Trojan.Generic.11454451_6e1af1017e – Adaware

Trojan.Generic.11454451 (AdAware), Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 6e1af1017ec3546c111e3e628485d2f1

SHA1: 73f003656144f60c04f30c3df90be37e7275d20d

SHA256: 7c4ff29863027e3a6cadd72cfa5d607ca01957763d00a8fd1ea22957ea21837e

SSDeep: 24576:aRevMp /Qlb VoDLhb/ZPPtKWMAEeazRjDRWbXxIZ:a8MpYYSVo/l/ZPPt/rEeaQI

Size: 1074000 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171

Company: Exent Technologies Ltd.

Created at: 2008-08-20 16:51:24

Analyzed on: WindowsXP SP3 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

FreeRideGames.e:608
GPlayer.exe:252
GPlayer.exe:1132
GPlayer.exe:1956
%original file name%.exe:860
Regsvr32.exe:1752
RegEdit.exe:936
RegEdit.exe:1584
setup.exe:908
Free Ride Games.exe:1756

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process FreeRideGames.e:608 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (11297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (4508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (6224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (14367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (42648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (157015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (0 bytes)

The process GPlayer.exe:252 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\FreeRide Games\Info\4.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\3.clg (15349 bytes)

The process GPlayer.exe:1132 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\FreeRide Games\Info\6.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\5.clg (15349 bytes)

The process GPlayer.exe:1956 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Program Files%\FreeRide Games\Info\1.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\2.clg (1093 bytes)

The process %original file name%.exe:860 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\Free Ride Games.exe (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (6389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\cmhelper.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\resourceDll.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\ExentCtlInstaller.dll (98 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (0 bytes)

The process setup.exe:908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\FreeRide Games\setu20fe.rra (14400 bytes)
%Documents and Settings%\All Users\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgToa3a.rra (1 bytes)
%Program Files%\FreeRide Games\repo2b8.rra (364 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8b3.rra (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defafc30.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\cliec5d.rra (509 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13b0.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\mask\updae80.rra (96 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd519.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_865.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI410.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12a6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5c5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4fa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd43f.rra (4 bytes)
%Program Files%\FreeRide Games\cmhe2a8.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game140d.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1093.rra (2 bytes)
%Program Files%\FreeRide Games\Game25a.rra (65287 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd28.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1333.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data567.rra (31 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14aa.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb53.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e117d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\defa41f.rra (2 bytes)
%Program Files%\FreeRide Games\Data\vers316.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbe2.rra (3404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fb55.rra (7560 bytes)
%Program Files%\FreeRide Games\GPlr23b.rra (32516 bytes)
%Program Files%\FreeRide Games\npGa14e8.rra (13264 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\EXEt6ee.rra (843 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaac6.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd529.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (323 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\auto96f.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\myGac2e.rra (22 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main144c.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLad6.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm827.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos77b.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrtfc20.rra (8434 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc1e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_17f8.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu661.rra (2 bytes)
%System%\d3dx335.rra (32512 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14b9.rra (1 bytes)
%Program Files%\FreeRide Games\Repo299.rra (31560 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f29.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\logi9ad.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f58.rra (156954 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\debu3e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_76b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb690.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF} (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7b9.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logoa78.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13bf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1362.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb25.rra (17 bytes)
%Program Files%\FreeRide Games\glut1ce.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6de.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1313.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files%\FreeRide Games\Skin\icon\Exitaf5.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlafbe2.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaaa7.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dial97e.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1006.rra (2 bytes)
%Program Files%\FreeRide Games\Win815f2.rra (2334 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (21 bytes)
%Program Files%\FreeRide Games\wh_P2d7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos78a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topRa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8c3.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\mask\errod76.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\icon\faviaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd18.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs147b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascba.rra (16 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d112f.rra (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbb3.rra (6040 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info1304.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\erorbef.rra (8 bytes)
%Program Files%\FreeRide Games\Data\Loca335.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ea.rra (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbf2.rra (2104 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help7aa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bannf3b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos120a.rra (376 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec5a6.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\mg42f.rra (7 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\signd37.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\ISSe20ee.rra (10504 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe17f.rra (10504 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos613.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascca.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\mask\playdd4.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7e8.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\preRd37.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load1258.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dropc6c.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbc3.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\og_id09.rra (625 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1164 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada59.rra (2334 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo151.rra (515 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data160.rra (15968 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6cf.rra (2 bytes)
%Program Files%\FreeRide Games\frg-2e7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto558.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_2807.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a111f.rra (5 bytes)
%Program Files%\FreeRide Games\exs.ini (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\licefbc3.rra (9 bytes)
%Program Files%\FreeRide Games\AX322b8.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1239.rra (247 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd47d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\skin9dc.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlr9ec.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd50a.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan13cf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord1287.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\playd18.rra (729 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load142d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l11bc.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd49c.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_a98.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13a0.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\icon\Servb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_940.rra (13 bytes)
%Program Files%\FreeRide Games\ExentComponents.ini (1073 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12b6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca325.rra (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Strifc20.rra (2 bytes)
%Program Files%\FreeRide Games\FRGN383.rra (17 bytes)
%WinDir%\Downloaded Program Files\Exen354.rra (32172 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu213c.rra (4412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Fontfc01.rra (39 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1277.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\inde3a2.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\framcda.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm817.rra (1 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu215c.rra (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (4 bytes)
%Program Files%\FreeRide Games\Skin\Skin3a2.rra (352 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\0x041e7d.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLea2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim539.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC1381.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6bf.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6cf.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR14aa.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBoa1b.rra (1 bytes)
%Program Files%\FreeRide Games\Data\Loca325.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6fe.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\logicf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR149a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\md3f0.rra (383 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLae6.rra (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exsfbd2.rra (12834 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ1352.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_930.rra (12 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (1612 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13bf.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4db.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlrb63.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m11cb.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid76.rra (96 bytes)
%Program Files%\FreeRide Games\lice2e7.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\switd57.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho587.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb43.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_a3b2.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Stri6fe.rra (11940 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_m3c2.rra (24 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm836.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10c2.rra (1 bytes)
%Program Files%\FreeRide Games\exs316.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI400.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlab63.rra (17 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu212d.rra (256 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\dl41f.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd48d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyGab82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun1248.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb16.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_884.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\errocab.rra (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGafbf2.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10d1.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_94f.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\layo20fe.rra (515 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec14d9.rra (807 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada69.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\mg_i9bd.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topLa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load141d.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa95f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca335.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\Mostbc0.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\sett9cc.rra (6 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x0418f.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5e4.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear146b.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o11db.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_875.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\fram99e.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g119c.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Sett393.rra (1 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu19f.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\icon\IAFb72.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corefc11.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dl_i98e.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regifbc3.rra (29 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\jquece9.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb15.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i11ac.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_d3c2.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott13df.rra (35 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\back5b6.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos623.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6b0.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto548.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\icon\Settb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb671.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\yesnd66.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Connad6.rra (296 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro98e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi10f1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd46d.rra (3 bytes)
%Program Files%\FreeRide Games\Clie393.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_1807.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb661.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1eac.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb34.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\mg_id09.rra (20 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\exs20df.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd45e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\pbc2e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi1248.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\icon\Tray383.rra (17 bytes)
%Program Files%\FreeRide Games\GPla1ce.rra (154846 bytes)
%Program Files%\FreeRide Games\X4HS1be.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_70d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc0f.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_75b.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\MyGabd0.rra (4298 bytes)
%Program Files%\FreeRide Games\report.ini (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\play1110.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\splad47.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos633.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1268.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ac.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e114e.rra (4 bytes)
%Program Files%\FreeRide Games\exs2f6.rra (12834 bytes)
%Program Files%\FreeRide Games\X4Ex1ae.rra (16732 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi1100.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g118d.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12c5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear147b.rra (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (807 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec596.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid86.rra (48 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu211d.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1371.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyDob82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\attaa0b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8d2.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12d5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Chanaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_855.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc71d.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\spla9dc.rra (2 bytes)
%Documents and Settings%\All Users\Desktop\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialbe0.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7d8.rra (3 bytes)
%Program Files%\FreeRide Games\3rdP2e7.rra (26 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_c3b2.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_846.rra (27 bytes)
%Program Files%\FreeRide Games\AppL2c8.rra (32102 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\tracd57.rra (7 bytes)
%Program Files%\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u11fa.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_p3d1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\GATrbc0.rra (2326 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4cb.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5f4.rra (2 bytes)
%Program Files%\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10b2.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help79a.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6b0.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxfc01.rra (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s11eb.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\og_i9bd.rra (1 bytes)
%Program Files%\FreeRide Games\exs306.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_74c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb05.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa96f.rra (2 bytes)
%Program Files%\FreeRide Games\Game289.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dl_ic5d.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb681.rra (2 bytes)
%Program Files%\FreeRide Games\npEx373.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g11ac.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_95f.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\botta49.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_07e8.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnfc11.rra (11 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu170.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\erroc9b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1219.rra (483 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu642.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\yesn9ec.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\Helpb72.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\AC_Rc4d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1323.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRia2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13fe.rra (181 bytes)
%Program Files%\FreeRide Games\myGa393.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip690.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_911.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Onlib82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Game3f0.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb24.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12e5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd44e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca326.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaab7.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\key_cf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flasa59.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro99e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_901.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Spla3f0.rra (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exsfd97.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\logi3e1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8f2.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6a0.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu652.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8e2.rra (22 bytes)
%Program Files%\FreeRide Games\DoDl306.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc73c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pids42f.rra (58 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8a4.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retra78.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isrfc30.rra (18974 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e113f.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\iconbef.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo143c.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_921.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\spacc3d.rra (49 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5d5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6ee.rra (5 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlayer.ico (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isres_0x0409.dll (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exs.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnetinstaller.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\StringTable_0x0409.ips (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_toolbar.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corecomp.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\license.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\default.pal (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_toolbar_w_homepage.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.inx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78} (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\RegistryValues.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxData.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGameTreatPlugin.reg (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FontData.ini (0 bytes)

The process Free Ride Games.exe:1756 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\header[1].jpg (4881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (18524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].html (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[1].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\beacon[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_PROGRESS[1].htm (2073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Exent\GI20140801150510GMT.Log (28 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (1238 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (1286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDMLog.log (2605139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[3].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion3[1].gif (24079 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (223946 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (3017 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDM_DB_148.xml (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_HEADER2[1].css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion4[1].jpg (23149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\13[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\header[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\conversionTracking[1].htm (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].htm (1155 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion2[1].jpg (23210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (3504 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion1[1].jpg (19117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\boxshot_sm[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsdm.bat (175 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (0 bytes)

Registry activity

The process FreeRideGames.e:608 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 1F 2A 34 BE 0B 98 48 E9 BF 2B E9 72 C0 7F 12"

The process GPlayer.exe:252 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"RTyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"ErrorID" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"PlayTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"filepath" = "%Program Files%\FreeRide Games\Info\4.clg"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "3"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"STyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"STyp" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FC 5F B3 71 2C EC 9A B0 35 E8 47 58 74 B3 B0 74"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]
"PlayTime" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
"filepath" = "%Program Files%\FreeRide Games\Info\3.clg"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\3]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\4]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process GPlayer.exe:1132 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"RTyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"filepath" = "%Program Files%\FreeRide Games\Info\5.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"PlayTime" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"STyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"TicketID" = "1204111893"
"PlayTime" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"filepath" = "%Program Files%\FreeRide Games\Info\6.clg"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "5"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"RTyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
"TargetURL" = ""

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 7A 83 48 C7 A8 5E 0E 54 52 6B 25 92 D9 0E 5A"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]
"STyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\6]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\5]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process GPlayer.exe:1956 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"RTyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"TargetURL" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"RecoverSendFilesCount" = "3"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"TargetURL" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"PlayTime" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"STyp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"filepath" = "%Program Files%\FreeRide Games\Info\2.clg"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"filepath" = "%Program Files%\FreeRide Games\Info\1.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"ErrorID" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"PlayTime" = "0"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"RTyp" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"ErrorID" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 A7 6B 5E 45 8F 27 80 EF 47 8F F2 90 55 C8 58"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"MaxFilesCount" = "16"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\2]
[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG\1]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:860 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 BE B3 71 50 9E 69 7B 1C A2 D5 4F F3 A1 37 51"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsep.bat" = "_uninsep"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148]
"Free Ride Games.exe" = "FreeRideGames Application"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The process Regsvr32.exe:1752 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B3 F5 81 E2 FB 95 40 D4 EC 03 2D 38 15 6C C4 0C"

[HKLM\System\CurrentControlSet\Control\WOW]
"DefaultSeparateVDM" = "yes"

The process RegEdit.exe:936 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}]
"(Default)" = "Game Treat Widget"

[HKCR\AppID\{B415CD14-B45D-4BCA-B552-B06175C38606}]
"(Default)" = "FireBreathWin"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\ProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\VersionIndependentProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"Extension" = ""

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\Version]
"(Default)" = "1"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"(Default)" = "Game Treat Widget"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}]
"(Default)" = "IFBComEventSource"

[HKCR\GameTreatWidget.GameTreatWidget\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\GameTreatWidget.GameTreatWidget\CurVer]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}]
"(Default)" = "IFBComJavascriptObject"

[HKCR\GameTreatWidget.GameTreatWidget.1]
"(Default)" = "Game Treat Widget"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"CLSID" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}]
"(Default)" = "IFBControl"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus]
"(Default)" = "0"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\GameTreatWidget.GameTreatWidget.1\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"Version" = "1.0"

[HKCR\AppID\npGameTreatWidget.dll]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 63 2B C2 2A B8 03 3C 7C 11 45 1E BF 68 76 0B"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"

[HKCR\GameTreatWidget.GameTreatWidget]
"(Default)" = "Game Treat Widget"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\iexplore\AllowedDomains\*]
"Count" = "0"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"Version" = "1.0"

[HKCR\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"Version" = "1.0"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0]
"(Default)" = "GameTreatWidget 1.0 Type Library"

The process RegEdit.exe:1584 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"Value" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"Value" = "30000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"IsReadOnly" = "1"
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"Value" = "1800"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"Value" = "old"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"Value" = "http://beta.freeridegames.com/messages/rss/"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"Value" = "Default"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"Value" = "default"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"Value" = "advoyris"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"Value" = "86400000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"Value" = "60000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"Value" = "168,86400"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"Value" = "30000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"Value" = "2"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"Value" = "193"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"Value" = "1000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 63 68 6E 48 F7 A9 D5 50 C8 CD 97 B1 C2 3A CA"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"Value" = "http://beta.freeridegames.com/messages/contentpush/"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\CLG]
"LastSuccessfulErrURL" = "http://player.freeridegames.com/opTools/errorReport.jsp"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsReadOnly" = "1"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"RunPlayerOnStartUp" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"Value" = "ON(143_CAMPAIGN_SERIAL_ID)ON(143_TURNKEY)ON(143_FIRST_BROWSER)NN(143_CAMPAIGN_PERFORMED_CONVERSIONS)NN(143_DAYS_PLAYED)NN(143_REACTIVATION_ID)NN(143_GAG)NN(143_UDOM)"
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"Value" = "player.freeridegames.com"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"Value" = "360"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"IsVisible" = "1"
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Version]
"Value" = "117802240"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"Value" = "20000"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"Value" = "player.freeridegames.com"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"Value" = "10"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"Value" = "http://player.freeridegames.com/do/PlayerUpdateInfo"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"Value" = "4320"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"Value" = "http://player.freeridegames.com/opTools/clientReport.jsp?theme=Home"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"Value" = "1800"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"Value" = "168,43200"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"Value" = ""

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"Value" = "http://player.freeridegames.com/check.jsp"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingLastState" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"Value" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"Value" = "1440"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"Value" = "http://player.freeridegames.com/do/gameInfo?contentId=%GAME_ID%"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsVisible" = "0"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingEnable" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsVisible" = "1"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"Value" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsVisible" = "1"

The process setup.exe:908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Version" = "16777219"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus\1]
"(Default)" = "132497"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"Installer" = "MSICD"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc" = "Completed"

[HKCR\ExentControl.ExentInf1.1]
"(Default)" = "ExentInf1 Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = ""

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\HELPDIR]
"(Default)" = "%WinDir%\Downloaded Program Files"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}]
"(Default)" = "IExentCtlStub"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ProductGUID" = "{6C26A305-4549-4A8A-9F03-25719C03B0FB}"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148]
"BinPath" = "%Program Files%\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\DownloadInformation]
"CodeBase" = ""

[HKCU\Software\AppDataLow\Software\ExentControl]
"runInstallFlag" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\MozillaPlugins\www.exent.com/GameTreatWidget]
"Path" = "%Program Files%\FreeRide Games\NPGameTreatPlugin.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Keep Free Space" = "50"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\0\win32]
"(Default)" = "%Program Files%\FreeRide Games\npGameTreatWidget.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair" = "1"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}]
"(Default)" = "_IExentInfEvents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"VersionMajor" = "1"
"URLInfoAbout" = "www.exent.com"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentStub"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\HELPDIR]
"(Default)" = "%Program Files%\FreeRide Games"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"LogMode" = "1"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"

[HKCR\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls safely initializable from persistent data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Startup" = "%Documents and Settings%\All Users\Start Menu\Programs\Startup"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}]
"(Default)" = "IExentInf"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Version]
"(Default)" = "1.1"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus]
"(Default)" = "0"

[HKCR\ExentControl.ExentStub\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ProgID]
"(Default)" = "ExentControl.ExentInf1.1"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallLocation" = "%Program Files%\FreeRide Games"
"Publisher" = "Exent Technologies"
"InstallSource" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\pft3.tmp\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\%WinDir%\Downloaded Program Files]
"ExentControl.ocx" = "1"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1]
"(Default)" = "ExentControl 1.1 Type Library"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"(Default)" = "%Program Files%\FreeRide Games\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Contains\Files\%WinDir%\Downloaded Program Files]
"ExentControl.ocx" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\FLAGS]
"(Default)" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallString" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409 -removeonly"
"NoModify" = "1"
"VersionMinor" = "0"

[HKCR\ExentControl.ExentStub.1]
"(Default)" = "ExentStub Class"

[HKCR\ExentControl.ExentInf1]
"(Default)" = "ExentInf1 Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"Path" = "%Program Files%\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = "ExentStub Class"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"Policy" = "3"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"(Default)" = "07,02,00,07"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayName" = "FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"LastModified" = "Wed, 20 Jun 2012 05:42:12 GMT"

[HKCR\exent\shell\open\command]
"(Default)" = "%Program Files%\FreeRide Games\Win8Launcher.exe %1"

[HKCR\ExentControl.ExentStub]
"(Default)" = "ExentStub Class"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"Version" = "1.1"

[HKCR\ExentControl.ExentInf1\CurVer]
"(Default)" = "ExentControl.ExentInf1.1"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"Version" = "1.1"

[HKCR\ExentControl.ExentStub\CurVer]
"(Default)" = "ExentControl.ExentStub.1"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\0\win32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayVersion" = "1.00.0003"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"RegOwner" = "XP1"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\TypeLib]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCR\ExentControl.ExentStub.1\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Size" = "3927"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppPath" = "%Program Files%\FreeRide Games"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallStringOriginal" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Setup.exe -runfromtemp"
"RegCompany" = "Malware"

[HKCR\ExentControl.ExentInf1.1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Fonts" = "%WinDir%\Fonts"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ToolboxBitmap32]
"(Default)" = "%WinDir%\Downloaded Program Files\ExentControl.ocx, 101"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"Version" = "1.1"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\ProgID]
"(Default)" = "ExentControl.ExentStub.1"

[HKCR\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}]
"409" = "Controls that are safely scriptable"

[HKCR\ExentControl.ExentInf1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = "ExentInf1 Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ExentControl.ocx]
"{4FF78044-96B4-4312-A5B7-FDA3CB328095}" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRemove" = "0"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 4A 30 F3 B4 C9 FE 87 4A 16 F8 07 D5 A0 10 3A"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"Progress" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Language" = "1033"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallDate" = "20140801"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Disks\C]
"Games Dir" = "Remote Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayIcon" = "%Program Files%\FreeRide Games\myGames.ico"

[HKCR\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"(Default)" = "%Program Files%\FreeRide Games\npGameTreatWidget.dll"

[HKCR\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentInf1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ModifyPath" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409"
"LogFile" = "%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ilg"

[HKCR\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"SystemComponent" = "0"

[HKCR\exent]
"URL Protocol" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/ExentControl.ocx]
".Owner" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\MozillaPlugins\@exent.com/npExentControl,version=7.1.0.1]
"Path" = "%Program Files%\FreeRide Games\npExentControl.dll"

[HKCR\exent]
"(Default)" = "URL:Exent Protocol"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppName" = "GPlayer.exe"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Exent Technologies]
[HKLM\SOFTWARE\Exent Technologies\FreeRide Games]
[HKLM\SOFTWARE\Exent Technologies\FreeRide Games\1.00.0003]

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MinorVersion"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MajorVersion"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ExtResponse"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoModify"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair"
"NoRemove"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"
"Progress"

The process Free Ride Games.exe:1756 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014080120140802\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CacheOptions" = "11"
"CacheRepair" = "0"

[HKLM\SOFTWARE\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
"ResumePage" = "index.html#PageId=SDM_PROGRESS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"Free Ride Games.exe" = "10"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148]
"FreeRideGames.exe" = "EXEtender Player"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\@%System%]
"SHELL32.dll,-9216" = "My Computer"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp]
"_uninsdm.bat" = "_uninsdm"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0B 2D 79 01 C9 4E B5 0D 18 D3 F7 41 D9 C8 C5 53"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080120140802]
"CachePrefix" = ":2014080120140802:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '595450'"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"ProxyServer"
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM"

