T../..,.s...
<<
<<< skipped >>>
GET /static/marketing/main/css/main.css?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:16 GMT
Date: Fri, 01 Aug 2014 15:05:16 GMT
Content-Length: 2803
Connection: keep-alive
...........Zmo.6.....b."M..._...z..mw..n...h..@[...,........_%R")....a...p...P|.7Y..`..?.h...DEoQ..7.[.o.7h.>.z.,.%..5B..{.>.<D1...,..J......).S...(p!i..OG|<...z...Wp ...>..{.L.._.../..x..x7.g...~.....G.m........3......S.....?}..3....6.PZ...4._..-....wB..7....m.(.P...1..Cg..{p{J.K..o...,u.2."11i../.W.m.........'.W.r..........n|%.....n..x.......%~D.NbH..hm..@...P...&.[.. ..t...)..8..9}..&X.....\.a...a...{47.0`....).D_.7.@..j1..)...y=......Gpw.o....@._...`..Dp.?..Ml.2.Q.3.\g...U.l...Xl...#..i..3p:...'..P....}...&^:Y.x...o....<.&..7p.8...z}2....e......E.2..Y...zo....i2[....tF. .k7.I.....t......".a.=.......HHr..4|.\R6i..|V.1.@@.z.]...%.".!hy.....9.....q.L.G.j.15...LT{...p2..24.QDt..j..B.>..0..(..7[...<.....H\.`.U.@...Qe.....t.p...'.y.......a.^..#&&A...D....E.Cf$...T.r.r.#......l$Y..6..1...G[9...Mo.#...?30O.5..Y.._.#..{9ikVBU......9. ..E..1..o....`N.H.x.Q........-.&..Gm.....z.$.X...H..4.w...jP..75..z.K.;.k}..F....G.......-K.x#..(.`..H...M.b..UN.A....B..8e.5%.r ....W..../}............n..Ix.......*l..6......!I.Iz..*.`.2.&..'..$..Y<h-Kj.i.....,R.....;=..J=6..1xvw.......^.\8'.{[...iF....K.........&n..9L.........NU.d0.|...t..SU....2Ud...4.I...n..[./.......=PZ[c..a.>.0.P^cI.a..k....VCb...A.~.#{.@.... ..\.4....d.....(..Q..kena.c...h{.2R.PV..I........&...<H=Gqu(jA...(.:....u..u|7.l... V.Gm..|i3..S.J*.F,....i.=.6n..j.\m1..R"A ........1...u....X...........@.p.O....pt$...Q.....y.X....'.(1.N....%..........h....5uKk......Ph.7..XGBN.<v.<.<..D&.9?I...>.......}.kT<.k&l.m..c.@U[..',...
<<
<<< skipped >>>
GET /system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Content-Encoding: gzip
Content-Length: 336
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Connection: keep-alive
Vary: Accept-Encoding
..........}P.n.0.<..?X..(......AN.I,.odo ...k'.....}xfvfm..?.g..u.\../........f..>lYx.XSc...!?j......V......:.U..E.I..2.h:.}..H..Hbm....pm..C....V...Z...{.u`$..L..Y..;kE........tU.H_.....%../2{.!...i....NI ..@.N.$r.m.8h........p.......I.3Q.4(I.h&,.3...). O..3..(.p.........X.^'^"..Ji[....NI....AO\.]YQ.......$...(..Bi...)r..1.....2.........