Dropped PE files

MD5	File path
0f5522184e9ab86f640b6cb1df65ed9f	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\ExentCtlInstaller.dll
073aed8b0f5e6be312410ba6f61c452b	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\Free Ride Games.exe
35582cf9713985c9b746e8544c792d9c	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\SDM148\FreeRideGames.exe
72ef2d24d0efd50633e348426acb452f	c:\Program Files\FreeRide Games\AX32.dll
b3c69f6569b3ddf8f90e0fe882981a5d	c:\Program Files\FreeRide Games\AppLoader2KEx.dll
3645930301faace148be2813e8ce7977	c:\Program Files\FreeRide Games\DoDlg.exe
112811fe88dc3437ba8e731209f66465	c:\Program Files\FreeRide Games\GPlayer.exe
e440493ee5b307736dbcccab3b6d4bd5	c:\Program Files\FreeRide Games\GPlrLanc.exe
9373af11b046df0de7cd437ad2e99638	c:\Program Files\FreeRide Games\GameInst.dll
f1ec77deb12d8637c010ee26e1a28e0d	c:\Program Files\FreeRide Games\GameLauncher.exe
d2e90286b623106bf283749f49b496f1	c:\Program Files\FreeRide Games\Report.exe
549d2f6d72267e727ed29baef05aa68b	c:\Program Files\FreeRide Games\X4Ex_Pr148.sys
51b3cc1f1a2762f31ac35560a1de9004	c:\Program Files\FreeRide Games\X4HSEx_Pr148.sys
ae81517636a17218e6fed6116452ccbc	c:\Program Files\FreeRide Games\cmhelper.exe
d5783da0f964882bc555a83da5e2bad5	c:\Program Files\FreeRide Games\exs.dll
55c38709c3c879b2d0fa24f751d2c824	c:\Program Files\FreeRide Games\glutil.dll
c330e3f40bb38bcb04e4743407c8b6c9	c:\Program Files\FreeRide Games\npExentControl.dll
9bc0902f50e58167b4b778ef6f1b1103	c:\Program Files\FreeRide Games\wh_Pr148.dll
1bf0fc52d41be3f3c1025b3971bc49a0	c:\Program Files\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSetup.dll
9afff8eae9918d5051b52eb432d6dac0	c:\Program Files\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe
7ac9b56c15369c1c950d32e9084b9dde	c:\WINDOWS\Downloaded Program Files\ExentControl.ocx
39c858645cbf37b83bc907e188f8bc85	c:\WINDOWS\system32\d3dx9_32.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
FreeRideGames.e:608
GPlayer.exe:252
GPlayer.exe:1132
GPlayer.exe:1956
%original file name%.exe:860
Regsvr32.exe:1752
RegEdit.exe:936
RegEdit.exe:1584
setup.exe:908
Free Ride Games.exe:1756
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\ISSetup.dll (11297 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\0x0409.ini (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\layout.bin (515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.zip (4508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.exe (15278 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.inx (6224 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.cab (14367 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setupapplet.jar (541 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\pftw1.pkg (42648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\plf1.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.iss (256 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data2.cab (157015 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.ini (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\data1.hdr (1941 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ext2.tmp (5 bytes)
%Program Files%\FreeRide Games\Info\4.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\3.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\6.clg (1093 bytes)
%Program Files%\FreeRide Games\Info\5.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\1.clg (15349 bytes)
%Program Files%\FreeRide Games\Info\2.clg (1093 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\Free Ride Games.exe (1775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsep.bat (168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\000721ED (6389 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\cmhelper.exe (192 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\resourceDll.dll (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\ExentCtlInstaller.dll (98 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu20fe.rra (14400 bytes)
%Documents and Settings%\All Users\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgToa3a.rra (1 bytes)
%Program Files%\FreeRide Games\repo2b8.rra (364 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8b3.rra (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defafc30.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\cliec5d.rra (509 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13b0.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\mask\updae80.rra (96 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd519.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_865.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI410.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12a6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5c5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4fa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd43f.rra (4 bytes)
%Program Files%\FreeRide Games\cmhe2a8.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game140d.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1093.rra (2 bytes)
%Program Files%\FreeRide Games\Game25a.rra (65287 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd28.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1333.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data567.rra (31 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14aa.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb53.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e117d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\defa41f.rra (2 bytes)
%Program Files%\FreeRide Games\Data\vers316.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbe2.rra (3404 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\fb55.rra (7560 bytes)
%Program Files%\FreeRide Games\GPlr23b.rra (32516 bytes)
%Program Files%\FreeRide Games\npGa14e8.rra (13264 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\EXEt6ee.rra (843 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaac6.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd529.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\setup.log (323 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\auto96f.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\myGac2e.rra (22 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main144c.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLad6.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm827.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos77b.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrtfc20.rra (8434 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc1e.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_17f8.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu661.rra (2 bytes)
%System%\d3dx335.rra (32512 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14b9.rra (1 bytes)
%Program Files%\FreeRide Games\Repo299.rra (31560 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f29.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\logi9ad.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1f58.rra (156954 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\debu3e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_76b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb690.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7b9.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logoa78.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13bf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1362.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb25.rra (17 bytes)
%Program Files%\FreeRide Games\glut1ce.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6de.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1313.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files%\FreeRide Games\Skin\icon\Exitaf5.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPlafbe2.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaaa7.rra (4314 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dial97e.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann1006.rra (2 bytes)
%Program Files%\FreeRide Games\Win815f2.rra (2334 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\0x0409.ini (21 bytes)
%Program Files%\FreeRide Games\wh_P2d7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos78a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topRa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8c3.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\mask\errod76.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\icon\faviaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\postd18.rra (966 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs147b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascba.rra (16 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d112f.rra (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbb3.rra (6040 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info1304.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\erorbef.rra (8 bytes)
%Program Files%\FreeRide Games\Data\Loca335.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ea.rra (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_fbf2.rra (2104 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help7aa.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bannf3b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos120a.rra (376 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec5a6.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\mg42f.rra (7 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\signd37.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\ISSe20ee.rra (10504 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe17f.rra (10504 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos613.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\flascca.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\mask\playdd4.rra (144 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7e8.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\preRd37.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load1258.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dropc6c.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setufbc3.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\og_id09.rra (625 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (1164 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada59.rra (2334 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo151.rra (515 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data160.rra (15968 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\yesb6cf.rra (2 bytes)
%Program Files%\FreeRide Games\frg-2e7.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto558.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_2807.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a111f.rra (5 bytes)
%Program Files%\FreeRide Games\exs.ini (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\licefbc3.rra (9 bytes)
%Program Files%\FreeRide Games\AX322b8.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1239.rra (247 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd47d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\skin9dc.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\dat\GPlr9ec.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd50a.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan13cf.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord1287.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\playd18.rra (729 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load142d.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l11bc.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd49c.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_a98.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13a0.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\icon\Servb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_940.rra (13 bytes)
%Program Files%\FreeRide Games\ExentComponents.ini (1073 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn12b6.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca325.rra (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Strifc20.rra (2 bytes)
%Program Files%\FreeRide Games\FRGN383.rra (17 bytes)
%WinDir%\Downloaded Program Files\Exen354.rra (32172 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu213c.rra (4412 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Fontfc01.rra (39 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1277.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\inde3a2.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\framcda.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm817.rra (1 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu215c.rra (1568 bytes)
%Program Files%\FreeRide Games\Skin\Skin3a2.rra (352 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\0x041e7d.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLea2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim539.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC1381.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6bf.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6cf.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR14aa.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBoa1b.rra (1 bytes)
%Program Files%\FreeRide Games\Data\Loca325.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6fe.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\logicf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR149a.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\md3f0.rra (383 bytes)
%Program Files%\FreeRide Games\Skin\html\OffLae6.rra (387 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exsfbd2.rra (12834 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ1352.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_930.rra (12 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[2].txt (1612 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs13bf.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4db.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlrb63.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m11cb.rra (18 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid76.rra (96 bytes)
%Program Files%\FreeRide Games\lice2e7.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\switd57.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho587.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb43.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_a3b2.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Stri6fe.rra (11940 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_m3c2.rra (24 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm836.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10c2.rra (1 bytes)
%Program Files%\FreeRide Games\exs316.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\NIBmps\NetI400.rra (1890 bytes)
%Program Files%\FreeRide Games\Skin\icon\GPlab63.rra (17 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu212d.rra (256 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\dl41f.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd48d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyGab82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun1248.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb16.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_884.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\errocab.rra (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGafbf2.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10d1.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_94f.rra (4 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\layo20fe.rra (515 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec14d9.rra (807 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\loada69.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\mg_i9bd.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topLa88.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load141d.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa95f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca335.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide7c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\Mostbc0.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\sett9cc.rra (6 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x0418f.rra (21 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5e4.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear146b.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o11db.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_875.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\fram99e.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g119c.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Sett393.rra (1 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu19f.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\icon\IAFb72.rra (17 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\corefc11.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\dl_i98e.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regifbc3.rra (29 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\jquece9.rra (3404 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb15.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i11ac.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_d3c2.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott13df.rra (35 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\back5b6.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos623.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\upda6b0.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto548.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\icon\Settb92.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb671.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\yesnd66.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Connad6.rra (296 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro98e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi10f1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd46d.rra (3 bytes)
%Program Files%\FreeRide Games\Clie393.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_1807.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb661.rra (2 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\data1eac.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb34.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\mg_id09.rra (20 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\exs20df.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd45e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\pbc2e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi1248.rra (262 bytes)
%Program Files%\FreeRide Games\Skin\icon\Tray383.rra (17 bytes)
%Program Files%\FreeRide Games\GPla1ce.rra (154846 bytes)
%Program Files%\FreeRide Games\X4HS1be.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_70d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\layoc0f.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_75b.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\MyGabd0.rra (4298 bytes)
%Program Files%\FreeRide Games\report.ini (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\play1110.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\splad47.rra (6 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\clos633.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play1268.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4ac.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e114e.rra (4 bytes)
%Program Files%\FreeRide Games\exs2f6.rra (12834 bytes)
%Program Files%\FreeRide Games\X4Ex1ae.rra (16732 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi1100.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g118d.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12c5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear147b.rra (10 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@player.freeridegames[1].txt (807 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\Chec596.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\mask\logid86.rra (48 bytes)
%Documents and Settings%\All Users\Application Data\FreeRide Games\setu211d.rra (6041 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl1371.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\MyDob82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\attaa0b.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8d2.rra (11 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp12d5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc72d.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Chanaf5.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_855.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc71d.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\spla9dc.rra (2 bytes)
%Documents and Settings%\All Users\Desktop\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialbe0.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\more7d8.rra (3 bytes)
%Program Files%\FreeRide Games\3rdP2e7.rra (26 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_c3b2.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_846.rra (27 bytes)
%Program Files%\FreeRide Games\AppL2c8.rra (32102 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\tracd57.rra (7 bytes)
%Program Files%\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u11fa.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\ap_p3d1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\GATrbc0.rra (2326 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd4cb.rra (10 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5f4.rra (2 bytes)
%Program Files%\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{29AE00A7-B498-4E5C-BB58-7DDB6E74EC78}\setup.ini (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10b2.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\help79a.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6b0.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFxfc01.rra (86 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s11eb.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\og_i9bd.rra (1 bytes)
%Program Files%\FreeRide Games\exs306.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_74c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb05.rra (34 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\adGa96f.rra (2 bytes)
%Program Files%\FreeRide Games\Game289.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\dl_ic5d.rra (32 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\pinb681.rra (2 bytes)
%Program Files%\FreeRide Games\npEx373.rra (8760 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g11ac.rra (9 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_95f.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\botta49.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\info12f4.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_07e8.rra (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\dotnfc11.rra (11 bytes)
%Program Files%\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu170.rra (14400 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\erroc9b.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos1219.rra (483 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin14c9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu642.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\yesn9ec.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\icon\Helpb72.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\AC_Rc4d.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\main1323.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRia2a.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop13fe.rra (181 bytes)
%Program Files%\FreeRide Games\myGa393.rra (2334 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip690.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e115f.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann10e1.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_911.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\icon\Onlib82.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Game3f0.rra (12 bytes)
%Program Files%\FreeRide Games\Skin\icon\FRGLb24.rra (17 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai12e5.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\prvd44e.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\dat\Loca326.rra (7 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\gplayer\gplaab7.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\js\key_cf9.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flasa59.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\css\erro99e.rra (1 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_901.rra (15 bytes)
%Program Files%\FreeRide Games\Skin\GameInfoDefault\Spla3f0.rra (29 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\pft3.tmp\exsfd97.rra (7168 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\logi3e1.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8f2.rra (19 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\skip6a0.rra (3 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\nobu652.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8e2.rra (22 bytes)
%Program Files%\FreeRide Games\DoDl306.rra (4456 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc73c.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pids42f.rra (58 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_8a4.rra (4 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retra78.rra (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\{48F24231-B53E-4EB0-B129-C3810151C1DF}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isrfc30.rra (18974 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e113f.rra (5 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\iconbef.rra (8 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo143c.rra (14 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Exent\classes\cls_921.rra (13 bytes)
%Program Files%\FreeRide Games\Skin\html\Skin\Provider\img\spacc3d.rra (49 bytes)
%Program Files%\FreeRide Games\Skin\Popups\1\canc5d5.rra (2 bytes)
%Program Files%\FreeRide Games\Skin\Langs\0409\Erro6ee.rra (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\header[1].jpg (4881 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion1[1].jpg (18524 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\SDM_PROGRESS[1].html (1208 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[1].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\beacon[1].js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_PROGRESS[1].htm (2073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Exent\GI20140801150510GMT.Log (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (1286 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDMLog.log (2605139 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[3].css (732 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion3[1].gif (24079 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (223946 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SDM148\SDM_DB_148.xml (560 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\SDM_HEADER2[1].css (471 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\servicePromotion4[1].jpg (23149 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\13[1].gif (43 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\QL6XWPY7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\III78ZJA\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\header[1].htm (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[1].txt (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\SDM_PROGRESS[2].css (347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\conversionTracking[1].htm (95 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion2[1].jpg (23210 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\defines[1].js (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A3ENKTOJ\servicePromotion1[1].jpg (19117 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\TLWM3HSV\boxshot_sm[1].jpg (3 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@scorecardresearch[2].txt (366 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_uninsdm.bat (175 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '595450'"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Exent Technologies Ltd.
Product Name: ExentCtl Module
Product Version: 07.02.00.01
Legal Copyright: Copyright (c) 1996-2007 Exent Technologies Ltd. All rights reserved.
Legal Trademarks:
Original Filename: ExentCtl.ocx
Internal Name: ExentCtl
File Version: 07.02.00.01
File Description: ExentCtl Module
Comments: Release.
Language: Language Neutral

Company Name: Exent Technologies Ltd.Product Name: ExentCtl ModuleProduct Version: 07.02.00.01Legal Copyright: Copyright (c) 1996-2007 Exent Technologies Ltd. All rights reserved.Legal Trademarks: Original Filename: ExentCtl.ocxInternal Name: ExentCtlFile Version: 07.02.00.01File Description: ExentCtl ModuleComments: Release.Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	67586	69632	4.53151	13d4df63a29071e604d09a6768d2e641
.rdata	73728	9413	12288	2.89315	1aae2e1490b0b801344569bed4d29505
.data	86016	19400	16384	0.903431	b02c7e2c998cd8ec273626efa37333f3
.rsrc	106496	963096	966656	5.36094	fd039aa7373d1f9040955ed82095602e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=595450
hxxp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://a1507.b.akamai.net/free/frg/products/595450/boxshot_sm.jpg
hxxp://a1697.b.akamai.net/FRG_site/downloads/geo/en/Exetender_Default.exe
hxxp://e8296.g.akamaiedge.net/check.jsp
hxxp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450
hxxp://a1697.b.akamai.net/freeride_marketing/SDM/SDM_standard/header.html
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/js/defines.js
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
hxxp://e54.g.akamaiedge.net/meter/www.freeridegames.com/13.gif
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard/img/header.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/js/defines.js
hxxp://a1294.w20.akamai.net/beacon.js
hxxp://a1294.w20.akamai.net/b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
hxxp://a1294.w20.akamai.net/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/do/gateway?sId=Default
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationstart
hxxp://player.freeridegames.com/do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationfinished
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB
hxxp://a1697.b.akamai.net/my_games?gameId=595450
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp
hxxp://a1697.b.akamai.net/static/marketing/main/css/main.css?version=38
hxxp://player.freeridegames.com/do/gatewayCD?sId=&subId=&actid=&callback=updateClientCookies&_=1406905525155
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38
hxxp://a1697.b.akamai.net/static/marketing/main/css/templates.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/gamebox.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/sprite_sheet.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/hover_elements_sheet.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/tinybox.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/download_assist.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot?
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38
hxxp://a1697.b.akamai.net/static/marketing/header/css/header.css
hxxp://a1697.b.akamai.net/static/marketing/main/img/background_pixel.jpg
hxxp://www-google-analytics.l.google.com/js/plusone.js
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js
hxxp://a1697.b.akamai.net/static/marketing/header/js/header.js
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38
hxxp://a1697.b.akamai.net/static/marketing/header/img/ui_elements.png
hxxp://a1697.b.akamai.net/static/marketing/header/img/logo.png
hxxp://a1697.b.akamai.net/static/marketing/header/img/icons.png
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_left_rib.jpg
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/oDB-fAAStWy.js?version=41
hxxp://a1507.b.akamai.net/free/frg/products/450950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/554350/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_right_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_pagenation_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_left_rib.jpg
hxxp://a1507.b.akamai.net/free/frg/products/616550/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_right_rib.jpg
hxxp://a1507.b.akamai.net/free/frg/products/661050/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_pagenation_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/footer/css/footer.css
hxxp://a1507.b.akamai.net/free/frg/products/608450/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/sprite_sheet.png
hxxp://a1507.b.akamai.net/free/frg/products/680950/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels.jpg
hxxp://a1507.b.akamai.net/free/frg/products/631850/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels_rib.jpg
hxxp://star.c10r.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_top_rib.jpg
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png
hxxp://a1507.b.akamai.net/free/frg/products/558350/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/green_btn_28_mid.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_corners.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_bottom_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_top_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_corners.jpg
hxxp://a1507.b.akamai.net/free/frg/products/645050/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/575350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/616950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/761850/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/589550/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/582150/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/571950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/710650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/619350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/643650/boxshot.jpg
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user
hxxp://a1697.b.akamai.net/static/marketing/main/img/hover_elements_sheet.png
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_bottom_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/preload.gif
hxxp://a1697.b.akamai.net/static/marketing/footer/img/footer_pixel.jpg
hxxp://a1507.b.akamai.net/free/frg/products/563750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/633350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/668950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/667850/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/624150/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/632750/boxshot.jpg
hxxp://a1697.b.akamai.net/action/JSONService
hxxp://a1507.b.akamai.net/free/frg/products/663350/boxshot.jpg
hxxp://stats.l.doubleclick.net/dc.js
hxxp://player.freeridegames.com/do/gateway?sId=&subId=&actid=&udom=partners.freeridegames.com
hxxp://a1507.b.akamai.net/free/frg/products/524350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/674750/boxshot.jpg
hxxp://www-googletagmanager.l.google.com/gtm.js?id=GTM-MJF4W9
hxxp://a749.dsw4.akamai.net/rsrc.php/v2/y7/r/j0a7CRWp-Sa.js
hxxp://a1294.w20.akamai.net/rsrc.php/v2/y1/r/LVx-xkvaJ0b.png
hxxp://a1507.b.akamai.net/free/frg/products/719950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/642550/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/765950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/559350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/699950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/701650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/748750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/766250/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/578250/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/521350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/661650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/764350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/735250/boxshot.jpg
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftRootAuthority.crl
hxxp://a1363.g.akamai.net/pki/crl/products/MicWinHarComPCA_2010-11-01.crl
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/img/header.jpg	184.84.180.16
hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe	63.85.36.72
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html	184.84.180.16
hxxp://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41	23.15.4.18
hxxp://partners.freeridegames.com/static/marketing/main/img/background_pixel.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/554350/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38	184.84.180.32
hxxp://b.scorecardresearch.com/beacon.js	23.15.4.18
hxxp://img.exent.com/free/frg/products/699950/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels_rib.jpg	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/css/main.css?version=38	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38	184.84.180.32
hxxp://b.scorecardresearch.com/b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=	23.15.4.18
hxxp://img.exent.com/free/frg/products/616550/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/766250/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/sprite_sheet.css	184.84.180.32
hxxp://static.ak.fbcdn.net/rsrc.php/v2/y1/r/LVx-xkvaJ0b.png	23.15.4.18
hxxp://partners.freeridegames.com/my_games?gameId=595450	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_corners.jpg	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_bottom_rib.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/608450/boxshot.jpg	184.84.180.59
hxxp://stats.g.doubleclick.net/dc.js
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_right_rib.jpg	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_top_rib.jpg	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38	184.84.180.32
hxxp://img.exent.com/free/frg/products/642550/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/hover_elements_sheet.png	184.84.180.32
hxxp://img.exent.com/free/frg/products/748750/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/571950/boxshot.jpg	184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg	184.84.180.16
hxxp://img.exent.com/free/frg/products/661650/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels.jpg	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/img/logo.png	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/img/ui_elements.png	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot?	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38	184.84.180.32
hxxp://img.exent.com/free/frg/products/643650/boxshot.jpg	184.84.180.59
hxxp://apis.google.com/js/plusone.js
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38	184.84.180.32
hxxp://img.exent.com/free/frg/products/589550/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/761850/boxshot.jpg	184.84.180.59
hxxp://images.scanalert.com/meter/www.freeridegames.com/13.gif	23.194.144.80
hxxp://img.exent.com/free/frg/products/663350/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/631850/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38	184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css	184.84.180.16
hxxp://partners.freeridegames.com/static/marketing/main/css/hover_elements_sheet.css	184.84.180.32
hxxp://img.exent.com/free/frg/products/633350/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/download_assist.css	184.84.180.32
hxxp://img.exent.com/free/frg/products/735250/boxshot.jpg	184.84.180.59
hxxp://www.googletagmanager.com/gtm.js?id=GTM-MJF4W9	74.125.226.62
hxxp://partners.freeridegames.com/static/marketing/footer/css/footer.css	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_right_rib.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/624150/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38	184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif	184.84.180.16
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38	184.84.180.32
hxxp://www.freeridegames.com/check.jsp	23.60.129.154
hxxp://img.exent.com/free/frg/products/668950/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38	184.84.180.32
hxxp://img.exent.com/free/frg/products/719950/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/616950/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/524350/boxshot.jpg	184.84.180.59
hxxp://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user	23.15.4.18
hxxp://img.exent.com/free/frg/products/563750/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/575350/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/674750/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_left_rib.jpg	184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg	184.84.180.16
hxxp://b.static.ak.fbcdn.net/rsrc.php/v2/y7/r/j0a7CRWp-Sa.js	23.15.4.16
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38	184.84.180.32
hxxp://connect.facebook.net/en_US/all.js
hxxp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html	63.85.36.72
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_corners.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/680950/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/701650/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/header/js/header.js	184.84.180.32
hxxp://img.exent.com/free/frg/products/645050/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/gamebox.css	184.84.180.32
hxxp://img.exent.com/free/frg/products/521350/boxshot.jpg	184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/js/defines.js	184.84.180.16
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_pagenation_rib.jpg	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/sprite_sheet.png	184.84.180.32
hxxp://www.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100	31.13.74.49
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_pagenation_rib.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/710650/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/img/icons.png	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/green_btn_28_mid.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/632750/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/css/tinybox.css	184.84.180.32
hxxp://img.exent.com/free/frg/products/595450/boxshot_sm.jpg	184.84.180.59
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl	23.15.4.8
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/img/preload.gif	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/header/css/header.css	184.84.180.32
hxxp://img.exent.com/free/frg/products/578250/boxshot.jpg	184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css	184.84.180.16
hxxp://partners.freeridegames.com/static/marketing/footer/img/footer_pixel.jpg	184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/js/defines.js	184.84.180.16
hxxp://partners.freeridegames.com/action/JSONService	184.84.180.32
hxxp://b.scorecardresearch.com/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=	23.15.4.18
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png	184.84.180.32
hxxp://img.exent.com/free/frg/products/559350/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/558350/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/450950/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_top_rib.jpg	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38	184.84.180.32
hxxp://partners.freeridegames.com/static/marketing/main/css/templates.css	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38	184.84.180.32
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css	184.84.180.16
hxxp://img.exent.com/free/frg/products/582150/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_bottom_rib.jpg	184.84.180.32
hxxp://img.exent.com/free/frg/products/667850/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/765950/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/619350/boxshot.jpg	184.84.180.59
hxxp://img.exent.com/free/frg/products/661050/boxshot.jpg	184.84.180.59
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg	184.84.180.16
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38	184.84.180.32
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp	184.84.180.32
hxxp://img.exent.com/free/frg/products/764350/boxshot.jpg	184.84.180.59
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_left_rib.jpg	184.84.180.32
s-static.ak.facebook.com	23.209.49.33

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:12 GMT

Connection: keep-alive

GET /connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f1210ab4f89fe85&domain=partners.freeridegames.com&origin=http://partners.freeridegames.com/fb4bbe1e11d138&relation=parent&error=unknown_user HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: static.ak.facebook.com

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

X-Content-Type-Options: nosniff

X-XSS-Protection: 0

Content-Encoding: gzip

X-FB-Debug: ZB 50aMstmsTvc/Q8Bzyb3YkyXotkTC nMtFOpOrjd9HqCdP06SGvCzueP0UYwZvOqczfcXu59vy W3jNMO3Uw==

Vary: Accept-Encoding

Content-Length: 9227

Cache-Control: public, max-age=30665883

Expires: Wed, 22 Jul 2015 13:23:26 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

...........}.z.F...<......")/.1........mlg........D,....H.g.U........-...Z]U][.........../..........yQ.E./_1...tj...<?.).Y.Xoy..I.L..G3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'..zz..w8Ys..=X.?.T<vz[...Re..S.8.....g..p....fsvN.....5..4s.-..06......BR.k.f.@Y.0....zbM:.`r[.....ta%|a}...Y.....e........dR.nH.....Ho..'...E.k6'.&.X@Y.B..dH.$..."(p'..\O..8. ..%..r.|ga.DX.x:6b..<#....D.rLT....@P.....-`Ep..T.qDnZ.y. ...]7G...x.".K...&h......b..)V..BXe.l.6....W).{R.l...n.N.Q..3.....l....OcN...w.....jj.<..0......).Y......x.....E...t"`../.F.;..vz*.m<.(.4h....#.F,/^K`6...q..f..q.......<..X.\..z..L.O......R...Wb..,.A.6H.F... .\^^...LH....(.wP...P<.k..$.B..a..._....A..4.....;9 ...w=...gg....;.Y.8..... ."Z3...}...5l...K\.....V......=.r.q.i..Z....<B.C2.&^...\....Y...#.,..H>d)X.....I.%..d-9.....)v......)... .z........G."$.. .!..EX..n HX.,..X4.v.g&...c8...@..h.....K.9;..G.-.Q....'V.V........z..X............y4n]_.......|.l:r.Wj,..#...Hy........j.....x....[(..o...G....X.{.-.=...SF...{N*..;Z...........`..0.J|.Zl6.V...,....}0......\....W#...x..A0..;.Z.......Mgd.o6.V"..sE`..M]...W.U.Xvs.4....7..:....wb........LC.....0.W....sSNqsq...;v..{#,iEW.r.....7..`..O.I...2<..Q.<(JB.>......W.(.'g`.4.3.....m...T........w*....\.tw...y...}.@}_....&...[9P{k}7.G<./.1M#...BN.'(..Nh...........:.3qy.................N.;..1.>..xx$.~.....a...;.c.\......L6.4.K.by>.,.2..g....}.,9...# ..~]{P...o.q...X...6....6.]......[

<<< skipped >>>

GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.ak.fbcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-MD5: mQCwCAAKHD AV8oddNLhdw==

Content-Type: image/png

Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT

X-Content-Type-Options: nosniff

X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=

Content-Length: 1329

Cache-Control: public, max-age=16118759

Expires: Wed, 04 Feb 2015 04:31:23 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

.PNG........IHDR.......H.......EH....IDATx...mH.w..q.R$....(Ed.E.CF...Z..9..U']......i...........q.X.$..1ptv}...lA.Z.....W.->U..y2......e.x.C.s....&..}.r.............17.............n....98TT....z..V.....3.?]........v{.0...`V......j...B.h...'O1.Rk.......y.....V-.-....k.lw.8......Z.]'*OB$....:Q.&...Bw.....32.ll...tqei......].^T\.sv....k..(..o(........(|..q8._.-.P....F..r...i..6.LA.X...M...f..?.g.r./...us.....~..P9.Td....(.........@..C....."..'..i...u\.........../.A:b.r.P...J..m....~...2.m>...C.Lo3.....cc.>s.[...W..>.Q..8. 1..........[r....^)<........(k...*S.C.g....9.}.....>.,..SxH3..v........_..p(....`....Dx..y..W..uJ._....s_.n.{.\.e.9|.r..:?......c`S.%..w.....0...t..K&.}.......ea;U.5ec.7....i...c."...N%..`l.E./....p.:.....4.".d`......b;.6..*dP..s.....p9..t.c....X..)\nGi......E......a.............h&.gU.......l.bg..T...3../`.........|....0f..H.6(D..B4./K...jt.&L..........&.............[0PX....a.p.......=.].w.[Ql]!...h...oii...ill.!....k!.j...{3.......Z..nnnf...X..E.<......mR.L@...v.Q.G".Mq...[..j8..8ja.<......e.Q..^j...P..[X...9}......}J.x..k.|wlV..:...{.....%../.V........`}.0}d*}..#S.[U.V./...:.Kbc.Sh.:..c.%W4.L...........\...........A.1...J.k!...... .....Xt....M......<33.4....0"zl....*.#.w......:9.k.d....._!1......N.4...........I......f[.OLLH...0...kjj..,..m6.....f5...'......>/.[U..U..(...;.Mu..I.....IEND.B`...

<<< skipped >>>

GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.ak.fbcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-MD5: mQCwCAAKHD AV8oddNLhdw==

Content-Type: image/png

Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT

X-Content-Type-Options: nosniff

X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=

Content-Length: 1329

Cache-Control: public, max-age=16118759

Expires: Wed, 04 Feb 2015 04:31:23 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

<<< skipped >>>

GET /do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=595450 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Date: Fri, 01 Aug 2014 15:04:00 GMT

Server: Apache

Set-Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; Path=/; HttpOnly

Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_TURNKEY=Default-641406905440442383; Expires=Sat, 01-Aug-2015 15:04:00 GMT; Path=/

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:04:00 GMT; Path=/

Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:04:00 GMT; Path=/

Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:04:00 GMT; Path=/

Location: hXXp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html

....

GET /do/SDM?action=config_7_5&contentId=595450&type=EN_NO_TB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:00 GMT

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html

7f9..<?xml version="1.0" encoding="utf-8"?><Response><ContentConfiguration id="595450"><IS><Url>hXXp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender.exe</Url><AddOns><Param><ID>""</ID><Name>noaddons</Name><Priority>0</Priority><Checked>false</Checked><Dependencies/></Param></AddOns><CommandLine/></IS><SDMVersion>1.0.0.22</SDMVersion><PromotionUrl>hXXp://player.freeridegames.com/product/SDM/SDM_standard</PromotionUrl><ReportUrl>hXXp://player.freeridegames.com/opTools/clientTracking.jsp</ReportUrl><ConversionUrl>http://player.freeridegames.com/do/conversionTracking</ConversionUrl><PartnerName>Default</PartnerName><ProviderId>148</ProviderId><ProviderName>FreeRideGames</ProviderName><ClientVersion>7.2.0.0</ClientVersion><EULAUrl>http://player.freeridegames.com/do/general?Partner=Default&jspName=licenseAgreement</EULAUrl><ImgServerUrl>hXXp://img.exent.com/free/frg</ImgServerUrl><HeaderUrl>hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html</HeaderUrl><MyGamesUrl>hXXp://partners.freeridegames.com/my_games?gameId=%GAME_ID%</MyGamesUrl><StartPageId>SDM_EULA</StartPageId><Type>EN_NO_TB</Type><Game><Id>595450</Id><Name><![CDATA[The Secret of Margrave Manor]]>&

<<< skipped >>>

POST /opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:00 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=798

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:00 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=798..Connection: Keep-Alive..Content-Type: text/html......

POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hXXp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:01 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=797

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:01 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=797..Connection: Keep-Alive..Content-Type: text/html......

GET /product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450 HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: player.freeridegames.com

Connection: Keep-Alive

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:02 GMT

Server: Apache

Last-Modified: Wed, 13 Apr 2011 11:32:31 GMT

ETag: "300000000521b-236c-4a0cb2a10245c"

Accept-Ranges: bytes

Content-Length: 9068

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=796

Connection: Keep-Alive

Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">..<html>..<head>..<title>Progress</title>......<link rel="stylesheet" type="text/css" href="hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css">..<script type="text/javascript" src="http://cdn.exent.com/freeride_marketing/SDM/SDM_standard/js/defines.js"></script>..<script language="JavaScript" type="text/javascript">..function checkIframeSize(){..<!--...var viewportwidth;...var viewportheight;... // the more standards compliant browsers (mozilla/netscape/opera/IE7) use window.innerWidth and window.innerHeight... ... if (typeof window.innerWidth != 'undefined')... {.....viewportwidth = window.innerWidth,.....viewportheight = window.innerHeight... }... ...// IE6 in standards compliant mode (i.e. with a valid doctype as the first line in the document)...... else if (typeof document.documentElement != 'undefined'.... && typeof document.documentElement.clientWidth !=.... 'undefined' && document.documentElement.clientWidth != 0)... {..... viewportwidth = document.documentElement.clientWidth,..... viewportheight = document.documentElement.clientHeight... }... ... // older versions of IE... ... else... {..... viewportwidth = document.getElementsByTagName('body')[0].clientWidth,..... viewportheight =

<<< skipped >>>

GET /rsrc.php/v2/y1/r/LVx-xkvaJ0b.png HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.ak.fbcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-MD5: mQCwCAAKHD AV8oddNLhdw==

Content-Type: image/png

Last-Modified: Wed, 29 Jan 2014 22:40:52 GMT

X-Content-Type-Options: nosniff

X-FB-Debug: sKdoaTXW8 jWmKQEyhAg p6vY/olbyNkue0m9cwmXTg=

Content-Length: 1329

Cache-Control: public, max-age=16118759

Expires: Wed, 04 Feb 2015 04:31:23 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:33 GMT

Connection: keep-alive

GET /free/frg/products/589550/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 19 Apr 2009 06:44:48 GMT

Content-Type: image/jpeg

Content-Length: 26276

Accept-Ranges: bytes

X-Varnish: 1111897187

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d....................................................................................................................................................................................................................................................!1...AQ"a2#.q.BR....b3C....S$T...4%5..r.s.DdtE.&.......................!1..AQaq".......2..BRb#...r.3......c$..CSs45.............?.p.re...`..............l.R......?..._........|.Q..y..l.V..S......9S.U..."..>.u.....V.*..WJW%.cMa....J..Bh.....H?j.jI......Q. RPn....5*'..3.P.l..o....LBN."..G..<B0.......b............7.....p@.....8.<.uUU^...UW.\J..fD....7=..(....q....h......W..z .M*.v9T.E.....#......>.j..H..c...q.I..).H..k........z.............x...7l..'S......:.._c...U...{...W0.QV...h.q.....i*.r..rG..m%..Y\...&.^T.H..B,....".....*.sm.g....B..Q.....e....ch.....3.A.\..........2=\*.k.D.2K.....2O.E...*..zr]...D..~W...o........1k........y.).....vA..|.b.lC.|TEL.T.k."...N2.....o..a.a.wQGN..8\..\..^..T.vV,...a.X.....h!#._1.Q.Tw.wN......:9...W.?t..l!...=.1...2.. .S..../i (.....~..\n.2...j..Qf......h..B....d.g...0Z...i.4..t>K..4^-.01.DZ.Q..e..D.D.:....I..Z.<....."..h....Mu..P.)c..h...N.SQ]n ....~.E_........YM..|.sutt...g.s0....]7y. ....""|W..t.V..O.......r..g.....=$.N.2.5...DW.>]7.....].U*.....2.......c.\*U$.0~>......."..g..h.T....v..5.......59I...K..N../......J..U].. ...q..Eh..,s.l.%..!.=-.M4....*/....[v.|.K.Z...o.G,..cd'...l./,?.... C3)..N...k..."...'.x....U.34..M|t.......!.6.:.4...d..{....j.1..*..Y.}OE{: W..ya.^/Q

<<< skipped >>>

GET /free/frg/products/582150/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 26 Jun 2013 10:47:21 GMT

Content-Type: image/jpeg

Content-Length: 38149

Accept-Ranges: bytes

X-Varnish: 1111897231 1111052407

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6F9A17903439E211955FE55656C7D978" xmpMM:DocumentID="xmp.did:2564C0E0DE4D11E2A95ED3BB7153D468" xmpMM:InstanceID="xmp.iid:2564C0DFDE4D11E2A95ED3BB7153D468" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5F9B6107DCC611E295048EF1D728ED69" stRef:documentID="xmp.did:5F9B6108DCC611E295048EF1D728ED69"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d........................................................................................................................................................................................................................................................"!2#..1ABR3..Qaq.br$.....CST....cs4%...Dtu&6.....d.5.v.8........................"2..BR...br#!1...3$...AQ.C4.aq..S%....cs..DT..t5......6.....U&'............?.....|5..M>.......-...._...x.>........_.|......Yi.Uxz<~....}8.b.M...e....."^6I*..r8r..~.m...G....O..n......?.W.......!.M..)..Y.U3.q]

<<< skipped >>>

GET /free/frg/products/661650/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 22 Mar 2011 12:18:46 GMT

Content-Type: image/jpeg

Content-Length: 28217

Accept-Ranges: bytes

X-Varnish: 1111897217 1111051928

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......J......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..Ã„S...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?...J.........V...>.r...G..^G.C.H#.`....J.I...F.....x....A.L=6.............../..... .W.j..Ou..Ek,.qZJ.9.%R....S\997.....<.>.<......H ....)...........fa.V.......3...^^..$.......BT..<@.....|#..\.....f...../.^.^M2.y{R..R...i..Z]}b.......@..aU.w./......#..k..@...e.&...I4^.\.NbD...@.. y"....8a../5I.#K ...-...G..$.......~29>.............mR;.<...?.......T.......%..siI...C~..y...E..S.>.e...bK{.k......a'%....'.G.,...w.}5.C.... .B..z.3ZhZ...g..sq/(.8`J..S.....Y..r......s..s..'..]*.X.!....M=...o$.Zi..K......>.J............X..z...#qBI=.r..K/...e....,....Uf..............U~Gy..Z.......k...I}E...r.....J....1?...54Y.b..9..\,%.........I.lC...N^p......yc;. .........J.....SXC5c{..bY....nb..=2. G6b@.cZN.....{m.R..W.k...6.#.....Rd..,..#R...m,....y#.............%..Xfy..b...".s..{..9(..XZ._k.........HY@"..J...... .w}...8...?..........[.<yz..Cc.s..S....w.@y.;:J...W..f.....@.?.5

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:31 GMT

Content-Type: image/jpeg

Content-Length: 58728

Accept-Ranges: bytes

X-Varnish: 1111680955 1109957715

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:05 GMT

Date: Fri, 01 Aug 2014 15:04:05 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:B22AB4A0B36411DFA9EAD1B5118C216B" xmpMM:InstanceID="xmp.iid:B22AB49FB36411DFA9EAD1B5118C216B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|..............................................................................................!..1Qa"A2..q...R#.....Bb3..Cs$t.%E&r..DT..Ffv.....S...7.c..4d.58.Ueu...6V'.........................!.1..AQq"a...2....R....Br#D..b3$4...C..Sc5................?.....Y.....b.........?.h..................H....;.P.g.H.0}.....1.".....$:

<<< skipped >>>

GET /gtm.js?id=GTM-MJF4W9 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googletagmanager.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/javascript; charset=UTF-8

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Fri, 01 Aug 2014 15:05:24 GMT

Expires: Fri, 01 Aug 2014 15:05:24 GMT

Cache-Control: private, max-age=903

Server: HTTP server (unknown)

Content-Length: 10698

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

...........}.W.;.......>...7..n:>@ .&..Kr....V....Mw..b...JK/v;...3..9.7sqK*I.R.6-).....K...E.Z.Z .....^8..Ra.0(........./....0..!.._x..FC...bv&C.A.|"]....m..g:}.9.Q.n..Z...&..........Y.So....zW q....=.....-'..z]y.A....z!.h...^..s..1.u...uLc...,2\.. .0.......2.....bI........,.Q@...~|W....(.a..ht...a...`.}..Z...W1.6`....n.0....N......$..J.>.Fwkk.d.....o.&..x.c|Y) :.A.r..A.<...`W..LC6fX....=V....v...oB..J..3o.. ...;....".....X ...Eq~R.d..K3....3..Y......%..............&..J....=...`...Mj{q=5.... .".d!...0]..,.oj.H.....3.5..w.N.....w@U..f6[.u.,E......,.G)...kk...e..j3..$..g..!.z...F>0ns.Q...q.QB..LS....,.i...iz(bj.K.....T-...7...V>.@.8_C........&<x)<VK..j.d.......^...`.P..Hi....K..[F..!/......R.|...y0..8.N..d....j.M.(..h....{.<.n.er...@'...R-Q.D.`.............P....5.V..p.FO<8.!7-[....e./.....h..ix...\wPqF...Z. .UW...........W.&|..KR....V.(x.:..F.p...F....T'F*..Tn.0.....\'>wb).Z.1..;3.,.t@....%WHX.q.....uW.....fd0O3...tj*....6[m.uf..`.L..C.-1KV..m.......nI.......u[m....../....R_..&..;_...\...&X.>5&.uF&..../.....<......;#C..b...eq..3z..32... ..tQ.Q...%..'{.........s .......Ea?!1..R.d.5.H.y.).&-.|<........)..G.K...&,...j.......2..AZM.....,.V.u.#........>............{8 .......!.*.8..(...C..........[!.[....;.....8$.IA........V.gv..J..0.`.<.F7./....(0.....6...v...j.H..7W.....;..\]&].0..)JV]a.c/...P(..&..@./-.n..`:.....-%..,.X.........V....C99H%(...P..gI.`V...8....Lc....N.{Ls.. ..x[._.....q.....4}.C.*0...../..W!.....N.j........$.vE.Te.k...Qm.........^..<..*.M`.}.....hq...

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard/css/SDM_HEADER2.css HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT

Content-Type: text/css

Accept-Ranges: bytes

X-Varnish: 1277530684 1277300854

Content-Encoding: gzip

Content-Length: 301

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Connection: keep-alive

Vary: Accept-Encoding

............=O.0..gG......IShQ.....,..*'.8..m]........hG..^.z......g.y...{.\p...,-...Dm...=?.%c,.~.L.m..R.>".T.....j.....(...n.......Dg...L%W..<z...2... .l!...Yk..S..h.;. ..Q..=8*..)[.@.`5j.......{.UO.)..4.]v.X|.}...n.%..-B.I' ..'.4.u..@.H.>Xy....:>.W.f..*;.bv........1..1=..i../o^........8U...$.:....HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT..Content-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1277530684 1277300854..Content-Encoding: gzip..Content-Length: 301..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding..............=O.0..gG......IShQ.....,..*'.8..m]........hG..^.z......g.y...{.\p...,-...Dm...=?.%c,.~.L.m..R.>".T.....j.....(...n.......Dg...L%W..<z...2... .l!...Yk..S..h.;. ..Q..=8*..)[.@.`5j.......{.UO.)..4.]v.X|.}...n.%..-B.I' ..'.4.u..@.H.>Xy....:>.W.f..*;.bv........1..1=..i../o^........8U...$.:........

GET /freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT

Content-Type: text/css

Accept-Ranges: bytes

X-Varnish: 1111680717 1111348487

Content-Encoding: gzip

Content-Length: 347

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Connection: keep-alive

Vary: Accept-Encoding

.............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...0(..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...n,..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...(...@1..X.....Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$.....PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$............HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT..Content-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1111680717 1111348487..Content-Encoding: gzip..Content-Length: 347..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding...............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...0(..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...n,..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...(...@1..X.....Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$.....PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$................

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT

Content-Type: image/jpeg

Content-Length: 90657

Accept-Ranges: bytes

X-Varnish: 1111680933 1109709205

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:05 GMT

Date: Fri, 01 Aug 2014 15:04:05 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:AF514043B36311DFB23FC5759A59FD89" xmpMM:InstanceID="xmp.iid:AF514042B36311DFB23FC5759A59FD89" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|................................................................................................!.1a.A".Q2.q...#..V.BR.3.$Tt..uF.......Sc..^U.&v..brCs...4D7.8....e.f...6d'.......................!..1AQ.aq".......2...BR...br.#3.D....CS.4T...cs.$..5.t.%..d............?..g.....e=..WN.tu.U...N..V."(..".."(..".......J..<.P.

<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2552

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

tAQAAAAAAADBewCAeQAeAAkAeQApA4YelAAAAAUAAAAeAAAAKAoAAAIAAAeTZXxGa8NlIFehYGqCMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAA1OTUHODUGQTMzODUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:04 GMT

Server: Apache

Set-Cookie: JSESSIONID=6E8F644F8AD594DDDD847D9798CB7234; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1

0..

GET /free/frg/products/680950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT

Content-Type: image/jpeg

Content-Length: 17864

Accept-Ranges: bytes

X-Varnish: 1109304790 1107277168

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......S......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..Ã„S...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..y7..k.5.......P .$...................^.D.......=:....V...6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e......6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5.........Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... ....z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5..@.sq.}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q....^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb ..6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2

<<< skipped >>>

GET /free/frg/products/524350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 05 Mar 2009 14:05:07 GMT

Content-Type: image/jpeg

Content-Length: 29022

Accept-Ranges: bytes

X-Varnish: 1679247317 1678275182

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......S......Adobe.d..................................................................................................................................................................................................................................................!.1.AQ"...aq.2#...B......R3$%.rCb..4&.......................!..1A..Qa..q....."2.....B.Rbr#......3s.Sc$....4D............?..;.....=.... *...-.G5..YJSU!(......#F..K..H.........IU3.Ls.....Q.x....a.....[>Q...'.......1...zBV...o.J....j...gb.Q..u.C..M!T......"7Z.e.3............a7...s...v.........~p. OMhTv...P.q.]..t&..,.3..\.I ..'..M.7V..v.yq(fx..3S.b.../.}........S.J\..}.q.!..u....Rk..).bk.O.q.A.m..k.1o..t......U.....P...........t.._.LV .(.%..>.r|......[.G*).V.l...==.J..un.\..<....A.W?..` ..>....{.9.s.p..P....!..n3...F?tZ.Rmr..........x...C.c....{...Q....(.`YM...u...:.A.Z....SU).J..H.i..z.{..$Q.....H..f......j.Bv0>W.-.J}...*$......f....teizD..{u.).p..n$V.]y...BEN.'...H.V.J..Y.0bI......*..)Ris..!$.>c".&...T.1.Ty7&...6^MO.........I..v.`5.5.Z...9.<.......&...!.......q..}....qc..N..V..@uM.*j...P...B..../..].w...<..=..=l.....H....bI.c)...........o...D....7q.R.....]@.>."..U.W.sN.M(u/..6d...........A..oG...{....{]....v.......e.......?.....X.".:..`..#.v3..R.x..ZBTh....{C{.uQF.F..d.$......m.....Rx.....^.T.f......X...c...sP.v;.A)<J.... Ji.~...V4.]..1..x.{......Q..E......8..........$(qJB-...xmF..-S.,D.]...........S.S.F1;q.....h.....CmY..fBJ...t...H$.P..........y...j...e..6..w....S.W`.Iq...ko.[.."^3m.1.Y.!A.M.%.