GET /static/marketing/main/css/sprite_sheet.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 2713
Connection: keep-alive
............[..6....WP.<.......=......g...&...e<=S.. .0: k.v.&...GGG../.yO;...y^^.....Z.'............omW.K....s..^.............?..n.w9.o~.....r.........G..!..$e..u.....5...z.7....2m........E............./....~M..Ls..>:(.=q.;........V.o..>.........C.H..kQ.E...R._>{. ..Jq}=....>{.....]ux._ o......g....?JW..x~~)....=Is..}.T..~.[~{zH...1.O..hy........b|...;..xj_....."..-D..=1.9..#...%.,..<~.de.G..........4B....R...F``...H.....w.9...!.Q.p8k..p...w...T.6........c QqHz......5D..).T.V.p`.f.........6..|.q.y<|....e.1)rQ%.6r.Yi..R...d...`....e.....q.V.dm..().[{{..q..a..z...W........!p.%4...<1.]...@.{..x.....fm.b.R...W....\/.O...Qi..;>..Z../....$...`....p$X......O..d.m.Y...2B......%hp.44Ty...J...o.h..I......Z..TgRGk.?Q..]..V@.6...../.....8...LTh...K.tH.w...d..........v.]Ov.4.#..T..$.J.c....mH...........X/|..[.Cpk.[s.m.'.25.<6P..."...S....!.....H3.Cpe,.z..-x{s....W.@.p..P.@....f.........E....J._T..qC.......&...z`D13.1...H......Ka.J..n.*....(..-y..b.j.l.8........H..W>.]3....#..D..>.n.......b.3 .t...g......M..5l..........S...4..x....|C.?@&.......~...3%.Dm6...0.2}*u.X.o.Z.0.$..l........,P...K .... . ...,.o9/......q...N..hItdo ...'.....<....0.....2...J..$6..y.O.LW..V...3h[..PH..%...B...,..|F{...........-..;.GT.$6..!e.......lQ.....7.. zO..b3..c?X*0.....=...t...4.qB.Y0W..."'..Y.......# .G....L........*5.(^.`.].......I......J.x.D.A..=,L.Vsu..../j3...~..OP..&T. ...)K.Xl.W.,6U.....w...O. D..s.............A.N..C......Cp/.f.ox......j..V.d.>....EcW..r5...K....|.....*.A..*..F6....L.cr.]...i..
<<
<<< skipped >>>
GET /static/marketing/main/css/tinybox.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Content-Length: 459
Connection: keep-alive
...........SMo.0.=._a)..{....@...a.!V...f.v..}mCRh....,y><3..sb ...h...V.*......c.a....).....2&T["..#"/...o.P..%*0..EQb.R\....]..6q.oq..q.k..`\-....Wga.D.{....V..X..M..A..I.,....\.eI ...A.y..E.~..V..;,..`h[.z}..q.C4.v....\7...I0....Qs.2....M.K.....E{..U..".=...B.......Z.....m....:M..h....g...m@....,....k.a..x....o@.'~..-.mlN.9....qg[7Y........0....X....M[x1.c........2K.,..*.4..:..K4..A....P...O..8%.....*'$.FV.~...F21X.._.....".4... g..6..[.q.y....9.T.k.......
GET /static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/html;charset=UTF-8
Content-Encoding: gzip
Content-Length: 36195
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:17 GMT
Date: Fri, 01 Aug 2014 15:05:17 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............|T........L&3.I&.3.I2.!.$.8`.......1.J.1".H.R.,e)".......""......M...Z...K..H.RK...kY..d..y......b........s..{..s...s...?.=Za.F)La*.?Ua......~....-...........'. ..Y...9.m.^v.{....;..Vv7.,b....p&.M..o...g>....l(..m8.._................|.L..J.......n..6)..>.........]... ......o.......g.Vm..a_.-\]..?..._.............c..y.Gw}.!_.u...=.g..;..g^fW.y|....}.....y'ck.co...%....Y...3............1eh.........\..w.^6g.C.y.................=..j<_y....yPu.c.2b...=p....~;......w>8..C...!...3.....u..y....).......bo..O.eG.O-I....8H.z.3..X......2....=.W.s86...'...1L...9.......t.%..z..r...z....I.......}{&S\.......].V.).T...-....&.Ec...8....).>.?..7..'XZ-.._,....6.mN...o...C......n...?......g.d.b ...G9..2.2:2...f<..D.&.DGG........2..]....omJn.x_r.....7.o25.........'..o......oMn....|.......M.\.o\....KPH..'.1 ....`P.8.....F&.....,....N...O.d7.<v. bSq..L....W...*..X......I..x.l...O..g.._...x...9.......3?..q.OZ.X.p.E...:d...i.~s=......a..<.V.G...Oq.0..$V"&....D....*.G.`P....'X5.G.:..)...Kl`........oIla_...~...q...66......i.]l:....*...a.@.:......a.@.j......$x.<.6.M`...,....;.........^.... .w.AX.p....^..@7........._"|..kx...HTTP/1.1 200 OK..Server: Apache..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Type: text/html;charset=UTF-8..Content-Encoding: gzip..Content-Length: 36195..Cache-Control: max-age=86400..Expires: Sat, 02 Aug 2014 15:05:17 GMT..Date: Fri, 01 Aug 2014 15:05:17 GMT..Connection: keep-alive..Vary: Accept-Encoding...............|T........L&3.I&.3.I2.!.$.8`.......1.J