<<< skipped >>>

GET /free/frg/products/761850/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 26 Feb 2012 08:56:37 GMT

Content-Type: image/jpeg

Content-Length: 12469

Accept-Ranges: bytes

X-Varnish: 1111897241 1110148689

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90....C....................................................................C............................................................................".........................................D..........................!.1."AQ.2a..q..#3BRb..r......$CS...ED...................................9.......................!.1..AQ."aq2...BR.....#..br.3CS.............?...@.A=......4.....H>.J....I.g..H...,..H.8W...QHM..gRZb.......H.Z.D.&.T.O..<.......j.f.~..P..H...T8R.W....G..G......U..7Hk.X.%.7.cC.8%.q........F3...u..).....w..O.NHA?S..............}.W...M_.yv%..w>..w. i.....!..W$....?..S..v..kEE..2.LbUNx~..c2.......?.}....]|..6....v.......A....h.F.=.}.)5..5,8..*.z)'U}..{.....?.........b.S..._..#.b?1._E.....W.T.{*.~.x..l..'.:..v.5x...f#;,...N....gh$e .@=.....L...k........J.R.l.^..,...n..F.U....E.I..PSBBF.d..X8..x.Sa....L.1..........i.eL.9U....2g...[.D.....T...h..........%.8.."..'.9....H.....w..-;...?.g...%HP...c...\.2;j'U.x..$......1.rq....^.."..X.$.....q.s......Q...tY.;.i..]....Ns.......e( .v...P.8..& .VMH.O...F...:.EQJ....r7.........N.x....%.. ... ls.k......................6.DNV.F.Y..L...A..im.-...h..P.k..Q..U...{j...:oNm.....*....P..Q.a>.dd.....Lu.....u.!.......-....2TT=...>....t...u?p...j......S.Bo.@...d.Q\Aq.E...R...{OA....KCe.......I.1.'.(...z.U.....J"..n....H._.....N....N..\48E.M...R..d.....@.......Z../1.....R../......(>d...~:...6...].0.ASe.I...'.E.m..%N..q.{.'z._...RB2L{.s..t..6...v.n.). t..uB.@S......M .\'...b.Z.)xr.

<<< skipped >>>

GET /free/frg/products/699950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 15 Sep 2011 12:15:43 GMT

Content-Type: image/jpeg

Content-Length: 16837

Accept-Ranges: bytes

X-Varnish: 1424314704 1424231860

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:26 GMT

Date: Fri, 01 Aug 2014 15:05:26 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......X......Adobe.d.................................................................................................................................................................................................................................................!.1..A.Qa"..q..2#....B.Rb%.....3C..s&........................!1.A.Qa..q."2......R#...Bbr.....3C.S$4............?..K.'.r.d.".79.X&.:F.. ..&..ww .)[........8......E...I..o.C].I.8*.P..P....O....[B....D....R..eIR....:..:\H....b.qk...7..z.2.....\Sn.Fw..$w$.).*aHl..g .....S....SZ...t...l..|.q.O....8f...E..ul.G_.4.:....s?.4^..sFoi....F...2..v...?.S.q.L..Er......OEYP."D.;.....w.....MDO....]*...t..b.N....a$Q....;...l..!.gPMg...R_....i...)TW.R.k.J.....G.h.Q.h...&.P.-.K.Is........_..4.q......-5..O.M.M..n..<......'..8..(..z..0'.=./R..thT.)@.......:.M$s$.....}C......{.k.u.*.>.}..1p...1..W*......[..B.]j..*..z......8.z..(U.]....$....tP..>=4l.......M.@G~s...[......:...s... ..Pz..D.I.V..#....m..b....B.OGW2!:.UP.t.V.Q..u...i...WJ&.V.....u..b....4.T..N..Rz.$......p.V.zzi'G~<.G..;..`...P.(.lG......|...`.........d....7|A0.Q.C....u..q...Dk../e..m..:Lh.r.:XA.%^....u...U`.I.5.j.lQ...QXV..we.2....P.......b5.?l.uNW.O...{..m.[...C...N.?O......*2 ..=.7N.."....Rcv...&..Wm$.W.....tE..'.....ov..II...5UG..6...X.........)S..cE^...=I.z.}l..".....Y.CGY..3"5.(..*m......UH.b...F...%.Kv!.q....E.O@~Z.ArQ9. B.S..w\..8>.,....F....n... .W.l:.iOb..SC].I.E..U(.K............;.N..i:.....Z...>.Q$...m...;...UO......Z.Zi.:..F."Z}.%...(.{gs.h. C.......P....

<<< skipped >>>

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=7287786-9717047

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Content-Type: application/x-msdownload

Accept-Ranges: bytes

X-Varnish: 1926374367 1926325909

Expires: Fri, 01 Aug 2014 15:04:02 GMT

Pragma: no-cache

Date: Fri, 01 Aug 2014 15:04:02 GMT

Content-Range: bytes 7287786-9717047/12146312

Content-Length: 2429262

Connection: keep-alive

Cache-Control: Private,max-age=0

HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 1926374367 1926325909..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 7287786-9717047/12146312..Content-Length: 2429262..Connection: keep-alive..Cache-Control: Private,max-age=0.....bK..h...ss...KA....&.uId..d..xf.[..PLDa... n.............T..T.7.z._!.-...P54......#ti.Y:k.;..}.Xja..cFa|3.;....Q.=^C3.....u.`...8..p.......`~zoR..w(..A^...~.$.>A.q...N..D0gtO.\...\.)....,n)X.|....Z...N..m....$.v..694....9wM...K....I..De.s....8W.../1l........-mW.kC.\.sK...Z........i.by.......X.........K.........`.&...I&....$....3>.'.[zu.s.n......4:...".....z...= ._..t..s>..&/(.Co.y.f....Gj(..z......OZ.mF.l.Jc..\%vu..'z.5J.P..4._0......(...^i...^..>!42]~.EQ\9........zMT...o-..D....2.,1..%..$#.n...-_hN...Ni..j........mU.......`...k....WV......"..R.j.......uc..qW.../...J.}j.]..g...F.f.U`._.".9..-..1....l....A..] ...cW..Z.,.........%.g....k.t....7(B(...&.......oS(..I.@...w.n......S.gk../.......H.5>.O...B)..-.]..x>q.~..M...gD..4..Vn<..H.H.p...0yl.<0c0m....V.{....L.4..rp......Cz.t...`...8...6 Jj..F]#&.<@.2...l.....ssK...K.m....d....."7..U././.Jo.....d. .v.....}K~i".9.-J.!.o.....,.@,.G.T.\...#.u....n2]Wx..y.}.-.{3..N..i>S/..G.!...=...|.....Y,...... .....F..d....>$...W..L..K.....BC.....efO0DK....-3....jd..D.......d.v...f4.....d....T.a...3..A.E.Y.......^izv.J^.K.J.#..]).{.m....=".D...Y.$..x..(.o3

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:28 GMT

Connection: keep-alive

GET /free/frg/products/668950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 21 Feb 2011 15:39:31 GMT

Content-Type: image/jpeg

Content-Length: 23666

Accept-Ranges: bytes

X-Varnish: 1111411910 1110267205

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......d......Adobe.d..................................................................................................................................................................................................................................................!..1AQ.a"..q.....2...B#..Rb..3r..$.....E.........................!1..AQa.q"....2...BR#....$..b3r..C%.............?..GA.|#.....F ..<......\0..\.....p.y.~.....>y..?<.O.......~..0(P..!......=........A.G..~#..e..~8.zx..G:............\'Z..T...>..H`........TA...<9D....E.....G.0.nC.r8O...ZE.'<.q...<.P.<(.........V...C.Q.=G...$.t.>.q..(.....o>.....s.u....CF.._T.xU.*Ky...?.....c.}..A.?u............?....>_..._..............|....,....|0....!B..G..w...$.....~.........|.........<%I...B.k..?.....p<(P......p5.K...@...U..H` .x../X....y..!.',c$.u.bP,y....2...2...@9Vu...9..#.....8.d&..s.Q......=M .....k .``#......$.j....Y.D...>P..d2yV..k.......y.......X^.........|xq.../..i:...k.e.x.....W.....o........q.....0D..T...K{Q.:.."p.@~n..i4}.........ck.v.C.yt...\..t4...x.?..g.,.........~#...W.t4j.yP,..L>.c...0.@.^&.A4]...............k...>...CV..0..(.f....z...DR...4a.>P...!..p.KH[.. ............i..~..'R I.Y.. ..C....<jJ.{s....iZ\u. #....H...A...a............K.mY9.V<N....'......u!l..............<..u.....E.m.x......a...4.=G..~.p.2<.1..yr.)LFC..0...../.L%...m-D|#..!..........$...$p...0....An5..*... ....>.....I.hv~....0e...K.|.....!..oqO4.:|(.9......m.E..Z.......a.....&..9q...Q........=...G.

<<< skipped >>>

POST /do/gateway?sId=Default HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:52 GMT

Server: Apache

Set-Cookie: JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4; Path=/; HttpOnly

Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:04:52 GMT; Path=/

Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:04:52 GMT; Path=/

Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:04:52 GMT; Path=/

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Length: 38

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1

({"gateway replay":"{'status':'ok'}"})....

POST /opTools/clientTracking.jsp?trackEvent=playerinstallationstart HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:53 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:53 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Content-Type: text/html..

GET /free/frg/products/563750/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 13:28:54 GMT

Content-Type: image/jpeg

Content-Length: 29430

Accept-Ranges: bytes

X-Varnish: 1110064354 1108874112

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE211955FE55656C7D978" xmpMM:DocumentID="xmp.did:0C1B73D5EA2D11E2A18CEE3F989F8A24" xmpMM:InstanceID="xmp.iid:0C1B73D4EA2D11E2A18CEE3F989F8A24" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:90D37B62E79B11E28D69DE4027E5AE9A" stRef:documentID="xmp.did:90D37B63E79B11E28D69DE4027E5AE9A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................................................................................................!..1A"..Q.aq2#...b.....BR.3...C$4%5........................!1...AQaq...."..2B...Rb.....r#..3.4CS$............?...%.:..\.......(i.J.J.R..Hm...>.S].hq.=.,.....I.TW3."}.Cb.F...3'..R...N.E...3..... O......R..%.DwR[.J@."...}w...!.@K.x...8..`do....._..&..fX6D....E...N.9.qZ.HT7....j.6.....U4!.q...,N%...%.

<<< skipped >>>

GET /free/frg/products/645050/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 27 Sep 2010 13:16:46 GMT

Content-Type: image/jpeg

Content-Length: 24320

Accept-Ranges: bytes

X-Varnish: 798420471 798402511

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......X......Adobe.d....................................................................................................................................................................................................................................................!..1".AQa...q2.R#...B.t....br.3Ss$%7...c4T.u...CD.5..&6'8........................!1..AQaq....."r...2B.4.R.#3....bs$%5......Cc..............?...w._....YE"]S.Q,@IP..R.t.?]><h....t....GL....d....x..D.{}....j........].c.e..Z.a............J.....J...L.. e.@.P'R.h...[..M.[.....1.Sb=!6....N>..%....y.S....z.....{k...a..D.../...5..P.;D....D..........].lvo.C..8......l.Ej....R....q.S.$1#.......9...)..6.P.-2.M..`2.-..e...uT.@I.n.n.|k...... h0.....,Z.1e.b....%.XuL..2..q.R.C.QJ...<dUt...6H$i.n..b..).7s.Zv.s.nzDV..hN..6V9...G.\......b.?..\....@O.$2.......B....<...%jO...<#(.#.o.8....e;...SB$.Z..i.p.T.......">%.....}......q.i...g{.......J.z....Y...Hqk_Z....m$.I..nq.>$%aR-.]:m.......Q.%`......x...]...vJ.P....w.0j.....}.9*T.n..8...2.](AQ.!>e... ....... N...L.0qUV..V....?.n.......QS.l.^V#..D.W....[...;..Y....i................j...H&S..%.S......kT...e.{.....Z....j.)..ss.gC...x.....,.I.b...q.l....{T.'...>.S.a.Wx1..|.o...r.<..>...e.......s..&*f ....F.mhy..}-..t.h....`x'A...`..Q!...2...bg............&.E.!.8m$EEm..z...%..0.<.O.4.cN..qI.wFk....J.B...yk...XL`..5....&.=zkM.NG....$I.W.=.k.....;be.>\a..R.:.......GX:..k..xA.8x....'.|y.."..~.'drB..........~Q....o#..(..W. ..........t...o.v4......dv.-%E=...2;........

<<< skipped >>>

GET /free/frg/products/578250/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 26 Jun 2013 12:33:39 GMT

Content-Type: image/jpeg

Content-Length: 31460

Accept-Ranges: bytes

X-Varnish: 1679249247 1678506895

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8E4D0DB03DCE211BB4FB0C483C69A6F" xmpMM:DocumentID="xmp.did:E13E1744DE5B11E2ABECAE40EB182E57" xmpMM:InstanceID="xmp.iid:E13E1743DE5B11E2ABECAE40EB182E57" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AA4F045ADCAA11E2B008B337C7D9C0AC" stRef:documentID="xmp.did:AA4F045BDCAA11E2B008B337C7D9C0AC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d......................................................................................................................................................................................................................................................!..1.$.AQ4.a..#DT%5.q..3d..."tE&.....2BC..U6.re.F'.Ss....Vfv.7.........................!..1A.$...Qa4DT%.q....dt5..."..E....2....U&6..u.Be'R...F7(..V..............?....w..k.8.tk../..N;..|.r.O.2E.WC8O....F.De_n.............O...qU)..y.z.............<..f..r..&..Mi......... >..sT.-.....6.....b...b

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:05:06 GMT

Connection: keep-alive

GET /rsrc.php/v2/y7/r/j0a7CRWp-Sa.js HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: b.static.ak.fbcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript; charset=utf-8

Last-Modified: Mon, 01 Jan 2001 08:00:00 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Content-MD5: MgEbNIV6xAPVxsNV4TTerw==

X-FB-Debug: YfDCXj1hmqpEFIqSlYah5nkeJh84VFS2zPnv/7EaiwBC/64qhfj7URdeE6OBgvz9PThqLpeQ6QN5L5zUSdocuA==

Vary: Accept-Encoding

Content-Length: 64284

Cache-Control: public, max-age=31273662

Expires: Wed, 29 Jul 2015 14:13:06 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

.............c.8.(..~.....I.h.N....7...9.n.L......h..E..dK....Z.. .%3....^,..Z(........^.w....~z...gO~>......g.?.....'?.?.....75;....k......d0.R......l....Qf.....yzy.qZ.G,o..LS...3.u.7.f..fa....J..<.k....7kL.d.....1K.gi...=?. ..Y..2.....zl....rVw~Z.....]..>.....u.....^Z..Z...U.....!8.<z=m=.Q..D......g'..?....xv..t.>>s~......(IR...n.u;-1.....)....:.i9....YAI.....qK~...0M.kqp_.../...wZ...;.f.0kDA<.....\..=tZ7.q...<........ja\."N..t......$Hp......dT..j..{CgCza`.E./.m.1.f......@.ptP..vG.PX...a.P!....J.9..t......\......t.T...C.9.K.:.H1....b..F.....:.2.Q.x..........q.hn|X...f.<.0.,..NU...c.<4..1....q?X|.q6....]...u.....7.O...7.>.n...w.F....!.M.C.$.&.x|.......qg.k.}..u.4..=~..x@..-E.q.(n......#.{..$.Lv;..4.l..@z...1M..F................'.....$.g.j/...G.u......9.g. .Co..;=.6.....r../...1.w....Z.0.i.;....`M...WFjN6.e .....V-.jq2...<k.A.!...e.U......9t...............@5....}.9M.A:.}.......Y1..xZ@!i...8...).|....`......`TC.L..e.G...........B?...1.,.......p0.9[........._........G.H11~o.Y...{G>x..&J`...v..`.5....s.t^_...........\.[Q.6.] ...t...'...sk.^A...<...A.I\....X.....p...-.{...z...s..99.....v..GG4..q.........m..i....d..55.o......b[.... .Yo..4.!.f....]..&.....vWO_....~-...1.<..o.&.\QM..waNs.................?....3...08..z3 ..o.T...g....U.5G.I.y%..Y...\...<9.....[D...".<l....................ul.}[..!.gC.pV....>|-|.#...}i.....,..v.........1...-...X?.']..J...$..x/..0A.. ..}5?.......?.....3..........3.......i..~n..._.....|J/?..Mp..on0.~n:'.Xo........X..\-~....n...x..N.[YW].

<<< skipped >>>

GET /free/frg/products/595450/boxshot_sm.jpg HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 27 Jun 2013 06:36:07 GMT

Content-Type: image/jpeg

Content-Length: 3913

Accept-Ranges: bytes

X-Varnish: 467849060 467652213

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:01 GMT

Date: Fri, 01 Aug 2014 15:04:01 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8E4D0DB03DCE211BB4FB0C483C69A6F" xmpMM:DocumentID="xmp.did:37B0D717DEF311E2945197C9A349E208" xmpMM:InstanceID="xmp.iid:37B0D716DEF311E2945197C9A349E208" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:78F7FD0CDCA811E2B081EE85099AA43D" stRef:documentID="xmp.did:78F7FD0DDCA811E2B081EE85099AA43D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................<.3...........................................................................................$...4.!.D%5.T&..d7.AQ.#3E6.....c..Ue...FV'............................!1Qaq$4A..T%.....Dd..5.......U6............?..v.A.\>.0...}...........v..yZa...>,?l..fDn..l..vX.l.I.J0..8......RIyrI.......B..F..p....X..1. ..f...........m2v......'....._.pvYq.#..[.^.*Z.I..0..............l....(.....x...s.....^..

<<< skipped >>>

GET /plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/oDB-fAAStWy.js?version=41#cb=f235e51c83d9c08&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffb4bbe1e11d138&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 HTTP/1.1

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.facebook.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Pragma: no-cache

X-XSS-Protection: 0

Cache-Control: private, no-cache, no-store, must-revalidate

Expires: Sat, 01 Jan 2000 00:00:00 GMT

X-UA-Compatible: IE=edge

Content-Encoding: gzip

Content-Type: text/html; charset=utf-8

X-FB-Debug: NJW5uIlGzuuGb8v0WPLpbhVOtUkQdQ9juZ3DzV8BnncVkXIogjvnc2uy3PPF2BAH8oj21lut95NPM7DNLB6LvQ==

Date: Fri, 01 Aug 2014 15:05:22 GMT

Transfer-Encoding: chunked

Connection: keep-alive

1ae3.............<.s.H..._.U.....|@....k...8...I#.. ..qX...=..!.o^}_..r..g...o............4........#.d..@.\{.;..f......$..A8.MtD..~...)..).....Y..wu.)....H..C....D..4.<.:d..|.D...`rb.n..|.._R7....A..&.~....a..c#.f.7X......,..iL.$"1l8..i.x..`..6....nkb.....].~.R..3..A{h.I.....xn@.....3.q.V....Y..."R}J..4......ObXy..F...`..R:O..s'...N.[..J....x8.\ .i.tmw@}..lS...i..n..R.#&...z0.Hm...~...9.........,.&...a....i....b...$v.....'4v.!...?......i..v.i....i..n..9B7..l....*~..,Y.7..bz..ZkI.ra....;.fq..Q....\z6...0..!....\...L.....pd4f.......p..(A......Ngi...V...Sy.....y..M....z..QFN.8.i.b.....>.|.......C........[.A.^ ...Q.;.|@....].`..PX.@o....^h.)...k.r......k...>fv#w...l.$%.1...@l...LP..:^/..>f.E.....e.z..%n.X3Q~..P....nJ.`..J..[6.....z...x..TC...G.V.h....,`....lX..HhJ.a.2KCqd....!.g..j.N..........t.(.S..*..0.y..(.S.%.E....n....p.....sC..Vo5E .}.0....?1..HJ.\...e.g..g..E.`.z. \-.xNcf)l.....8[.gR^J.....|.:@.>...N...^...n..../..#5rq"....F. /.su.UuC[.U..S...m9..S1P`U....x.Y1..V.7. ...7.c6.}A'!U.g...9..4..x.."....X.61....7ax3w#..<.. %......^`W.....<....c1.4.<o..pL..5.y.$...l..y6Td>.*.?.[....Q.....D..'...I.WEP.(.HA.r. .9P..... .n..Dx.}.8n..5..i.Z9.3`..........VCE....RP....ByR....;:..Z[...P..f..l|.....,'.) .0...:._..&B<...N X....:.&.,.@.Fm..[..Y6f.......e.-..$...9.#......|.$<.....:.OkW8.SH..iA6|...:.S3........Ij....z[S.._rX}!..:.#...P.nB...........'...uu...e..y..9..Y&.K.....q...... .V.....'I.Bi.S5'..k'.yku...9........ T....A...C......$;...g..^O.5..#^?dl8......L..x..V..y....@Q6.. #[...2..KG.

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 3330

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

.PNG........IHDR...1...).............tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.did:4E25B844FBE211E19D22C37B1A58EBB1" xmpMM:InstanceID="xmp.iid:4E25B843FBE211E19D22C37B1A58EBB1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18547691F077E1118511BC5C7C940756" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>?.u.....IDATx..Y]l\G.>g.......IJ.4)..J...KS..P.!Q.......'$........Q.*H..Z.F.ETi..RZJ..B,...sl.....zw..{...s83.n.(?..I.e...{=w.|s..3c$"._o....m..-.^...< wZ.....ZU..........`...I...@E...........".7.._#...yv...3..6.7.S..8.@..vt4..c....R.h...T...r...(....mKV...Tx.. .Xz......(.]yaB..*K.%......0G..e...jA#=?..8[rE......}r..Z||n.T...ul...y....I....T.MA.Mq.....[.*.7.....D...k........\.;..LN~..?4.Z.....n.M....xL.e.e....-.<..../0...F.... ...K......}....!.M..

<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_bottom_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1237

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DCA0EBD556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8DCA0EBC556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................b...........................................................Q....U........................b...S..............?...Y........F...H......tH........

GET /static/marketing/main/img/containers/green_bottom_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1229

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F89900DD556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F89900DC556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................^............................................................R...U........................R..............?....L. ..Qu...-..oz\..3..HTTP/1.1 200 OK..Server: Apache..Content-Length: 1229..Content-Type: image/jpeg;charset=UTF-8..Cache-Control: max-age=86400..Expires: Sat, 02 Aug 2014 15:05:23 GMT..Date: Fri, 01 Aug 2014 15:05:23 GMT..Connection: keep-alive........Exif..II*............

<<< skipped >>>

GET /free/frg/products/616950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 13 May 2009 07:04:16 GMT

Content-Type: image/jpeg

Content-Length: 15113

Accept-Ranges: bytes

X-Varnish: 1250507785 1249857010

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......<......Adobe.d.............................................................................................................................................................................................................................................!.1.AQ".aq2..B#...R...b3$...r....CS%........................!1.A.Qa"....q....2B..Rb#...3..r...$............?.u.kg..e..W..e`.@...:.......~C..1.7]....f...8..r....5......dn..AVF......9@.>...^..g....Or....@.s.@$...E......-..(&}.~.......WrY....:...yWI%.....=#.0W....i....H...H.{....Q.zj<~cI...k...V.h....e.........3.m....'kUc9....[.Un?...`|.n](...3.jZ....O.u.6.....8.p.v........A...2..^C.....#.8.>"s...K{.-....fajx...B...Q.NDyj...l.u.W.e8_.......... v..v.. ..A Dm..V..W`T.)"...u....m..Tua.A{...Y..E....B....gMm$od....nD....Z..A...{... ha..1...9.m.l~..........`a...I..4.j...U.p|..\.^....|.g2.......9D.).3.GC.;kg......g.;.7........=4O(.c.N.. .L.Y3 P../ ...}.s..CB.....qy*.H..?.1....X@.f.=h .GMv.p.p.N..]."../..)....[Y$...(.6.|u..k:.t.......vP~..@.:..b.i.>......<..p.q..}Q.....6Z...e.U..N?.6.G9y%.{v.........[...-....ww....b.X,x..@..&j..F.#...(...Et. .LkW.........3.l..x.@w?P.{{.r.$...,...p....5......J;.M..n#.6...1,=.f....We....wq..V.h..........#....k.....s.............V....{i...~(/23.& .*[px.o..W....od...3[.k.?t.....&}.P......Zw..d.{v?.J......v4.....c..t.|g..v.r..7......2.v..#..w.\.k.r..?..s..w....s7._..~.~.O..|...\{s7....J...h.W......Xkr.......||{.dn..0....7v.......&....G3A..5......:...K.. V.u.cR...^w&b.........k...64..P|..#......

<<< skipped >>>

GET /free/frg/products/719950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 18 Mar 2012 15:31:39 GMT

Content-Type: image/jpeg

Content-Length: 18774

Accept-Ranges: bytes

X-Varnish: 1111897254 1110700244

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......X......Adobe.d.....................................................................................................................................................................................................................................................#."23C.BRbS$..rcs.4..!1Qa...D%A..T5.q.......dE.....tU&......6'..........................."2#3.BRb....r..C$!1A...Sc4Q..%.aq.sD...........d............?...7...Z.m..R..J...J.i...%x!........... G..SnY..]8...o.$av."..E.<...&Z.T!......,..O.'S..Y&....7#g.0 ..!F.?Y....2`......T.`..C....p...$..S".~0.......3.R].K{..g...H.M.:.a.<.G.B1...9$|............Q..:...%......C.. .A..E....x.| .{?>;.. ...1.4.k...c....9s~M.G0......c....\..|8Eu..y?.....V...........o.. .p.x}......]...7....0,.=.o.]M(5....d....Q.....=.`.B.....B.....E....k.>L.s..........6...Lj.y~a.N...B...7.....[9m.9%..mwx....J.c!1.....Y,..L.4m..F._....x[..q.Q........9>8e......u.-..S.........=1.pb.r*.{53S$.....m..$&D.@..Kw...q".{..Q.........o....,L..0.opK .RUJK.s...RY.`.1..f....~.j....,.F.[.....!:....-..DM.....8..K.Q.9Z...3..P...............6g....6.....G....]|...vm?Oq.y...@...z....$..3..MEI*.@.....e!2.........Yw....*.$|.........HN.p.]j..W^........Ue.OG..#.t..W..|....;.w*.....w.r.......w:..X..L/.]....7......<(.{..A%.).......'.......rX....'.t07:.I....\..C.4..Qu%.....m.I....D*.D........4.."......#~....1#L "Xt.Mw....X......=.m...\.;....1P`.\!Z.}|s....e.@.m&.s...J..L.....\....c....p.........@...U...t.......,.n.N..%.eJ.K......$~......M.5a...X.....01..o........[`.2|r...6=4

<<< skipped >>>

GET /free/frg/products/521350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 14:00:26 GMT

Content-Type: image/jpeg

Content-Length: 20224

Accept-Ranges: bytes

X-Varnish: 1465218307 1465089466

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A2564DD428E9E2119B6EAAA9B36B19B3" xmpMM:DocumentID="xmp.did:683F9C80EA3111E28E18D6C6357C70B1" xmpMM:InstanceID="xmp.iid:683F9C7FEA3111E28E18D6C6357C70B1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8EFCE9A1E93311E2931C861C14986523" stRef:documentID="xmp.did:8EFCE9A2E93311E2931C861C14986523"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................................................................................................!1.A.Q"..aq2...B#..R..3$....b.C%r..S4........................!1AQ..aq...."2..B#.....R.br$.3.C.............?.......V.c.JR....."W.#..c.Um.m........q........@H=....|.SgB...3.m......f..q.V?......H......>.R.fr..),..(;.Ep..6...r........P3._........W..55.'..*&..j.^k......N.......Y-A...oO.......D..].........

<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1848

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

tAQAAAAAAADBewCAeQAeAAkAeQAMAOoAlAAAAAUAAAAeAAAAKAoAAAIAAAeTZXxGa8NlIFehYGqCMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAA1OTUHODUGQTMzODUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:04 GMT

Server: Apache

Set-Cookie: JSESSIONID=096DFCAA73E3C37F86B4EA5350B4FC0F; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1

0..

POST /opTools/clientTracking.jsp?trackEvent=playerinstallationfinished HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=5FA0F83642FEAB46FFFBE66D9CE295A4

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:02 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:02 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html..

GET /free/frg/products/643650/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 21 Jul 2009 12:45:04 GMT

Content-Type: image/jpeg

Content-Length: 17001

Accept-Ranges: bytes

X-Varnish: 1108941170 1108243209

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d..................................................................................................................................................................................................................................................!1..AQ".a..q..2#..BR$.br.........3CDcs4d.......................!1...AQ.raq......."2.$4..BR..b#3..Ccs...............?..-.......k...}....2.M.#x....hdZ..>:I..(..Or.~.I2...I5..U....]5..:I... ..IP.Y=.v<v.uJ...".L2M7..J..$.p.O!..sx0...*.".#[...W}...R.."6..7......T..R.......3c3.c..(z.W.`1L..bs..<5..^.W..$..H.M$.45..I{...4._..$..IxU.t.I.X.:9...h.....8...........m............?...o.....q.....G.....|....i..2K .....lJ.y.i$.......z-...i..........c..j.#'..c;d.......8.MIn.........^.e.n........!.?p[~DnW.r5....<hO.....?..B.HW.W.5....F_.M...2/Vc...pR.m .]....\ C....I.GH96.9p...u*..L.Jy....j-e.....L....K.R.I/6$.i$...zN.).Q......}....P.i9...1..a.y.'..l..............U...G..j.I...I%.Q\t...LM..4...$....cR.X.....i..,)S6.A...\....y...bR.Q.t2...|...Kw.7.H.~..... .).q.(.O........sM..b;-......M._...d.gw...O9..-.........id..%T.NU.N....L..Z......V..bwr.^..WX..J.M..^.h....ST.......'..A.H..&Ca.....m.S..y(..G.k..g....nX...]rZ..*AN..E.*..VU.iP.MX..,M.6...u`r.j..5$..S...)...-F......s...j-Jec.H:z.Id$.^...S.h.....8........'.?.F5...G...s...<S...M.#x..1.t....hj....=.S..=2.y......(..v...US.......>.lt'hH...8....]......KP...4...K.......m......K.j.(..a_.P........6l6..QQe..6.^.Yny<........8.....U...>.p...$.u.h.PahO;?nN.LfKp.mIB.*R...Pw'.NZ.....

<<< skipped >>>

GET /free/frg/products/663350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 08 Feb 2010 12:06:01 GMT

Content-Type: image/jpeg

Content-Length: 16226

Accept-Ranges: bytes

X-Varnish: 1111897215 1111051955

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......D......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..Ã„S...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..L.,.5*w.XA.b(..k${..R2G..$.&........1.N.....h.z.]6.H.......j..ga..N.<.l.......,\ZFC.84*GZ|.s(.c....O....`....G...j..u]..8`.N..kr..Y.......l...S<Y...S.#.M.N.eI.x..a..6R..)...KV.FBjT....`...N.\\..jA....<....7F.m..$K{.."..u!.V..j2..............(...../..s[.8;....#$..b3k.Gi...7o...5C<d{.|...D......i....J\#..;.*........(.z..*....0.... .q$..3X4.&...jw./.Wq.S..G.....{...T..4.5... cdzV.Z.....X....C..Z.T....#...nG.'8.e....yJI....2.bvn..|>`..#.A@G.o0{E(..7.qe...S2.jLX....9W.=a.h......?@.e.:.;.|4|....^-.6.c...>....EF.w.)..N1.'r.Il-.)......^.vFY..bc.[..6...xP.^....&.@..$.7K.EEI................g..GrsC)d...g"...K........@=.sJ.R.p..E9.DK...q.:.3{.'.....$..C5......1...f.tF.. .69..(.T.l.@>Z....R....4..~|..z.fj0..f ...?.......@#... [.R.4.<..#.0.[R1.........f.5.7.w.[Q.[....%.&.?...'0?{.>.A.h.^l=.-7..u.|.=.1........I9.b...TUA.6...d81....D. ..`MCT)...5......X.".Y..z..ke....~.

<<< skipped >>>

GET /free/frg/products/571950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 02 Apr 2009 12:56:42 GMT

Content-Type: image/jpeg

Content-Length: 17011

Accept-Ranges: bytes

X-Varnish: 1111897252 1110760732

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d.................................................................................................................................................................................................................................................!.1"..AQa.q.2..b.BR.#...cs$.r...4.v....3C..&7.......................!1..AQaq..".....2.B....R...#35.r.b.s.............?...Z$...hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F....hH..F.#B.....hB4!....F.#B.....|.I.P'm...|...........H......).5.E..\....3..).I-............q..y.-.J`q...`.....uQ;8........1....Q.[)!E.#......Ihq...r.....J.....,=.Z4!......A.4.IU.H.hJ...L8r.$...u.....(.}...N...:G84T...xj.H.-b@..).G..%..R.p...Oh)..<N..L.@..0n(N..-...J.....hJ...4....uM.$I.H.ZI\...?.........P.....Q%y{M2.....E.~`H.....U......<.maGt...P:...a...by}TgKW5..h.N|;....H .u#.>.c.......(T._.0;....N ......J..Z.Nb.i6.-.....h.K.$..8....H...CZ..@..&..#Y$..T...z.........S.I.$.I%K.6..-....t..Q......%.. ..;|...&..i.[..o.X7%t......e#...I.......a.......V*4....A..W.9-..>.......e..r...................h.|....5.!.....c7%...1...\.;....Z...R.7.... .. ....5`~..E...$uJ.(W.@x.|.....)-{\h. wAth.>..2.q.2..BV.!AH'......5,BF.73].n4......aw.<F~......m..........(.t0.c8......_.=...^f.?&;.%J..B....qM.....ON....y......#.tiWh..hJ..|.3....{.Vq~9.b...YC.............'...$........N.ka......\....V....of)...4nxyh.8..LE.G..........~Y....L...Eo....z.0^l....e#..'...F........,.(.C...@.]..G....D....yo..7.>.8........L.v[.u

<<< skipped >>>

GET /free/frg/products/748750/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT

Content-Type: image/jpeg

Content-Length: 30665

Accept-Ranges: bytes

X-Varnish: 1110567298 1110386393

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......^......Adobe.d........................................................................................................................................................................................................................................................"#.2B3..RbC$.!rS.1.cs.4%.AQaq....D&..T5.......d'......t...e......................."....2B#..Rbr3......C.!1Aa..Ss$4..Qqc..%....D......T.5......t..............?..!.MEx..x?.^0.....k....&!#tM-.....qS..u...I.h.$..~........n..hq.....8...~..}h.L.=.[gdf..1...E.n....].D....~W.'...t.dn.E..Z<."(..rN7|..!S..9..~`.6.[}W~..^.....u.}c..W...*.."........."?\.u*j.....~..G...7..;"..s..C7_).t.<..~1..W......1f......S.<A..b....J.F......W'>E.xYC.....)t.......F.....u................f..g.A.0k.f....'..._70.l.......y.p.~B....,1.(.eR........-h....9.......pE..O$f.e.Rn.....^.F../....}.......IC#....n5..q...IwhJ<..|D/..k....|.X......8..'..0.9..k....6../#.$e..P....!...VMAk........d{>t..7`g........../~8.....b....../~8.....kt,K.......}./....'...{..G.'...k*.......2?..Q......e....ip...[..w..T{...G>K'...yq.>G..1../...g.....yr..'.......EzK.L..v....K.\.Cj4.T.i1p.`..7.....t~z...aHTTP/1.1 200 OK..Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT..Content-Type: image/jpeg..Content-Length: 30665..Accept-Ranges: bytes..X-Varnish: 1110567298 1110386393..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:05:25 GMT..Date: Fri, 01 Aug 2014 15:05:25 GMT..Connection: keep-alive........JFIF.....d.d......Ducky.......^......Adobe.d....

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:18 GMT

Connection: keep-alive

GET /static/marketing/main/img/green_btn_28_mid.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1289

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=67666

Expires: Sat, 02 Aug 2014 09:53:08 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:79D12945B258E1119DF2A5DBDC21884E" xmpMM:DocumentID="xmp.did:CCF2A9DF58C311E18081921A07E6FF11" xmpMM:InstanceID="xmp.iid:CCF2A9DE58C311E18081921A07E6FF11" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7BD12945B258E1119DF2A5DBDC21884E" stRef:documentID="xmp.did:79D12945B258E1119DF2A5DBDC21884E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................u...................................................................R..T.....Vf'...................Q.....!.."b.c.T.&............?...4....nL(.zMz..X.i1}.;..#n...#.J%ATM...*..R....]...%............

<<< skipped >>>

GET /static/marketing/main/img/containers/green_corners.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 2157

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:408B6E0A556411E18557BC153AD0475B" xmpMM:InstanceID="xmp.iid:408B6E09556411E18557BC153AD0475B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5E231C124755E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................I......................................................................................!1A.q.Q...".a..2B$.#3...T..V.......................!1..A.aq..."2.Q.....Rr..S............?..Q2w&V.9q..a..2$.A.8%QC.*..f ..I>.\iB.NMl.s.C.....2 . ......q........4n?.]...og.`.7.._.;.;.......1.Ts.^....fS~T<....s..@...";.....%A.np..Pga..).0...#.......$2!.q..u..e....I......"E"..`Lu.............2.....?..m...2Jn

<<< skipped >>>

GET /static/marketing/main/img/preload.gif HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 6712

Content-Type: image/gif;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

GIF89a0.#....................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.....G.,....0.#.....4...................................<............>.......<. ........< ...... .....3........<..*........!....*<.<.....<...<............._.1.0hA^.G T..."..H.(J\w..F..:B.h..B..T.\.....!B.lI#DI.1....S.O.3f..!t^L.!~.X1....D..[.T)..O.J=W..R...v...k/.P........p......!.....G.,...... .....G....!<...<.3..!...G.G...........: .G........;..........G..!G.....*...... G.........<........<..............*....*...G*........!..s........8.p......0..b...z........B.[.2......L..e...h.|.r...3rV..B..G3n.......G~>..shQ.=.n...(..Q....s..@.!.....G.,...... .....G....<..<.......G....................*........;......G...:*..G....3. !.....<.......<.G......... .G.<.........4.. G*....!*.*.....T..G..>....C.".B........#.3...qD..#.C~..r....R..yD....U..........\1.g...g..Q.hQ.4...@..Q.H..<...O.R..x.5 A.......!.....G.,...... .....4...4.!.<...!....!<........... .........!.4*.......<..<........ ....*.3. !...>;......... <..>..3...3...........3*. *.....*.*.......j..{....d...s.!.p.-"...;Y.41...44x...$.."E.3yH.K.&i.p.aELA.Q.X..B..@o..:c.L....@v.B

<<< skipped >>>

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=2429262-4858523

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Content-Type: application/x-msdownload

Accept-Ranges: bytes

X-Varnish: 1926374369 1926325909

Expires: Fri, 01 Aug 2014 15:04:02 GMT

Pragma: no-cache

Date: Fri, 01 Aug 2014 15:04:02 GMT

Content-Range: bytes 2429262-4858523/12146312

Content-Length: 2429262

Connection: keep-alive

Cache-Control: Private,max-age=0

HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 1926374369 1926325909..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 2429262-4858523/12146312..Content-Length: 2429262..Connection: keep-alive..Cache-Control: Private,max-age=0..q..O..E"^...E.B..D.r=^"....R./.....1-^-../...D|....y}.........].-..Qa.._.'.......[X..<...f..P....z6.y..U-].)....AJ.U..../..fc3.V.....o.'......^..yVb.]..Lh.3dZDT.v...KT.....|..CB...*...T.j...pSq........G..q....y....$...._......4.....`.FT..N.w.4.D...O...|......%. ....._>... V.6.5...-e3.. )......}l.....i..u.P1.....o..>"..ou........[#...6[#. ..y..|.Y<c.y....(>.Y.%p......YL...d.S......`E.............?...`@....^3.`... X..............A>....vN.^.4..V.*...O.P....6n:........lf.........yN..{.x..%..-l.Wfc....... _.......z.5z..t...:..4l6^.C{Y.$O. ..4......../....`p.N.....5..&..X...m.4.v..b]9.s..%...C......j.!?..Sz...>;*....p.v.k.=.:.=.......H.Y..V.l..E./.Q....$...q5....a...~..Vaz.[(.1.2..[.6p..p.u3e....K..5.g%........3Kd.|......?b.n`-.A....V.H.b<.D...9.N...e........hViVn.s.J$...E...`.f._..>z..?./M..........G|a...L|..a.......%....l......C~>.1w.D.JP.0.IE...a.....\....r.......s......sG..]..O.ll _@.]`.].cx..."..>..a...?..Sq....q.G....@ue..H)....!....N.:g.uXh..........-.Ue0...\...\.c.b.&D5.......T..B......32.yO.g.....'..s....u.s.....o...../G.....O.....'.....9....&....qQ.}t....$Xsh`.5g@.]..A.&8B....Jr..;.%=.

<<< skipped >>>

GET /en_US/all.js HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: connect.facebook.net

Connection: Keep-Alive

HTTP/1.1 200 OK

ETag: "a89d9f64c8545f8b1b7c72572d2188f4"

Content-Type: application/x-javascript; charset=utf-8

Timing-Allow-Origin: *

Content-Encoding: gzip

Content-MD5: g7tSjC4YILZvPtnpqLpd/Q==

X-FB-Debug: 0gk9ovic4HQA6uchwM49yJT0YNnZJr2BCxoJBI2vISFstDN wKGadQJ2IGehLL EIzxZhdr8n8MGiH3Sko9nUQ==

Content-Length: 54012

Cache-Control: public, max-age=1200

Expires: Fri, 01 Aug 2014 15:25:18 GMT

Date: Fri, 01 Aug 2014 15:05:18 GMT

Connection: keep-alive

Vary: Accept-Encoding

............k{.H.7...O..3.jd..:B.|.q.v..[U==3..%@.q.F`....../"3...vu.....9.E.3222"2"....G.'.k....y..~.^z.O..l..G..^.<<~|D%.p..........?.......t9.z.y.}...q<,}.t...._.N8I.ni1.......^M...Q9^...,..JG..j...i.......p.j<....tr...7.>}{./...c>[.VW..._U........b...K.[Z..e0 %.....$. u..b.N.&..S....{4...U"M...a2.g..(S@'z.Q..6..S..f .....j.}..V.......W.......-..V..j..Z-.....p..j....I)h.....*W..P....E4..V..H.J....W.^..t......`.x...~.]N.q.I.~.n..k.w.#.....l.8g.U .S...............,.........l...5..N.........h...g.Ui.^...f...|.a..JXqJ.Bi..K.0....y4......|{~....~........y....eu.Nz..7..~..qN.....5F/...RqW.U4.......]u...T....^.=..aC.5@.QU?2...)?..k.S..,...rw)^%*.P.|.H....z.N0..Q..y5n...".....B'.NG.r....V...Z.4.8...........4..i.|G.;..k..TO.....w..x......j.......}.?v7......._FH..u..~...D....o._.f...k.c,.^..K7...:^.c..t......i:....S...SI1.;e.v....V..F...R<.2...6 T...6*..K..J.....5.g~_&.yH..BT.......R;......S....!Q.G#"P.........=$..mNj%.............!..VMq.c./.........=.;s..Z...~n..y.S.#....c.<.M....!f....^.:{C.u..-...f........c..,..|.....Z.F......E..*..G..^....!.....k.......#...!u.j:...a_[......n.6.....z..^.;....x..T).........z.@........S=.j..G...z..$.!.{U.4,..;R..."M.....2..F.t.,?..oN;&...T....^G...u.'..}X.....h.3P*....f.|.h.T.......p...8])Y(...GX..H?.p...H.Y.g..jf@.a..,$.i..R...4.....:.y...l.y@..-...V.....:w~........D..j;.<<.....Y....3..[4..|....]F...1....hR....<.j......"M..j.}.(.....*O..c..m?..z.D..q....A........q..F....&.x.hH.yyBT..(....I....7!.M.v...A4I6H...J7..@e...#ht'~..L.{.Za`.2.s.....`_.._4..=

<<< skipped >>>

GET /en_US/all.js HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: connect.facebook.net

Connection: Keep-Alive

HTTP/1.1 200 OK

ETag: "a89d9f64c8545f8b1b7c72572d2188f4"

Content-Type: application/x-javascript; charset=utf-8

Timing-Allow-Origin: *

Content-Encoding: gzip

Content-MD5: g7tSjC4YILZvPtnpqLpd/Q==

X-FB-Debug: 0gk9ovic4HQA6uchwM49yJT0YNnZJr2BCxoJBI2vISFstDN wKGadQJ2IGehLL EIzxZhdr8n8MGiH3Sko9nUQ==

Content-Length: 54012

Cache-Control: public, max-age=1200

Expires: Fri, 01 Aug 2014 15:25:19 GMT

Date: Fri, 01 Aug 2014 15:05:19 GMT

Connection: keep-alive

Vary: Accept-Encoding

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:39 GMT

Connection: keep-alive

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=9717048-12146311

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Content-Type: application/x-msdownload

Accept-Ranges: bytes

X-Varnish: 494852603 494804948

Expires: Fri, 01 Aug 2014 15:04:02 GMT

Pragma: no-cache

Date: Fri, 01 Aug 2014 15:04:02 GMT

Content-Range: bytes 9717048-12146311/12146312

Content-Length: 2429264

Connection: keep-alive

Cache-Control: Private,max-age=0

HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 494852603 494804948..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 9717048-12146311/12146312..Content-Length: 2429264..Connection: keep-alive..Cache-Control: Private,max-age=0..Y......).la.a~{..vP..)4.f....<TZ..3m.... .#....{..:!.f,I....8.L.(..l....wf.s2..6.... yt........W.....2...g.........?...n%....<..(@...w0:.,.h.d.....W8G..1..,...c.X.U....a.U.@......q4.xx]t...v......d..'.....' .\O#f8...r...>..`...xV|..?...7..N.95g16.0Bs>..9...B.Y..3i.4.S.b.!.......P*I.C..Q..z_._.....n.?q.<...SVE...#....... ........^......e...........;x..|..,,w..n.6..w.N<..S?>.l......G.w..,....W....U.{..S.A..$#..$...t.. 7&..........Zy-..^~l..f.d/..F.P..#.}.*.?3.(..F..lC.c..........=..M@.z,..h....*!.&.........g*a.XnPQi.J..7..rG,.(.'.EE._*..c0.`...._r'^.?.....-.....C.P.hy`~....Y=;8....Y.[/....:...|...j]<...5........>wA...l.>7<.O5.}......j.......k8e.R!.... .]<OD...\..yI.......#..`.S.E.........;..#H.bs=/<.....R....R.Ygn5Bf.1#.JE.....-92....Y.....u.6.......e.d&a..,.9.y.......^....NY9C.W5.....Y....XC.....E..|W....3..5.......{.....Hn~....Ny/...Jos....Bv.q.....s.L0 .KL.W....8.=.<.....r........h.=!^..#3k.U.B!>........P..L.............w......@n.@}.y..|.8.. ..o..um..it.5.9%.).J.d.-....p'q.........~.....c.z..Z....N\...n.....C.7rg:...~....r.u~..f...$....U..".F.w..H....J....{.f..$.. ..U&p4i"..(..