<<
<<< skipped >>>
GET /static/marketing/header/js/header.js HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Type: application/x-javascript;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:19 GMT
Date: Fri, 01 Aug 2014 15:05:19 GMT
Content-Length: 1812
Connection: keep-alive
...........Xms.F......x".`.~I:.r..:....L...0B...I.H'....w.N...1i....t..... .Cc..4..0..:..c...`<4..J.rhh...4..g....oi\$.V*@%<........x..x........^[.[gM....:...Ub^.OI.9.c... .... X..G<J#.N<~gH....Ibh>...N...MrD...wl*<.l......[8=6.F~..d?y...d..L.`.*....v,......h.G..<>._.Zgo.S.N...uy,]y..!..YH5......i:'.g..8!.!.g=.....W...ub......Q.......&.#D.&)D...(...".q..}....:!..>...:1...Xb.e>Zs*z>..........J>.\.....<....J,(..`I..T...Yn.?. .(.hW.er..@...V.".-.>.tL.S..D.-........%QJ.4wQ..2.I.S)..4.4.E5S...T.J.7..........v?...!...........6...~...8......r..%.x.*...Yn.P....b..P...bg..".M.K L....1.i.;qJ%-..Z:.9.......g.....;.........2O)...2q_mL...}.........4In...."..en....F....P.T.Zg.i..b..D...b....&.....(O.Q.)...g..:....B.tnRB7....M....:.l..5..fC..Y.bEJ...XL.V..0...<.%d.....6.}..]>....r...>....\..*sNo...I .a.`D......"..,..4..H(W...P.&.Z..dYC;.5GK..bU..ac...:.P..4..2)...X@$s.l..r. y..d..6Y{<}C.......sb.U........(E.C.........a.. ......T..j.Q...$B(0"8..F.G.*.|&.....'....[.}8.(i-F_......(r[>.....OPU. *..veg.N.OF.(..?.=t..F.A....d..wP....y.a!U.tE.[..a6.........A.S...T....YY..;...1.Vw.Uih...l.^T..&6Ys`....$.K....N..z.^.....ON@..>.#E.~.....G..]..xK'..$?0e.b....5....h,.Z.a.pT....GJK....6.d...M2.11P...m......x...R....`_.Y..s....\...<9r....G.UP...t..J.....fY...D5w.~Bs.].p..\n..v.3.....rQW...K..h.....!.e{..k......g.7..._j5T^.p.....7.9.k@.5... .a..W.......Y..i,..p............Lb..=!..F..,(.8...1.)..y.:.4u.S-.>.| .I`}..zc..DNxY ..P......h.QKX..R..|'Yl..R?....S.h... 3c..g.|...g...j
<<
<<< skipped >>>
GET /static/marketing/header/img/ui_elements.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 26274
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
.PNG........IHDR..............."T....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<
<<< skipped >>>
GET /static/marketing/header/img/icons.png HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 34162
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
.PNG........IHDR.......l......d.\....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F249C00A9951E111A7D697F015223A85" xmpMM:DocumentID="xmp.did:23E2C840532E11E197DDFBD349484D06" xmpMM:InstanceID="xmp.iid:23E2C83F532E11E197DDFBD349484D06" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B36963060153E111A7D697F015223A85" stRef:documentID="xmp.did:F249C00A9951E111A7D697F015223A85"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>p.......IDATx..].`....{wi.v..4. .......T.(]DQ..JS:XA)J.."E.). .B.-... .....K..7.../.$(........y.fg........i ./(B,...........$ ............K..........B,...........$ ............K..........B,...........$ ............K..........B,...........$ .............K.........B,...........$ .............K.........B,...........$ .............K.........B,...........$ .............K.........B,...........$ ............K.........B,...........$ ............K........