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard/header.html HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dts1.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 21 Feb 2013 10:04:09 GMT

Content-Type: text/html

Accept-Ranges: bytes

X-Varnish: 1140614167 1139395939

Content-Encoding: gzip

Content-Length: 1002

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:02 GMT

Date: Fri, 01 Aug 2014 15:04:02 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........Umo.6......W.Km,.....m5pl7)....n.."....F....#...=./s......IQ....{....../......j.7..g...Z....s>YN./^...,.(LjSU....5{........Q.n......og.....4f!3.....-.[..2...Kc..5&![[[.9.q....6.*..F.i....wh.b... ..5V......7....t...O...qE*.......!..}.#.....1.....PxC. c.....&..Z...GZj.W.r..j._..1tfE.vO.....)......u.V..q|...n..o.3Pf.@Yi.m.^...m.................c.."....P.a...t..........WR$HH}.CV..P."2*.,.t.Z.~.....V...[...g....,........h6....d..........l.....0.4..\8..M.$..3.)).P..`..v...^.kthC.........)9-C.y....4RP#...4G....;.`.&.Df.S#......|.D.....p.XB.*0..$Z..,.'.5.5&....8. I.d ...LYo.F...)...)......=...S.U!U.......G.x9VeM...V.4"01D5...Z..iJN.....CP...). d..9.&... ....A...N.'?.....|..y.i...H..........T....t.Ic7(..:.'.85e&.~....H.....^h.%..;..._...O.gs......_@v............n...[..7......M.....b.{.d....n.....S.m...)`vlF...1..R..Ic.Y.l.......I.....6..U....S..p...........&.gph,.1...V.X........5...r.... .......,(I...V1.iaHt.....q.m...l.....0,.QM|{....x"~y&;t..n.......A.D~.;........~.....7....w..)0l...HTTP/1.1 200 OK..Last-Modified: Thu, 21 Feb 2013 10:04:09 GMT..Content-Type: text/html..Accept-Ranges: bytes..X-Varnish: 1140614167 1139395939..Content-Encoding: gzip..Content-Length: 1002..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:02 GMT..Date: Fri, 01 Aug 2014 15:04:02 GMT..Connection: keep-alive..Vary: Accept-Encoding.............Umo.6......W.Km,.....m5pl7)....n.."....F....#...=./s......IQ....{....../......j.7..g...Z....s>YN./^...,.(LjSU....5{........Q.n......og.....4f!3.....-.[..2...Kc..5&

<<< skipped >>>

GET /beacon.js HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: b.scorecardresearch.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Expires: Fri, 15 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Content-Length: 1140

Connection: keep-alive

Cache-Control: private, no-transform, max-age=1209600

..........mU...6.}......CF.l/.4..k4.<.h. i.\..(.bK.....".{.e..M..".3...sF..(_[3;...J..._..)A.m?).. <..U.V....ce.......R........J.......$........{q.|...x#...;.[,.7....r'.p....p.6......7....K.A.Jv:....eJ..V...vb...q.5..$!.........M.(b...=.q...sZ.6:...t<.Rj".0.X"#.Dd...f.5.n....E0.*.E..tRy.>i`..\.......`!.Ed.^.....}..".~.l.?.9..6....s.1...z?....e.K >..0....W,nd...k.....N.g.G?^:..(.cS0c<..V...P#Bjo....M.....0..o...,....A.p.....\...Z'2T5.........^SrE8.....y....@.s...Y.............l`y..1.,.h.N......d.......< z<....c.g..G.f..M....._..M.3=.|... .r.{-.. ..@.d..]G.<"..R/j........U.F.\..Q.c.A..u)....6_.=?......~q1I0.l....K^...$......f..R..j..A %J4Ip.....L;..m..i...~(......_..A..z..Be .b'.....r..8".i.t&.......a.~..8..C....P&d.....*.M......'.@.H..b...Yp..v/l,.3G9.......2I..[....]`.X8.q..>%n..t..nW....!.. ...M......,.%.....>#k.g.A.jf..sC`S ..v.{[....$~F...|..zr!..hK}U.....N..S&d"...v?$..|.V.4QWy.....T)K2.T.'........Ee.j<Ml:f@...{....i..7...d..Y.7 .;.y..zmz\9.a.....Y..E.,.I....-e/V.%......Z.........../Y....)..O.6.....h...G.8../.9.VzU.....C....P...s....Q..e.;.....>*.k._kd...9.qJ..8.L........o......J-.P&.RY#.l}. ............g...g...".Al.......

GET /b?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: b.scorecardresearch.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Length: 0

Location: hXXp://b.scorecardresearch.com/b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=

Date: Fri, 01 Aug 2014 15:04:04 GMT

Connection: keep-alive

Set-Cookie: UID=31aee1e-23.15.4.18-1406905444; expires=Thu, 21-Jul-2016 15:04:04 GMT; path=/; domain=.scorecardresearch.com

Set-Cookie: UIDR=1406905444; expires=Thu, 21-Jul-2016 15:04:04 GMT; path=/; domain=.scorecardresearch.com

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"

Pragma: no-cache

Expires: Mon, 01 Jan 1990 00:00:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate

....

GET /b2?c1=2&c2=6035233&ns__t=1406905452640&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: b.scorecardresearch.com

Connection: Keep-Alive

Cookie: UID=31aee1e-23.15.4.18-1406905444; UIDR=1406905444

HTTP/1.1 204 No Content

Content-Length: 0

Date: Fri, 01 Aug 2014 15:04:04 GMT

Connection: keep-alive

Pragma: no-cache

Expires: Mon, 01 Jan 1990 00:00:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate

HTTP/1.1 204 No Content..Content-Length: 0..Date: Fri, 01 Aug 2014 15:04:04 GMT..Connection: keep-alive..Pragma: no-cache..Expires: Mon, 01 Jan 1990 00:00:00 GMT..Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate..

POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:50 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html

....

POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:04:50 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:04:50 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Content-Type: text/html..

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:05:01 GMT

Connection: keep-alive

GET /system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 219

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Connection: keep-alive

Vary: Accept-Encoding

.............n.@.D.A...P.Qw.....%.k...Efi.V.{w..4.....y.......p....,v=q.G8...%..v..k.>..,..~.T......9..Le..~yJ....>`.Om.6.....X<.......teY... I...L..I....f....jkO...A.{<DE....48rD._..Q..>..8.>.....p....A`.G.......5.|.......

GET /static/marketing/main/css/templates.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Content-Length: 1650

Connection: keep-alive

...........Ymo.6.....[..I.G.{....4i.uN.z..e.d.....!.M...}|.H...8.l@.D..x.{.............}r.:zqlY..G.,.p..j~.K..l.....*g..k.m.at ..-k.fM...CGX.B..T.../. .h..eJ...f......hZ.u.m..b.,.d.D#...Yy..Ds..f-.2<....E....n...h...>... j-P0_.....G.H...o.:..ny.......Y.x8..Q.G.uVl)](.o.o.p~=.\.'...y}.K/....(.t......B....Hk.[....A.....`o.J../....G..&..8.(......I..Nc..%. .....b......e.1...?.t..PY.|1.^.4.......7.c.N[ .G.UG....f.... ..]..3._g.]...kz5l...|U....\^_O.'...6....pC7..x..W....%4s.._..3vj... ....w3.Qz]P1....f@.9~...'.<;.<...1...=...H.........W.=V...?.k.~y.F.`.{K...#w...:O..iZ....!.r.8^U.P..T8.?...;.=<....2.E.....T.g....3.l....1...B.Qz?Z...".....1......sQ.3E..X!.,S...eH.L.."..g..m..E........Q..~{..xuJL(..,%.A.H..Hi........Q.`-.K.n.l...s..O.<.........?..o.x.X.?..U.`/.J%x...z...$^G.h..w..;..W..-fj!.Sr..L...k.....-.....C....Bj...a.....'.j..GG.w.J...C.....8*~7.J|.a.Y...JJ\mV..G..Cd..Q.Y..".n.....7.#..6Bk6;.g....ITE...U......4..5F...5.v>.;"..r5.2.%..aQ...........T.....6.g.n.#.?..g..r..J...H0.Lp$.....e....~8..s....F.%..u...I.v.l...i.......B25.e....D#.....L:.M..l.lZ.Y.8...w..L.".?.sF...yGiKu.J!.UYr8.,1.K.f..R.R..Q.......J......0..6....._..H..;W.{.^_.qXV...j~j..../......}`.%.......D-.(#.b._....v..,..;..B.b.5.....R...}u........gk....R..Ca^9.2.2Q..XP/.y.....m...}. .W.^.*....],...._p.....Kf..A.:.)P.e..:AR.E(.;.j....y..R.7;a.G-..Vh ..........*..-.X.1%.......G....3A...5..W...3....r>!4..|Q>.(.-.,.S0.....g.D.e..k.k.k ....!.u}50...R..h..\u.../...J#.~..L......$.......I.0.......D..).....S.q..dDt.>.......kw..._..

<<< skipped >>>

GET /static/marketing/main/css/gamebox.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Content-Length: 940

Connection: keep-alive

...............0........LW7".7z7..g...$jF$..m....'..$r.......%...O...!.SG..p....S.O>2r72.."...|..w..m.&Szz.9[.7[......j.a..%!8......~3>...h.2..4...soNO..d...j......l..L(.6.c...?.%.,..3.tfWY .....tu`L....%.......0.3..i..(.br..-....K...1..*.....T...U._b .o.P..<...3.. .Gq)N...@e%....).<L.ZT.........#&..$.=N>/..7..$o......!. ..ak..0&i".BOc_.*pD,.....T.....?].<*.[.aD..b.^O&.b...(..(.....vY.-g.........R~..(..B.~.>\=.....".x.?).T.$ ..ED.(.Z.......]...g..{..\N.s...0N.j.R.h.9.l.....'J..yU....u...P.c...K.........:.Q..w.[L.b.=.L..*6zg.R..Wf.....&4..Ui....EH^l]...%..........9.S.e..w....R.j.m.e.v.?...u.D..@].7...do.t.3Y.\.9.!.).Q.......V. ......i..!.9.(.&..N....&...k...Qj.....$...-:T.....{..P../X..............y....o..!o..".....=.kR7.]......][..~.\.6..>.........m....u#y....3...D7...z3...*..=....BG.9.;.=k......~../....%...1....Nh...hM...*...z..x.........Up.....S..f....... .......Y\qY.G.b....a.R.Fr.Qo...S.r.C.^...86fr'.[e.aq...$.H:..?Y@..........

GET /static/marketing/main/css/hover_elements_sheet.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Content-Length: 409

Connection: keep-alive

.............n. .@..W..J.....X.Ll....:....'N..H......f......!..... (:..Q..kKy..<.eG.Tv.c`..5.V.../....Q.w._..]_}@....z.../X.Q]V .I......'.UW..8T...Se...Z..(.Y.EI&.^........!.\.. .t.,Z,..%..j...R\5....._..........7h..f..|...L.I.3I....R..74n.Mai.x:Qp..,..AI..=:...2.gA.-. ...I.B.yb./.T.....?q......\r.|.Z8..nQ.N....Q..w.;........^..d.9..h....'>.,^..b.,x.|zfN...BS.B.gI..C...e.&......".........0..<Fl"....<..........

GET /static/marketing/main/css/download_assist.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Content-Length: 217

Connection: keep-alive

..........}.A..@.....X...etj.@..D..:........[..OW....f...3;q...j..6.0X. .V.......B.*.........2] .V..F...%.:...........y ...%l..^mU,...b3..G.........`...M..>...&...8.DqV;5.....{8k..G.H..d.u...%.YBg..=...:..@.~.Bdq.........

GET /system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:18 GMT

Date: Fri, 01 Aug 2014 15:05:18 GMT

Content-Length: 284

Connection: keep-alive

.............J.0...W.;.^9(i]....d.!X.........%%.Ze.....^.D.@ .../.azzr...tI..........gC.|........t\.....)fdH.U9...]...V ..*.q......l..1./h..m.0..m/.ik7C. ..,..~....a.d.kP..g....)#..1.l.M.O..Q..I.......|..9go.h....el....6....\....$Y....,b.#<...bv.=.s...Q...g.#...........{G)....=.?........

GET /system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:18 GMT

Date: Fri, 01 Aug 2014 15:05:18 GMT

Content-Length: 46010

Connection: keep-alive

.............W.9.0.{....}w...!.d2.;...'.._.Mf.........Yw......V.>ZR..&..g.g....R.T*.JRIz.......*...].[[.............$..N .w............}..K.pp..G..(L.....Rk4Z:F.d.8L..]8\.....`..s....k....(...u5._.....q.....h|....:JX.n{....N.!..;.i..}'...q;..E......4...8.......,../...#.>.387....,.'......D%.. \r~.bz..g).M.`..4...`....m..Q..K....(.D....O1.9.1..>.._..QX.#)..L/.t..W.u/...I......e.Ys\7..U..^......,:C...@..f)u.>'..f.....'.Q.^s.../_PJ...0I...C...m..4Ip..-.....5.....J...q.*......._J...1..4....(N.K.8^......0..&......*.......@~5g........3...$^.oZ..ra#..B.....g..n....0&.J.7nS...}D...&iB...@1)I.I.`:.m.....FL......(.\.......Aw0.nSW..8....\n...N.....Q._.. ..gq.ut.V\..b.:.o.......b...x.T....X..2..|....(...b...L..su~.X.............t4R*c...... .<.............$V..S.h;.......,...x..'.H....nx..:...&..#.c.k......F.01.0.....&.Yz.s,k..v.}.................kCA..:}I}..7.P .9...Q..>b.5l....8...>.,.Bz.. P........s.a...=%.N.U..'.. .....y...... y.j.F.z.)..j..I.......B....v..l@..*......eS.XJ...ZY.Dl......S..!...*:...X..rf.|.Di.T..uy........}>.8j.`0...0..K.Q<...Fd9......q2...%..!..yE-...1=E..E..Xc.q.....w.=9n..[.v....hM=8.n.u.........^..s.9.1.T..y{f..>...-..Q....6...U"..%...p.:.W(@[%...az=...hc.4.10...pIdZ..\887.^....&.8...i8.0....}..(6.8I.x..%... .O.?=U..?....K#.*.|.......0S5..?*:..8.2M._..b..J@v..D)N...(.$.?.7......W.H.p<....r@1,........}`.0.).....C..A.2.....ls..J2zCN@9G.@.K3..b.^..."5Hi-11a}..H..6..d...\...0..U......./_...&.....16......k.I...&.|..K....x4....Z." B..H.)..L..h.g.g........c2Q.]..:Si.%.&.SyJsA&

<<< skipped >>>

GET /static/marketing/header/css/header.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:18 GMT

Date: Fri, 01 Aug 2014 15:05:18 GMT

Content-Length: 1821

Connection: keep-alive

...........Yko.6.......i....Bn..m.'M..@.8............._IrN.Tj........N...N/5.*X_.....i....^...D....UX}e_...=.%Uz.>.x .?....I[../.6. .b.H . .H..b`..,.......*.a.ZJTVw.....c...k..EoP......V...:j.(.....Z\8b....#Uy..)F.....P.R`....&%%....r>.bP.i.1.hp..A.>........R./....*s...G.#o.f<....sX.k....gf..Zn.7.V..M...5w.s..(.......SL.!.....6o..3.p.}4..f..... ].0#5..)Y....7...s.MF0.Y...|....a.b.S...........T.<gQ`..9...'.}G)...Q...y..0*.! .....`.=..O.!..<....9...D....d....s.~.,.sP..q.k_.ok}C1_)...$....]..H..x...=..v.7J./#.M.....<==.s..2R6OUY............bTV-M....N.xB..y..|.RV.gX...`.f..tcf.........&.jk......fSW.q...\l.;&....u.(........t.}.d....D.....$....<.....MV...)I7..l..E.A@Z......DO.Z.CAz...IBZ]-..X....%?a...L.I........C...d.......D.2.....@..){T....8....t......ieUT.H..|nJ.#Pa......i...\......0.q.....n.......gP.s..u.D.Y........dg....s..h7t.{.0..lbF..1:...Cz.me.EgV...t>x .\.E.1.|<....F....0.(................t<...[. Gm.u...L>....xxE.u.....Uvz......X...n....w.....W..[k97Y.]......e. ........j..9..s......c.....;. '.s.de...... t....9).....".Y..9.....(...&...._.* O7.6..C...*.N...k.Y...^..^.............6;A.........m.(..1..:!...u...@(%g...nh.....dO.....h.)k..8..`<.Q....9.\..b.wEws..*{...j...j.V.!.D.u..$V...Y....iQCXNK.l.3......F..2.....y..?T.{...x..w.!...7^*.... *...Hd..NH.....A......P)F...^%...............3(c8..=|..bO4.0.........M.....k.9RW ...z!....T5yH....Y?.Z.....s.&G......6y......Y4B....(<s...c......F.>.@...%.a$......R....6y......a.......H.G.((...K....V........ .G......c...q.fB...3X'\

<<< skipped >>>

GET /static/marketing/main/img/background_pixel.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1591

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:18 GMT

Date: Fri, 01 Aug 2014 15:05:18 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.did:27704965522811E1800CB3176D22E618" xmpMM:InstanceID="xmp.iid:27704964522811E1800CB3176D22E618" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:165525FDC050E111B59EE6C32F2CA589" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................b...............W................................................................aQ...............................?..................$v*.#P DE.;..........7..$P....F.U9...)4..7<QA....TRh.@S...TV..R.0..............Rb.......H.X.R..* ....Vj...).....".J....* <.y.NqEf..* ..@Vj..*......Q^}.&..>(.... ..B..E9.yTS.Rx".E .r....

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1052

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........X...:.}.J....J=RC..\.SO......p.U..13.F... !..!.y......^......\....aD.lS.....6..K.T/n..8..8~...Ls.O..>|Sw{B..LW...yC%.,....>..XaQP..G.n%WK.>~..&.AI..i.}..mx.J......K.8#SI~.&..J%y....%..ti...(..!..y......`if..b.K..G...nm....\.A.. e.t.AS.....8....&)..4.A*L...HZ..h/O&.K.....R.*u.X.)...........e.P.@o!..St...G.r.F.....G.z0...i........M.M<hgi.L.]x.......K.jBiQ..QWG..P.....k........0t...3.....;n>D...S)....~.`|.....&..N..S.\.%j..N....P3..U..e...d..T]Q..Xt........._..U....7.).........(.{.........&... O........ ......V.\.73..j........;.v...Nrf.l.7...........q..a..M....(.....2..Y."4.$.u.......j.jN].6....?..=.n.....x...0d..k.-.~...,.u\q..%@.{z...D.{....^.g|........F..{S...on....0....?..A....W..|.Q-7. ......v....G[....).C..*<.....}..&..0._}.8....eJ..E.W%UP.........e~...c.=B.....@4..B;..J.A.3.......'..zE..'..........R..U.*..<..........v.............=s{..n.7....j..j@..a.]..]......n.P._C...Pr.md..ti.b....Q%..?..a6j..L..D..............U'.........i..4.T...mI.y.....O..7.U^....sA...L=.8...9...!.jV|..0>..&X:S{.;'....wv.;|e ...J*Kr...O^......I.l.......

GET /static/marketing/header/img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 26369

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

.PNG........IHDR................Z....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B3983B1C9B50E111B59EE6C32F2CA589" xmpMM:DocumentID="xmp.did:D41735F6522711E1BBABC9A21DA171C9" xmpMM:InstanceID="xmp.iid:D41735F5522711E1BBABC9A21DA171C9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5079397E5F51E11183EA8AA91EE6894C" stRef:documentID="xmp.did:B3983B1C9B50E111B59EE6C32F2CA589"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......c3IDATx..}.x....;.]....^.{.........C0=$..HB .BH.PL...B5.....m..\$.jV.]..2..3 i..-2$_..}4..v....s.S....w:~|../...<......&.G............._...r#8........."p....t.~.....#m....H[W@.......a..H...@...4.s<.G...J.7..G.ZW..F.b.G...XO..#.,...p.NO.....?...../.*9`.. .A....._....=?M..i./A.{....?......?._..H:..D..|....w.h..... U..h..G..?Z.Ft.HMX.R.W.....A......8......{.......<$...|...Ep...g9.;^..................49....To....j.....t%..H.q..@V........<h......v..'..d@..b.w...8. .!.............^..]O..s..'.......M.%.Pp.F..........

<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_left_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1227

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A40556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8DAB8A3F556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................]............................................................3s.....................Aq.2r..4............?...9..'Rk...7UD....I........

<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_right_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1244

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D90AF3B556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8D90AF3A556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................d............................................................2r....6....................1q..2.B.3..............?...`S..4d.!s....m.|>\.N..h..L.........

<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_pagenation_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1260

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A38556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8DAB8A37556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................j................................................................R......V.....................Q.....S................?......L.*.{!r......O..M..-...hoF...u/..&V.......

<<< skipped >>>

GET /static/marketing/main/img/containers/green_pagenation_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1256

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:21 GMT

Date: Fri, 01 Aug 2014 15:05:21 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8568556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F87F8567556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................h..............................................................a...R.....f........................R................?.........x..TB..w2".&}...>.O....3$.P4.........

<<< skipped >>>

GET /static/marketing/main/img/sprite_sheet.png HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 272240

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:21 GMT

Date: Fri, 01 Aug 2014 15:05:21 GMT

Connection: keep-alive

.PNG........IHDR.....................sBIT....|.d.....pHYs............... .IDATx...w..E...3.......{..J...E.P.... "...P.G,D...E...G.GQ.B........o.-...ef~..so.... .;..k^.g.........g...B..TPA..TPA..TPA..T...Q..........sy..........`.<PBl.^.,..m....= .!.. WA..TPA..TPA..M....n.....2...H....".T.G.u...G..5.m.F.....vk.......!.R...().R........"^.r.TPA..TPA..T..D,..3...t...z`v........_...x.".T...Hk-.Z"m.BC.C.0"..Qd.Z........ .@)..$......qp]...."@E.....*....*.............K.H.i.........#...u<....C'......?=.HUn.{..X...7.....Z...A...C. .a..@..'.T..=.. %8J.9......!.s.<.......*.@..TPA..TPA........y..@......QS..F../....BX...........TPA..TPA..TPA..TPA?.....@l.. .2.....j@...K..?7bo......C'..m.....20...XV.B..b.!p.!..<..<.......... ......\."..4.!0*..A...!.&....c...........[_o).;...~..5.......V....lo/..6...B,.g...(.h...k.....a.!......Rj.y.B..:7q.A..}.....'...:.Z.1..b..l...5.X...A.Bl.Rn@......z_.........?... !.. .j..2.j..,Y..L&..5k.....7.].~......H)....UUU.UUU.........#.<r...3.....}.c..1.\.A*....(..p..w....u..~.....>.8..|.c.a...y..w..n..km*.G?i....O...:.] ...[.....).aJr.'......... .J...k]G.S...x........m..........{.a'._.......R.%K.,...[n...l]..>)...R...K.s.r..a.*..X.G...?.deTl....U.....\.n.WX.9..\1u.......&Z..$"U-".VV.<..i.q.P....D...#...2..|^.(..?'U.uS.././j.;...}..%.....%>....W...(.|`...........J^.N.....@.t...Wn........a...f....F.cJ......@'..o..9$..t..`.......f.b..W...kL..8.......R...Z.`H.x...l.&D).cA......h .....%....".#].^....tK.*.....D....F.#.q.....Way....O....hw.L.......... -..HDi.k.X|.H....Q.A......

<<< skipped >>>

GET /static/marketing/main/img/containers/labels_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1313

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:A53B9BFC558811E1BDBC91B6FE137091" xmpMM:DocumentID="xmp.did:A53B9BFD558811E1BDBC91B6FE137091"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A53B9BFA558811E1BDBC91B6FE137091" stRef:documentID="xmp.did:A53B9BFB558811E1BDBC91B6FE137091"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................c....................................................................................Qa.b....V.."....U.......................Q..........S..TU.............?.....;...dz..r$Y..&.C.s5.H...v.=W<G..-...:X=..rV...Z.QWv.O ..'.<.2...<..&...R..pH0....=2T.z.,I.....Bv........1.r.....4.e..-|G$.TBj&xt.....;.........

<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_top_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1242

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D7B2B6E556411E1A50ABAD0BCA65938" xmpMM:InstanceID="xmp.iid:8D7B2B6D556411E1A50ABAD0BCA65938" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................b..........................................................a.....V.....................!....S..T.............?.....D.F.......c."Y.i...2Jp...........

GET /static/marketing/main/img/containers/yellow_corners.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 2323

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:AEB0E8BA556411E1A2C0A3AE56E7EFC1" xmpMM:InstanceID="xmp.iid:AEB0E8B9556411E1A2C0A3AE56E7EFC1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5069219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................................I.......................................................................................!1..Aaq.Q."R.#....Bbr..3C$d.UV........................!..1Aq.Qa......"2r...Rb......#3Ss.$4............?....e....g...J...[p..:(&.t...k.3.R[.Dwr5.....@.4.4D.l...J.a.....A..2..f..._}._....W.....?..$..m.........L.G .~T....2..h..~..u..5=<. ......y.t.....0.e[\..8e......=..........j..v.z.o...5.a.\...A....A ......

<<< skipped >>>

GET /static/marketing/main/img/containers/green_top_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1235

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F8486FDE556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F8486FDD556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................`...........................................................b.....V..................!..Q....S.............?......S..hH....2...1%..yY.!......

GET /static/marketing/footer/img/footer_pixel.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 8258

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......Exif..II*.......................................................................................................(...........1...........2...........i..........................'.......'..Adobe Photoshop CS5 Windows.2012:02:16 17:49:45...........0221................................................................j...........r...(...................z...........2.......H.......H.............Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?..~.o...)*{.Z....z_k..G......uI$.........Photoshop 3.0.8BIM..........Z...%G..Z...%G........8BIM.%.......m.l...F.4..?|.â€¹IM.:....................printOutput........ClrSenum....ClrS....RGBC....Inteenum....Inte....Clrm....MpBlbool.....printSixteenBitbool.....printerNameTEXT.......8BIM.;....................printOutputOptions........Cptnbool.....Clbrbool.....RgsMbool.....CrnCbool.....CntCbool.....Lblsbool.....Ngtvbool.....EmlDbool.....Intrbool.....BckgObjc..........RGBC........Rd doub@o..........Grn doub@o..........Bl doub@o..........BrdTUntF#Rlt............Bld UntF#Rlt............RsltUntF#Pxl@R..........vectorDatab

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:44 GMT

Connection: keep-alive

GET /free/frg/products/667850/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 13 Sep 2010 08:37:27 GMT

Content-Type: image/jpeg

Content-Length: 18940

Accept-Ranges: bytes

X-Varnish: 1111897303 1111053655

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d...............................................................................................................................................................................................................................................".2B..Rb#..r3$.C....Sc4..sD%....T5U&.......................".2B.Rbr......#3....C...S$...cs.A...4%.5............?....&....Fy.F.X%["..tG...N..F...5q=...Sl..cd...D.0k.m*.\J....n9..7R@........HwD..V........X...P..6Q.......Z.............X.El.f.....s...O0.L"..:.q..u...$V[....X..8.DKn..2svO..fq.,...yZ;...qkV...T....L.@iE.....R.h.C......`U.{..,*.2...j.(..he.$VE(..Q..8.....H!..T..I$.......t.&.....\......X..Gt...g..o.4R.a>"].q...&w~..Eu.]....i%*.......0..../$..B..5..{m.\b.zP..Z...Z..A... ...`0-.W....$.T9.r..E..t.e.9.....$..%uxiCX..%d;k.....yt.E..j...~...J.HUV.".J3k.......b..i.h...Sj.Bi6l.,0T..][.,....F..~......or.o<....\.u2P..%m.XZJ. !.i..K.......j.. Yf.......Ta..jHb.J..0.d. [.0..S....$.J../.O...bY@.....\... ......X..1..u....m[..E.....(....G.6K%..S9e..O......@.$.....C.....6...JA..v....a..*....f.3.*..6..H.. Rt.........i$ni....M..&o...3..a..1.p.....V<.E,Fl5..(.q."...<=.......o...HJ......,...l>..]..k.K....o.' *d.1on...uSCx..$...8.{.o...HcN....9.p...:....]]z...Z..i$#.4=8...i...y.d.`.4S..j..QW.Nb.....D..Wfl..@.<.cq...5.......t6.C..n.....;.g.....9...IJ......l;y.6...p..j........\`.. ..V.$._.L6.H.LU6.. U@..."Y{`....@..p.[..g/..c..p.=..!.P.(.4......=(.<.;.[I'=!.I$eu.|..A.43.X...".U...<r...$@.....ZxF..L....%.}.<........:

<<< skipped >>>

GET /free/frg/products/558350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 06 Dec 2010 09:43:23 GMT

Content-Type: image/jpeg

Content-Length: 25436

Accept-Ranges: bytes

X-Varnish: 1111897184 1110525835

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:24 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................!.1.A".Qa2#....q.R.$....B.3S.%..rC4..b.cs.T.5U'.......................!1..AQaq."......2...BR..b#.r..3..CS...$4%............?.......\....l....)(.*J......oK...F...@..)....^r..uD...Q1...&3h.....Z N.D.....:..}.}$e..9....U.-(..KpR8R..M.$.xsT4..<@8*...P...-k.....2.Q5D...O...we=..L..u..}.. .....pp....}B......"|.<.'tr.X.YO....gm).S.1....&m..:.*....zN8\.].h...Vd..)..D......."4..l2~........h&...-.&...Li.-....5..e.ql...... ...7.(=E"k..c........;-..D...W.U.y.U..UN8...Q....^.../L].m...u.<.@.O.....[h....../.62......8.)# ...Fa...lv|..y..>..[..f...#."z...;.........V.\.0..@S.7....2.J.o..?6.......XY.b."L. .b.b...T./.M[?.c...0.P8.!<@....$..r.O...^....l.^A.!.3\SbI.;.....f:..Dj....%%......'.. ..[l^.........5<.....T....8...z.z\UW.O..'...8..s......d...a.M...N".!8.. ..N...:.%d.f..M.}'...x.FBwDT......Z]h._}....Y.\9....R....z\y..=...e.y.&...Ui.N...Wp..[.....!p.4..^.Z.'.L;j$.=.q.l..\J%.)%.)..u.....O.9.:..R.........h....K.".Cs...5.!........3.}/..I,.....c..>U..y8f'....l...)...5v?..8...!.=e....a.c...n....&..C.z.7<..m..8.....T...........P.........0(!.9...K.4...8..nc....'....rn_.j.e.`...j.. Q...-7....H........M.....fG..f..0..`....#........f..np...y..2|jIA...P....w.wEY.fp............"E..! }lR...6.`....".@HJ*......w.8...o.....S...!L.

<<< skipped >>>

GET /free/frg/products/642550/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 08 Dec 2009 12:23:38 GMT

Content-Type: image/jpeg

Content-Length: 26784

Accept-Ranges: bytes

X-Varnish: 1267047727 1264829550

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:24 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................!.1AQ"...a2#.q.B..R3....bC$rSc%.s4........................!1..AQ.aq.".....2.....BR#.b3..r.C..S$............?....Wf........."......H..Oj.../....Ulg.r,xVOOd......].....UE.uB.E.....t.....E[.I*J....7.xw...zhe.D^.|."..$...jj_.6S.)..).SV...H..t.....^JUK....`.h.M<*.6j...*.....u...E...C...$<...).E......l!-;....z....|.4..|..a9Z..... .&.h..H...}W....\.Eu..1..Z7......U...%.N......}:....U......mU...6d(..h..&...w.D.TM:"..b.....yG..7.......`..#5"....__...u....r_....}........%. dpl.....#4.P!!#1T5.vMSN...../.....R.&...U76..fN.m..nd....mlR..("........ws..cF.D..Zj..aY.VU.Y..nI...qeGQ.s@......]QQv't.^..X............]K..U.wY5~B.....H.C......nWD#..h..It]Wr.u..#........7....*.-^O..2{.b.lG...9H..:%.d..m.&.%_....].^..;u.....e...a...}.W.......].jd2. .q....M....zh ..5.6.8..n.m..B..>......y5...]S.t..VO.h....c ..$A.Zz/.owF.m.^r...3O.......:...........Lw.).n.....&.f.....* ....-..N......A...A....a.8...>....7..'..Q#.&.M.....nEG.SU......rhtM.Ow.........L2r..v...K..:..'....tMS....)k..*...h...A......".....C..A.5..z.H.&L...:...a.W.;.........&..c=*....G.$B.n<.."......Q..KhE......S.YK}9.......L.g.. 9.K/..$...7&d..:..MU.M.....-.V.P.q.E{?p.v..7YHhf.....U.....G.......D..,*.P.........k`...I.U=..Dm.ai.]9........_o_....V.#.\NU:.^.i....fef.|.^U.0.(.I}.

<<< skipped >>>

GET /free/frg/products/764350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 26 Feb 2012 08:57:18 GMT

Content-Type: image/jpeg

Content-Length: 12274

Accept-Ranges: bytes

X-Varnish: 1679730039 1679251035

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90....C....................................................................C............................................................................".........................................E...........................!1.."AQ.2aq...B....#3R.b...$5CSr.%4.....................................3........................!1..AQa..."q..2.....#BR..............?.......\....qOI..uD.JKi$.6..........v....-OU..`1=q..XA...l{........y.....XV.TU...v......1....@.U.3V....c#=.*.$.....c;M..m.. f..,u`..ETQ .....;N......~XB0........G.o.|1.....B..Xv{JU<..[..v.. .]A.......v....ck.Q.m..PT.{.$...f2.h..t.O..Z.\U..xq.....;R....W.T[X.B.B.......%........6.|G..T[....f....|.Xn.H......`^..b?6k..(T..9;.o......l..4.)..Ts.t....<...9@W..C....jv\5.....i..2.G...r.\a...F.q.2kDv.[c..r....WjJ....r.@.s..:..*(Qf..}\....E.SP.Fi.DX......%A.V.B[).....?..../.l*.x....'..s-..{1....c......(..b.}...V'2d..JMR...*..R......).\.....IH...O....T.T...A........B....2\.........f.Q.......Y.'..(e.v.[.A..>...M......pe....X8..`....lx&......[N.[.<T......6[......].LdCA.....b..kE.....t6..O....Z6W...Q.II..._..enkr..k=5....y....'.lHP..V......V$......"X ..;B.l....)L.Dih!A.7.n..mo..'vH.-[d... ..N.Fi....... ,.......P .V.1"....G.^...;...!M.%....R:c'.Fs.).d\nZ.u[..-..94......[RcA..d1..,...).j...,.g..Qn-.xE..b.&......e.'.TO[b..oda..!#6K...y.6....R.....w..6.E..CHv...7C.....%...(.....E.u..>"..;S.Zk. xHe..|#....B...g..f.&.... ...$....U/j.M..f.r...'...,..F..'.Ea7i..(..g.D...rv......c.yIU.<K..

<<< skipped >>>

GET /free/frg/products/710650/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 23 Nov 2011 16:04:30 GMT

Content-Type: image/jpeg

Content-Length: 20072

Accept-Ranges: bytes

X-Varnish: 1156353546 1155589963

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......H......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..Ã„S...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?...W....s....y..zd....XFd..g~...EQR....X.@.W.K..s...c.............P.....d.\H.. ...ogl."."H..)..K5).|....@...#.....:.... .xA.?O.n..~...p..0S...q.|$(.....^$..:..~." ...L..@....DQ.............z(.a\...,.....e`.\.. J.o..^....J..nh:.......Z]..\.\\1.\...E,.f./...,.z....,.....]F.....*"_.f...:..:~....O>..!.(... |~..Tf"z.z=......n......-.....6K......Y..U..<......5Q...8....6.....q...j$}.....*..5..qip.......9..qI..AwM.*i......8.1.P...).......E....1.....W.A...w.{.6..k.7T..B.B.M...........o.....o.yG.h..u1...{/...1..5...V....7._......z(...|......N.z.}...r.../.G.2.$...b..L.. .Y..R...G..?..N[....d.|...u kkW..i...h>...e.....$.BD......3Z[......@..,.?2yb.....y....Gw..H.kH.......6.<B..vzc.3X....Z;K}S..Z...csB..M(....s.....2...Y...g.n...Km..V.;.Q.....t.m..j.....*.)....X.....|...:]N,..LG.'.n|..*.!.....^..7...n.NN...l.k.F.....G..;..v{......: ....?e.?Fbk3.p$.....V....y...F.|.a..V._-.....(N...W.#

<<< skipped >>>

GET /free/frg/products/632750/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 08 Feb 2010 12:06:05 GMT

Content-Type: image/jpeg

Content-Length: 22958

Accept-Ranges: bytes

X-Varnish: 1111897218 1111532531

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......Z......Adobe.d.....................................................................................................................................................................................................................................................!.1A..Qa".q2...R#...B...b..3C.rc$%.'..S4Tt.&.........................!1..AQ.aq......."2..R.Bbr#.......%.3Cs.4d5....Sc.$6.............?....b....T)m.mCD.....t2Q(...L..{....~Q......:c...A...?...V'...m..v%?..R..h.$...uK..O..?..r1..2...;...P..A..Q..1.K..*(>"..j]...H....Y..`7..F).p .H.......1..(.aI.6..5JQ^..#.u.-........xCC!)..G_.T..F.2...I.....\.a....?...iSE.u.....9..EAQ2.0..)...R.g.....5........6.|4......~;H...z...T..M......s...8!TE..tU.#....P..e.....?.8..I..N..a..hd.I.<I...F..`...#Im'.$.u...5....9....z.~..m...h.a5.%@........D...X....p.....-.~)5....:..V..G..e..VT...B..^...R&a...h...j<...:X"7..*.}.- .....@a 9...YXY...j..#]k.|...."2.4. ........#l6.......|..P..8FA....[~%Z....R].8.-..u.....J.... ...aAi).;S.A.Z4..')......S.?n......}0..OR.|..~.m.9JPQhA..C..c....d.}).......T%..o....*..........B.~...L...#.f=T)....z..4.z..../.c.W....J.>.].Za.{m..jIK..N...t.."..Hrp....u;..G...0....".).z.|4<.3.....O..<.v.FpM.%..:.. .4<.._.X\|5....sj.....]Be....`.....QO..M. .F0.....>......#.......Ec.\...s..5)p.[5..Y..9..n... .dv..}Z..".....G.`}G?%R.....8.wT.F>.......8A7..g....@....O_...w.GP.1......O.Py$.}.q...%...8 .4Fb...'.D9....QJ...[B\.....j...B.Sg}(.... ?..SB..3...H...C.z[.G.wUH.M)....lS.h$.a..\Yq!"i>.H.]....T.:..n.4..0&

<<< skipped >>>

GET /free/frg/products/765950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 26 Jun 2013 11:57:29 GMT

Content-Type: image/jpeg

Content-Length: 49185

Accept-Ranges: bytes

X-Varnish: 1109789826 1108363347

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:24 GMT

Date: Fri, 01 Aug 2014 15:05:24 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE211955FE55656C7D978" xmpMM:DocumentID="xmp.did:BF9ACF03DE5611E29D5CD82168A991B7" xmpMM:InstanceID="xmp.iid:BF9ACF02DE5611E29D5CD82168A991B7" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFECAE02DCAD11E297D7DA6E15F12B17" stRef:documentID="xmp.did:CFECAE03DCAD11E297D7DA6E15F12B17"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.....................................................................................................................................................................................................................................................!..1"...AQ#2.aqB$..b3..%E&'.........................!.1.A".Qaq2...#..B....Rbr3$.....CS......t...c..4T.5.d%&.............?.L:.r..PT0...T.1.2..N...F~-N..us..{/.8....-.7`...%?O-z...(..;b..zQ.....8......h....p#8.......z...=z*.._....YX3....nk.h........AoB.A...........m.V..a;..?@.D.qU...c(.Q9Q..W.:...6G0.

<<< skipped >>>

GET /free/frg/products/559350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 13:21:44 GMT

Content-Type: image/jpeg

Content-Length: 15034

Accept-Ranges: bytes

X-Varnish: 1111897258 1109849730

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:00F0D465EA2C11E297FAE79CF768BDAE" xmpMM:InstanceID="xmp.iid:00F0D464EA2C11E297FAE79CF768BDAE" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E1799641E79A11E2A6FFB8C361BB07AA" stRef:documentID="xmp.did:E1799642E79A11E2A6FFB8C361BB07AA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................................................................................................!.1.A..Qaq"...2#...BR...br....S$34...............................!1.A.Qa.q.."....2.B#....Rb.r..S..3c.$t.............?..as.ocgD.r.R..1..........>..W.#._G..yeZ^....O).P:E.6.....T.j...72[/.s#JEi..?~..l.`..&K...YR.Z....tjjmJ.....$.;...2.|....#u....[..bM........C.....]x6..).......J...i.....~.!R.$...'...A.v...D....]............1KG{u^&.S...}..E........e...;}..\a.......e....

<<< skipped >>>

GET /free/frg/products/735250/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Jul 2011 19:31:49 GMT

Content-Type: image/jpeg

Content-Length: 20909

Accept-Ranges: bytes

X-Varnish: 1111321462 1111163977

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......I......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..Ã„S...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?..RMp....CS.s.(>..{..L.I..6 ..}.... I..;.......G...$........#.q...{..f..m...p.;.g.^..........\......d......U..#.s.$A..b.A..Z.Q.TD.1..9...p.w.2H.E.....z.........0!\...o.|....X5x. ..!#./..3.....dl.....5.2.7......g_....c.Ld..X=.D.bH".T..1..?2i.G..k...J...w?,.}..L8.GM-...";....y...FR3.",.._.....=jY.%e%..R;..{..8p..S...j#.!7..js@..2:....c..<^.C..]P.......s>..\N..y..6............Z..z..V....H.....a,.............=.....D.A.....F...}........J...5._.. _' H.4.p...C.!.. .:..........=...M...Za..J..3......E["..."..H6......;..1.6K#...b...a6.2*..<..K....`.........K ..0..q....=f3......Jx&%|...W..9%......F....=Fxx....L.i.8I......O...^...kb..O.~../..%<..,...;....e........x..D...}.........y../...VE.r.\..pv..}.}...OS.....3[..C...:>.......a...#...g...9.....q...z..d....(...:...]&.i6...2YZ....wgk)..O..FX.........fF,..hH.:..a-6H.)D.y.....Nd...$n68Sj.;...R..-.....}.\$l.h.ku.*.......T...d:%h.

<<< skipped >>>

GET /do/gatewayCD?sId=&subId=&actid=&callback=updateClientCookies&_=1406905525155 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: player.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:16 GMT

Server: Apache

Set-Cookie: JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52; Path=/; HttpOnly

Content-Length: 166

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1

updateClientCookies( [{name:'143_TURNKEY',value:'Default-641406905440442383',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Default-MSIE 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:16 GMT..Server: Apache..Set-Cookie: JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52; Path=/; HttpOnly..Content-Length: 166..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1..updateClientCookies( [{name:'143_TURNKEY',value:'Default-641406905440442383',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Default-MSIE 7.0',expire:'7776000'}]);..

GET /free/frg/products/450950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 25 Apr 2007 20:42:32 GMT

Content-Type: image/jpeg

Content-Length: 30468

Accept-Ranges: bytes

X-Varnish: 1111190532 1111049418

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................................................................................................................!...1".A#.Q2.aB3q$....CR%.........................!1..AQ.aq"2.........BR#..b$.r3C.....S..cs4%.....D.............?....q..V.B...j<.....>..'..:`U....%#..2.zv.I....BH:.....*h...._#.F.....W....^Z.1,%3......9L..aXw.dbz.....l.....<.TT.F.\..G#{/.u....^.......t.,....'.....z.97.d..A.%c...j...c....<.[4..:;.....\....kUF.dO...[..\L.R. .(.@i3.\g.(.c....%.f..~.?..{x...Qo.$.=......t..2..z.]c.q.....M.....%e#.6.y.,|.........B.P.........N....9....I.r.k...y..qy.d.....F...k3L...)n%.#A..RI..-E#..=.~.Y6U.....r...4.......3.S0...-...G .X.6&...._...,.k.d5,k&..%.;.....D .g..5x.D^.....uf....EMp.z...I\...#I.x.......U=m!*.:S.......>i`...lP-y..U..j!..7.....=.TU..M]k.Z..V..hH ......@...........v....E4..U.A........{H..U....n...S\...mn..E.?....<.>...z.vU......;"`..c.LK.......\J.}.f!.a...^b....1......B...2...Tb.SN.w...[Z...EL\R........Z..xa3...6-....E.z...I...?D.pl.~...`.....(..(b.%..v1.zn.z.I.......Q4N.......r..m......[.a....".n.[x...I..R5{../.)\w...... ..2.!O..#Dv..Aj...DT.M......K}........56.-H.2.......c.......\.....c...d..<b..rV.s..h... o....U)...4g.u!.n;...C..[J>......EGOmo..p<..p...&.....)..*j..F..j..._..4.j..#8.....=..J...z..{.b..r.....s.......B. (.o..<."]...d.@I..ysZ). .........@F.8...e...../T.k.m.@....)..<....-.\.