<<
<<< skipped >>>
GET /static/marketing/main/img/containers/green_left_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1219
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:20 GMT
Date: Fri, 01 Aug 2014 15:05:20 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8570556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F87F856F556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................W........................................................A...4t....................q2.............?..<.....P.......[.........
GET /static/marketing/main/img/containers/green_right_rib.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 1232
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F85E1ABB556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F85E1ABA556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................^..........................................................q..3....6...................1..2B.............?...%D @......U.0...#\...........
GET /static/marketing/footer/css/footer.css HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Content-Type: text/css;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:21 GMT
Date: Fri, 01 Aug 2014 15:05:21 GMT
Content-Length: 403
Connection: keep-alive
..........}R.N.0..=...1.D.....0KG/P..M.........C.@..q..IV!:..dq..5....K.h@..c.unz......x......b]...W.D8...C.k......K..UwY....2.....^M}O,......?Z.[.$j..I......FG....R....C.>C.........wa.._.oQ...w..rl....t.1W-.P..g..r.....:..l..F.......#1i...8'[..<.......\.B.n6..*.V.vi ?.....,=. ..X'}0 N..z.\q...].~I}0.. ..!,.]*.D..H5.....Q.....o...E...m.d...VI}...p..XC..b...`....q.c#.....a..l..&.j.SX..U......7...6........
GET /static/marketing/main/img/containers/labels.jpg HTTP/1.1
Accept: */*
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Connection: Keep-Alive
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
HTTP/1.1 200 OK
Server: Apache
Content-Length: 3454
Content-Type: image/jpeg;charset=UTF-8
Cache-Control: max-age=86400
Expires: Sat, 02 Aug 2014 15:05:22 GMT
Date: Fri, 01 Aug 2014 15:05:22 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:FABB056B558811E1B193BFB3C877D24E" xmpMM:DocumentID="xmp.did:FABB056C558811E1B193BFB3C877D24E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FABB0569558811E1B193BFB3C877D24E" stRef:documentID="xmp.did:FABB056A558811E1B193BFB3C877D24E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................c.0.............................................................................................!Q..1AaR.q.."2.#3C....u....Bb.S.t..5e67.........................!1AQ..a.q.."2Rb......Br.#CSs..$....34t%5...cT..............?...c..cA4.A..S....7.t.....F...#....L.0..ECF...v.`..Z....7.*...P...T?.^`..v}e.8.!...k..v..;.5..q....C.J_OW../r..1.Jk...m.I.............j.Zq....W..&.!...[ ....D....yvB^p..s. .....G.1h.v........}......2.{..n..N...K....$.a^.....J..C...;#.-..B5.....a..j
<<
<<< skipped >>>
POST /action/JSONService HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.freeridegames.com
Content-Length: 103
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0
{"service":"geoService","action":"searchGeo","domainObj":{"site":"frg_partners","lang":"en"},"data":""}
HTTP/1.1 200 OK
Server: Apache
Content-Length: 59
Content-Type: text/plain;charset=UTF-8
Date: Fri, 01 Aug 2014 15:05:23 GMT
Connection: keep-alive
{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}HTTP/1.1 200 OK..Server: Apache..Content-Length: 59..Content-Type: text/plain;charset=UTF-8..Date: Fri, 01 Aug 2014 15:05:23 GMT..Connection: keep-alive..{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}..
GET /freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css HTTP/1.1
Accept: */*
Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT
Content-Type: text/css
Accept-Ranges: bytes
X-Varnish: 1111625333 1111321627
Content-Encoding: gzip
Content-Length: 346
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
Vary: Accept-Encoding
.............n.0.E. ..HYS..I:..j.].?`.......W../...Q[../...... ~..w.u.^wJ..s,Y/L6h...I....u2.q<..s9m..F.Q..z,........AM...FqG...JVC.(.HUm ^oFe.&..$ ;Q.:2.$..S.7..R.bpo.&..P.4.'Y.....U*i.....W.d....j...F.?...B..a..i....1 .q.Ad...o.V....!&X^^7.}.-.....v...=5...r....&."|.#3]....Nt....$.Q......e.....vC.m;.]v..U4......8Y._............c....../C......HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT..Content-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1111625333 1111321627..Content-Encoding: gzip..Content-Length: 346..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding...............n.0.E. ..HYS..I:..j.].?`.......W../...Q[../...... ~..w.u.^wJ..s,Y/L6h...I....u2.q<..s9m..F.Q..z,........AM...FqG...JVC.(.HUm ^oFe.&..$ ;Q.:2.$..S.7..R.bpo.&..P.4.'Y.....U*i.....W.d....j...F.?...B..a..i....1 .q.Ad...o.V....!&X^^7.}.-.....v...=5...r....&."|.#3]....Nt....$.Q......e.....vC.m;.]v..U4......8Y._............c....../C..........
GET /freeride_marketing/SDM/SDM_standard/img/header.jpg HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:24 GMT
Content-Type: image/jpeg
Content-Length: 24975
Accept-Ranges: bytes
X-Varnish: 684596343 684455615
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:03 GMT
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:635F5D80FD3F11DF973A82E7643F8FE6" xmpMM:InstanceID="xmp.iid:635F5D7FFD3F11DF973A82E7643F8FE6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:94A0E3898D9311DF986DD6F6636C425C" stRef:documentID="xmp.did:94A0E38A8D9311DF986DD6F6636C425C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................d.|..............................................................................................!A.1..."...Qaq2.T.....B..#.U...Rbr.3Ss$DEV...4d..%.F.Cc..t.fvW....5u&6'7.......................!1Q..Aa...q."....2R....B.D..b...#3.r..C.S...c.$4E5............?..T...R.q..j3N).0.....mk.Vv0B .....`...v.-_(T.U{0......L.3.P.5?...j..
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/jpeg
Content-Length: 48259
Accept-Ranges: bytes
X-Varnish: 1111680765 1109735540
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:04 GMT
Date: Fri, 01 Aug 2014 15:04:04 GMT
Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|..............................................................................................!a.1.A".Q.q2#.t....B.F.....Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q...?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.
<<
<<< skipped >>>
GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif HTTP/1.1
Accept: */*
Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.exent.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT
Content-Type: image/gif
Content-Length: 79037
Accept-Ranges: bytes
X-Varnish: 1111680936 1111349232
Cache-Control: private, max-age=259200
Expires: Mon, 04 Aug 2014 15:04:05 GMT
Date: Fri, 01 Aug 2014 15:04:05 GMT
Connection: keep-alive
GIF89a|.=.................u..f...^.v..i.Q..3..Ku..W....o...........Vho/g...S.n.e.-f..h..F......R{......&...j.W.....0...R......W........d...(............H........F....F..............9UgQ..3.....u..3u.......%...-^....s....U..5..G........x...]...3.....4.......mOk........"..x.."...x...,p...B....*V./JY....d........J........6.$...Y.l........L...vS......G...........0...3..I...... .w.....Y....r)W...S..3...Y.I.........{.................!'w...T.>dye.....u............2.j"$`r....x.....)R.....X.g..G...U.....G.7..X...k..I.g........E......Z.......:}.K.................t...4=...R...~|wR=x.........ok............................................................................................................................................................~........ .c1J......................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:370D4B19B36411DF92A0A43CC032876F" xmpMM:InstanceID="xmp.iid:370D4B18B36411DF92A0A43CC032876F" xmp:CreatorTool="Adobe Pho
<<
<<< skipped >>>
GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1
Range: bytes=0-2429261
User-Agent: AHTTPConnection
Host: dts1.freeridegames.com
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 206 Partial Content
Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT
Content-Type: application/x-msdownload
Accept-Ranges: bytes
X-Varnish: 494852606 494804948
Expires: Fri, 01 Aug 2014 15:04:02 GMT
Pragma: no-cache
Date: Fri, 01 Aug 2014 15:04:02 GMT
Content-Range: bytes 0-2429261/12146312
Content-Length: 2429262
Connection: keep-alive
Cache-Control: Private,max-age=0
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... ... ... .......5...O...(.......4...O...i......./... .......&...*.......!...Rich ...........PE..L...>.J=.................0...0...............@....@.........................................................................hI..........(...........8C..P............................................................@...............................text...6$.......0.................. ..`.rdata.......@... ...@..............@..@.data...dn...`...@...`..............@....rsrc...(...........................@..@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
<<
<<< skipped >>>
GET /meter/VVV.freeridegames.com/13.gif HTTP/1.1
Accept: */*
Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: images.scanalert.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache
Expires: Fri, 01 Aug 2014 15:15:00 GMT
Content-Encoding: gzip
Content-Type: image/gif; charset=UTF-8
Content-Length: 57
Vary: Accept-Encoding
Date: Fri, 01 Aug 2014 15:04:03 GMT
Connection: keep-alive
..........s.t..Ldd`dh``8s......O.F ..."@2.LL.......G. ...HTTP/1.1 200 OK..Server: Apache..Expires: Fri, 01 Aug 2014 15:15:00 GMT..Content-Encoding: gzip..Content-Type: image/gif; charset=UTF-8..Content-Length: 57..Vary: Accept-Encoding..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive............s.t..Ldd`dh``8s......O.F ..."@2.LL.......G. .....
GET /pki/crl/products/MicrosoftRootAuthority.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.microsoft.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Sun, 22 Jun 2014 05:05:27 GMT
Accept-Ranges: bytes
ETag: "ec45e394d78dcf1:0"
Server: Microsoft-IIS/8.0
VTag: 279122442000000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 603
Cache-Control: max-age=900
Date: Fri, 01 Aug 2014 15:05:27 GMT
Connection: keep-alive
0..W0..?...0...*.H........0p1 0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority..140621173809Z..140920055809Z0:0...:..../...V..091210010336Z0........$... ..020225080156Z._0]0...U.#..0...J\u".F....9.N...`...0... .....7.......0...U......$0... .....7......140919174809Z0...*.H.............S.>l.._....)j.k%..vm.'Y.....Q......p,..X.#..6......8...............xT..>.E..H.#......U...'.../....p....(5.....,..F:.......~.....M.."......I"....;0.]..,.OI}.....f.2~.].,u...hp.W,.'wj..%<......Y.N.. ..u',.. ..v$#A....l..9..m.T:s... .>Z.k...l.....kVyi......o.....
GET /do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: player.freeridegames.com
Connection: Keep-Alive
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:02 GMT
Server: Apache
Content-Length: 95
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=800
Connection: Keep-Alive
Content-Type: text/html;charset=ISO-8859-1
..........<html>.<head>.<title></title>.</head>.<body>..... .....</body>.</html>..HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:02 GMT..Server: Apache..Content-Length: 95..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1.. ..........<html>.<head>.<title></title>.</head>.<body>..... .....</body>.</html>......
POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1
User-Agent: AHTTPConnection
Host: player.freeridegames.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1
HTTP/1.1 200 OK
Date: Fri, 01 Aug 2014 15:05:04 GMT
Server: Apache
Content-Length: 0
P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
Keep-Alive: timeout=3, max=799
Connection: Keep-Alive
Content-Type: text/html
HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:04 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Content-Type: text/html..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
iexplore.exe_1932:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.Fg
IIIIIB(II<.Fg
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512