<<< skipped >>>

GET /free/frg/products/661050/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 13 Sep 2010 08:36:31 GMT

Content-Type: image/jpeg

Content-Length: 17879

Accept-Ranges: bytes

X-Varnish: 1111190609 1110319050

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:21 GMT

Date: Fri, 01 Aug 2014 15:05:21 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......R......Adobe.d............................................................................................................................................................................................................................................s.......!.1AQ..a"q..2.....B#.R..3.b.$r..Ã„S...cs.5D'...6.Tdt....&.......EF..V.U(........eu........fv........7GWgw........8HXhx........)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu........FVfv........GWgw........8HXhx........9IYiy........*:JZjz....................?.......n7...5.9.}.o........9.`.... v[-.......1s.0...U.......[..7..5,_.......{ mZj........[q..}C..8.bW.f.....>%..._.....3.#....c..7...-kK|.f.mA~...,.V6$.i.j...U>u.........V.Nh...&.....3...4.Sr....[....Q)....61'..........;..k{r.O]z.d#...,..JrA.^.X^$.Z.d..j.UHf...s.!.. S..=.*.[....3.3t......R........n..q....G. k ........ ...&.,\.|......>h...........&..~_._...;.......X......B..?...I.....&..U._L..Ei\...2}.onM.=>....`....s...|.X..qBz.zy..!......2~....a. ..}...jX.......MIe......^...x.....".._... .r.HG...sp..5..{|..\.Q..}..?.[...-.<>..ZR_../Ox.C,.H.X.^-.....w.5z....w}.r.t...C....y.4&..|.d90.....k1".........,.... .R.."N..l.k.. ..AM...........l......n%..... VQ!....|...........n.... ...z..\.`.k..2........H..&..X....M.X\|$..v.....9..x....'....................;......K-W.~}.k..?#..u....G.r$=......I..Z........o8.8b..h....Zf..H|...C.....I...y<.?I.*A....%..KF.<....._V..@L.Tm*

<<< skipped >>>

GET /free/frg/products/680950/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT

Content-Type: image/jpeg

Content-Length: 17864

Accept-Ranges: bytes

X-Varnish: 1109304790 1107277168

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

<<< skipped >>>

GET /do/gateway?sId=&subId=&actid=&udom=partners.freeridegames.com HTTP/1.1

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: player.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; JSESSIONID=BDE7B377B564D173A6DCBE9F18107F52

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:23 GMT

Server: Apache

Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/

Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/

Set-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/

Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:05:23 GMT; Path=/

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Length: 38

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1

({"gateway replay":"{'status':'ok'}"})HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:23 GMT..Server: Apache..Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Oct-2014 15:05:23 GMT; Path=/..Set-Cookie: 143_CT=1; Expires=Fri, 08-Aug-2014 15:05:23 GMT; Path=/..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Length: 38..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1..({"gateway replay":"{'status':'ok'}"})..

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:49 GMT

Connection: keep-alive

HEAD /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Content-Type: application/x-msdownload

Content-Length: 12146312

Accept-Ranges: bytes

X-Varnish: 1926374319 1926325909

Expires: Fri, 01 Aug 2014 15:04:01 GMT

Pragma: no-cache

Date: Fri, 01 Aug 2014 15:04:01 GMT

Connection: keep-alive

Cache-Control: Private,max-age=0

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 07:26:35 GMT

Expires: Fri, 01 Aug 2014 19:26:35 GMT

Last-Modified: Tue, 17 Jun 2014 01:05:58 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15758

Cache-Control: public, max-age=43200

Age: 27528

Alternate-Protocol: 80:quic

...........}kW....w~.....;.$..&.Y@i.-..ZZ...Y.CJpB.p).....H..$t?....M,..~..F3c7.'"....{...E....A$.|...\...L2..`?.{I/.g....N{Wr0.X..^...d...g.L. .........r.z.#..G."..~%.p..e_..p.^8...'.i.._.J.=!.6.....9./.....a}....`.. ...>..t..ox..q....D..(v...W<.P.......^c....... ...F...@(p.....NW5.a....`.n....l.K....:..... .h....!DO..~.r>.E...F..=. ..e...h0.].}..#P.0.ol.....K>..o.....%........{.....&.@.q..:......{..c.nzP*..n...........[9..)Ta...m=z.m......(....N...&A...X.KCV5.R...<..._|b&.$/l..3..1P'..O...s...x3.E..J.....[... .......8^...:z..".7.y.2.....,C..Y%.0..4...^.V..y.#..`.6U...........y..w...5=...N..{....o;.u E.iPs...........$rW...._.m.?..@<..W.g...L...../.a./...x"........a '.......|.n.. &S....Ea....r..P.......5.89..lto.$....z..s......|*.;N......AN..mL..*..(...U...f2...,....J...y.qqA.........BTo.../k$..7r..9P..H.J.^.......b..=..A..&...Qo.A?..W....l.........'".. ..D. ..EA.........Id.s.....2.9.k.f......aZ.0.r..H....n0.#&.|xo.]X..-..-..5.....4(.x..4j&..V..p.N)0..5..Cv.K.!........&A>...I....:>lh.A..>...U...J'..........B.q..y....()..3. .... A".u{{.;.......W.....k-..zF.\`Q.0........\d..a..A.1....5.y...`-^.F..M"tf.GM. .XY.YU...T.._.lH.......A=1..N....?Z..R ..{...(.RS..^...)...8Em.e.EU..^.....<I.H..C.....R......%...<$.........S......L.,.{..)..b....-E&.7...f.V.j..(...Bj.l..!..K...Z......T......B..NU3%4.i...9.......a...>/..kE.`_.$.;.Ld;......x.H....\.8.n....D8....@V..K...Vu.v....V1@.-...k..Z.....J..D.R.m..J.5 ...U...$..jG./..>O.}.,R.....0q..l.;2o'oJj....|]M.........:!X...&![v..EO....E&?.N.$

<<< skipped >>>

GET /free/frg/products/633350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 14 May 2009 11:41:01 GMT

Content-Type: image/jpeg

Content-Length: 22203

Accept-Ranges: bytes

X-Varnish: 1111191246 1110490904

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d..................................................................................................................................................................................................................................................!.1.A"..Qa2.q....BR#.br3.....c$.C..SsD%........................!1..AQ.aq."...2....BRb...r..#...3.....sSc$.............?.J..m......_V.$.|..3..#.....HE]GI...k..;9SW....'m..k...b.._m....Y.R.u......BZ Q.$.j%.]G&..z#....(.....=.....s..........I.%bl.q7...8...c.A.].m.h.,....[H.N......x..[.\......t...U....W\..G`2....`.{....!.sE.D...]1..&:=..R...y...,.....RU..i.~b..ie.q#.5...SC..U.,.IT....N...3.w^......v......;.l...".K%..p..$..v$P!..r..:...T{d\0'....K..,....rT..P..{....qg....P..-.o..$....[KIR..@-......mL.-.....^.I......n.6.........,...-?R.PG...;.h;p8.55.4.W..w...Tii.;...r..&$.TQ.*.@)...y'}...pEv.UO6w..3N.j......&E9i..P...2).MW8.o...."...i]|u...*2............R...qQw..c....O5s..5.3...d...yM...>......dM`....9.|U...C.......5X.a.n..?mX_,.....N.{..g...ND.p....@..2....!.l..<=B}4.|.j J.."1(W!%t.%iS.B.H\.#*!....&.y....X\... ...$.K..|:....s.N..jhd.K^...$B.\..(s.....BI...0..w..VY.I.\o.n.j........T..Dv....m.hy).....:M..|...s..#.......w0.<!.s..Aqih!.....v...Yx...d...'...z..jr8...K...UN.T.x...^..3....DN...S..8...qZB.$..Q...(..>...a.fI;.......Y9V.....&..Yu.eA....eI.S...Rv$h....X.6.^...G..e.P.,2.:..t......i..B.p(N`....l=...7.6..5.....P....1(...^.......GPz.....;.7.....I...........W.-.{1.U.[.cl..<!!...ajK@!.iZ.R...B.|.6..mX.7.Ksa...qn'.

<<< skipped >>>

GET /free/frg/products/619350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 16 Dec 2013 13:51:05 GMT

Content-Type: image/jpeg

Content-Length: 16168

Accept-Ranges: bytes

X-Varnish: 1456967477 1456500431

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......<......Adobe.d.............................................................................................................................................................................................................................................!.1..A"Qa..q.2B...#.b.R3$..r...%..C..F......................!1..AQa"2...q.....B..R..b#.r$...3............?..H{.........M....5J$..4V..Q.Q...1\On.#R$........xE......5* .4.W6TD...g..-........L ~]....J.X.s...:tI...T..C........yZG....X.R.A.N......0...%w..............P./ k&..............~:..{?'qb>>......c{.R.:4..7o..4..|m..~>._.y;rG..I.....-...,.~.. .....I..8..z|j..M..)....:.Y.2.82P".v.TS.........9..."..#.T..v..X.......7l....n......`......J.'....F..=.../..B.^....{j..z.@>_..k..H.......cC.....!..u..iC.o]..Z..]...a.[r.|}.....H..|..........u.SB}..Y...:...gh..#..w.^......{f.......?...Q....'*7H...|.no...$r.nc.:.....IYD7....%....E]......l..&m.q....B..&...F.........3.....X...h.<R...PF.d...!_KDD..N.....9f....._...$.L.x..vN1..Ui.Y..b"..k..i$.......YT....]..,$..b.B.".......U.......&......)..._.7..V.D.G.U(._J.qM.k...U.Y.].j..r....K.... ..8!{.........X....S....=& x....={.'...7k.k....d.}...5.}..[...zn=.B.0..W.X.r..-Jn.*....0.nE3..(.x.p...u)..,....y........uN|..SO...G4....bE..#.RG..q.T....$.65>.6.]............o.."$..JM#..T..Y....h....#../.M5..[L.!H...)c**.t.#.......I>Q...<.[...W &H(.EQN.H*..Nco........s...q......c........J.....;-.o...\.\ZPN.F.%Hp.....*.'......n...cou..)..J.R...j=cY....r..x..q,w.'.....R...Z...,B.s.........{.

<<< skipped >>>

GET /free/frg/products/701650/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 15 Sep 2011 12:15:52 GMT

Content-Type: image/jpeg

Content-Length: 18010

Accept-Ranges: bytes

X-Varnish: 1679378593 1678835593

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......F......Adobe.d................................................................................................................................................................................................................................................!".12B..AQR#aqbr.....3$.....C....Sc4%u.....d5..........................".12B.!AR...Qabr.........#....3..q...Cc4$T.............?.|.....w....|.u...br$>.4$..k..@...\.Z..."#Y|;U...W..5.l_.j..V}/k..../0..5...$6.....y.onX..P..]......M Jf.Cc...QA...)..rV....`....<.......j:.="`o...ku...yHGj.<c.D....i....c..t...z<gePO.L...P...N.V..............;...8.y..L~...av.e.dd;1.l...)...n ....J....;..M......?;G...wi...w..qU..q.4....\{.N...[..ml..O{............=?.1z.qe.-....3gjA...7D.3.p.8..._..x..f..[..j.y ..a....r...<. ...&.n.SMJ1.6..`).M...u...Go..E......M.JQyd.{..uE..2....&.M.n..t;.....&~Q...I.*.'.?...2Z.-.4.@.V.{.q,.n..=..Ejf....7H......o..U.w.o..&.....................V...W....hfP..4.^\TI.&.Lo._Lb..ov....V....33....V.).....S.zV.-./e.....Zwb`.*....q...Xpj.... ..x..................7Hv.kj....vA>.;..4.)R.|...7z.a...v../?.O.Xv.....5u...j..;...[...;e.5tj0.....<.4.5.D....($j....|...f.4..Y.....H.M.......#......#.....!E..8..(y.L."...(../p.|.....e..O.[.. )r.'...a..;t......D|.F|........Xz......^....W....$......^.!...i.....is"@...F........=...y$..Z=.^....19.._@#L...V;y...m.....b!/x.b......FT.4..u.~....G...B4.3...D.o.D..\.H......s.D] ............s.9^.........*...N........PVm.a.C1...k../ ....[m...V.. .`b...S......:.....D='DkT...G.m. ....

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard/js/defines.js HTTP/1.1

Accept: */*

Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:25 GMT

Content-Type: application/javascript

Content-Length: 1371

Accept-Ranges: bytes

X-Varnish: 1111625342 1111347017

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:02 GMT

Date: Fri, 01 Aug 2014 15:04:02 GMT

Connection: keep-alive

Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Markting = function()..{..};..Exent.SDM.Markting.Defines = function()..{..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard/img/",...freeride : "http://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.userAgent.indexOf("Windows NT 6.0") != -1) ..{.. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3vista.jpg')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}..else..{ .. .. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3.gif')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}....

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html HTTP/1.1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT

Content-Type: text/html

Accept-Ranges: bytes

X-Varnish: 1201441805 1199270395

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Content-Length: 1615

Connection: keep-alive

...........YmO.8..\$..7......i){-...tp..-.;.'.&nkH.(v(.....v.B_...]..8v...........^...ct.??C........c..4{.}.?..-.i.~.#N.e..m...q...?..P....]P............a......it...z.....1!.@b.....^.>...'d..0...../.\.......k.hg'........o.........7....F.[7@.o.....Qh,D..m?.,rO"a.lb..B.....Nn...H*....G.N.k.i8.j8..SP<O.:.lo..C..R<.....Ws..u.B...N...7.C.<.tK.}&p.V8,......h$...h8..f..P...R..^t.U/.F...........!.N.C..C.....F..L1...0%...U...J.A/..FW...N2..E...-.....D.DKJ..Z..n."=R.,QU........... .}...C..A.h._...0%...A^.....T....Z..-...cNP..MT*.........!....).n.r...j....b.t........ ..!.e.[G...:...i.X~b........?P.@:.0i3...=5F$J....C..~...$f.O@9.}.z....9.7H........Ni.'#w.(...B....[o.yk.).....!.o..K..!NC.Q.... .Y....q...G.4."6.!.8...h....)/r..I....<..|.....T....sy..Y..=....g!../.i....9.= !.Z..eU.P._H.'._..P.d...0*e.Y$.D.#s.;L.S ..Fx..${......r.{.....#...".p$w.....gQ.^E..#! .Q..u#O.2R......'4.H...\(. .)O.K...$.i.....0.l......Bm'i.u..U.....k..v*.&.Q......\.Q.W..L.~....[E..[..i...,...*.S..lj..DU`W7......usJ.1.>:N}L....a(...8.f.....,.A=.4..............fD.@.P..K>.gc.=......... ..D..5...*...g8...H..j..|/..Y.....Stp_..?E.. .....z....%.;.....A......Hv.23.TT..Qe...Dw..]..t....r....*..v.1.U.n.). ....]V....!..v2#j...1..)...S...},.4?..]..A.u. u....K9awP,..R....hP7!;.....!.U..L..L).i....$.(W.FM.f..AQ&.....U..........w......o....|...F.............n....v]..<......0.....mD.:o8.....G..$.*....<..YG.^}.V:....c...f....<..=.#[i...'.FZ.\...dO...qp...ei...r...:w.|...'...|.`.j........,.t..s.nn7..f..w....L...w...*;.......X.v1H}a..>

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/js/defines.js HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT

Content-Type: application/javascript

Content-Length: 1376

Accept-Ranges: bytes

X-Varnish: 1111680727 1110770841

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Connection: keep-alive

Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Markting = function()..{..};..Exent.SDM.Markting.Defines = function()..{..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/",...freeride : "hXXp://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.userAgent.indexOf("Windows NT 6.0") != -1) ..{.. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3vista.jpg')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}..else..{ .. .. Exent.SDM.Markting.Defines.SERVICE_PROMOTION = .. {.. .servicePromotion1 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion1.jpg')",.. .servicePromotion2 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion2.jpg')",.. servicePromotion3 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion3.gif')",.. .servicePromotion4 : "url('" Exent.SDM.Markting.Defines.BASE_URL.cdn "servicePromotion4.jpg')".. };..}....

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT

Content-Type: image/jpeg

Content-Length: 48259

Accept-Ranges: bytes

X-Varnish: 1111680765 1109735540

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:05 GMT

Date: Fri, 01 Aug 2014 15:04:05 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|..............................................................................................!a.1.A".Q.q2#.t....B.F.....Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q...?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.

<<< skipped >>>

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=4858524-7287785

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Content-Type: application/x-msdownload

Accept-Ranges: bytes

X-Varnish: 494852605 494804948

Expires: Fri, 01 Aug 2014 15:04:02 GMT

Pragma: no-cache

Date: Fri, 01 Aug 2014 15:04:02 GMT

Content-Range: bytes 4858524-7287785/12146312

Content-Length: 2429262

Connection: keep-alive

Cache-Control: Private,max-age=0

HTTP/1.1 206 Partial Content..Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT..Content-Type: application/x-msdownload..Accept-Ranges: bytes..X-Varnish: 494852605 494804948..Expires: Fri, 01 Aug 2014 15:04:02 GMT..Pragma: no-cache..Date: Fri, 01 Aug 2014 15:04:02 GMT..Content-Range: bytes 4858524-7287785/12146312..Content-Length: 2429262..Connection: keep-alive..Cache-Control: Private,max-age=0...>.W.O..Y.'...n....1l...^.YR...'...-..<.._...........'..,x.....`........IS.V.....(.a.....i$.|.^.....W...P.(....&.....a...c.C......M..B.4..3..y.R.....,x..O..... ./HT*.]..5..Y.W=..f.7....y.vcs......H..)0.h[m...Z..ce[.XY...n...S....G..t.vD'.. . e..<...#12....6....W....<./{...W....8..pk.VoaN.9......C...g$...........'F.......2..YZfq-..v....fd~Cd..-...s..T....t..S..T...9.S..Q/.0..l.=Z...p0...F...}7....e...G]:~.q...l."...vv..~.#......S......=1......4.X#3D.t..Q..........I..4v`.. .=a......ix3...CK.a.&....o.g...X.n.)..z....G..-.X.|%S..8..&...1}....../.\.)..L.@wM..<P70.....b..hR..B...O.#.l5f.....1..op{..8..)... I...0.O..}5Z...Qj`%f....6g..u..-.|...O..m.A..... *yV.i\...=...Wj...v..p? ...v....:.......iKD_.t.k......|....68.6... &a@..:.....I....'...iI.L..._. ...j..:"E...i).0R/2G&..w).fet.,.....#J..m...X/.......i.;..E..}..c..Z..>..Xi}.....`?.....N..i..i..qY..!r.Ji.n..p....oz....<.U.:..Rur....Q....bE...F........zC.4.......s=~~..!...z.._:.-.z.9b.......1.f.......^?..'...I.(.>P.K.....B.]5..;..m.e.!.........&..]...b^K...LCQx......Y^:.....ofd...]..`..aR....o...p....h.e..l.... ol.lt......K.......,...r...........h.x`......|

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:55 GMT

Connection: keep-alive

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:23 GMT

Connection: keep-alive

GET /free/frg/products/624150/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 06 May 2009 07:47:22 GMT

Content-Type: image/jpeg

Content-Length: 18319

Accept-Ranges: bytes

X-Varnish: 1679200751 1677933599

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d...............................................................................................................................................................................................................................................!..1.AQ"..aq.2B..#.....Rb3$...r..%..c4.......................!1..AQ..aq."..2.......B#.3Rr.............?..H...7.?v.f......X.o.6....t3x.ZT..2...T.....?r9*e=W...[vd.w....kq....D.-_.e......\...a.?..k]E................{X...o..c..%x......X.@..).C .p.z1....t<1.....5..|.%X.....~.[...^-......g.R.K(.....MT.:s..F...q.......;.'/...;....:..}k.............Kv#..ml.!E..j..6H7<..B?..l..@u_v9.]p....*....A..?.|..*._....p......r..O.x..r{e.^>.......T..........t...[..V.....=E.9g...o...gs..E:..G.W.!.s.?..{.d..a ..`....5...... ..6.....~.,{.a....=[E..K ..2..C...\...T.c..?........6......W....z..z..l<..........W.kZ.z.7......U.s...w.....#..T.$......z...[.K,k$1......$....\..9..Z....]`.P........1........L....;..[.p.0....;..q....r.h'.te......O...L@.K....<Qk.\..x...S".....yFk..q....zZTGl..k..o...7.....}G..q.\.\..yv.?.............?...[p..S..b.....,......D.v...fQ..Qb..[.......J\..8<n-Z^...F>..e;G..o.{8.a.....r...zn..T$5c...Ze..|....g.......x........N9.;.F.~n.1.@.Y..h.[p..a..(..q?...F.m........'.G....<g.....L~3l~R...P...e`......B.}.....Y.DG$Z..o9bo0.........Z/...Y..I.VZ.L.B...PT.v..u....7...-.G0..g.4....M.m...L?......b:...VA.........1e..0*.9%6=....r1f.Fd..|..x.....'4..z.......^.8.;.qVm40.mkwG........vS...q'H.;y...\..y...<g?..6.. lL..

<<< skipped >>>

GET /free/frg/products/674750/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 30 May 2010 12:08:35 GMT

Content-Type: image/jpeg

Content-Length: 13779

Accept-Ranges: bytes

X-Varnish: 1078423183 1078015529

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......W......Adobe.d...................................................................................................................................................................................................................................................#.."23CS..BRbcs$..!.4Qr....DT.a.......t&.q..d..5e.........U6.........................#3.."2BbRrC..1..S$4......A.c..T%&7.............?......t..Z..[.n....j.9.H.R. R.d%_.....2N..I..8.I..a....m..X...U?W.A..`../...E.V.~..Z.....5..EQ.rxd.........>U.x)>Q.v....f..R7.xJ.P.=$.!.{?#..]aY...\8..t.O6.u.....U...F%S.).4.....@..<y..5......k.dG.ZM&Au9...Ov.J....M.c!.....\......Q;z.~.y.....vt.....B.w%=....-..f.v..O..Z..........S8%ot....z......P.......!..F.u..:0....*,zA.1..R....w.y5 ...C..a`...wb.V..p......:.....w....L@.$].=6\m......*;99M..x..U#.k.O...Vv....../.k......T .#.z.t.F.\...Q<.......'.&....u....E.m7..d..,....^....3..tN.R.......!..*."%v.2.1.T.U...Q.p.P.......y.y...H.E.l....kU.n<[.R....H.]uO.71.~>.;Z.....0...n..P.:i...wmN.R.ZF2H.B5......k......U..g....q...I.SoC"..It.I.'.}z..^..Nd.`.....?a.$`.i./.).r?.D.....PB.{........,.B..?....T...F..^...o*...h?>..D.G..aZv....i.3.ke\...B...FBhP5.......a.4#..x.......c.&....:.W..*o..S..@...xL..b....Um....EJG*....(....d.|..rb..<.Y.^K..Z..`(.:{A. &M..b...D..Vxr...[@..X..K^.)6i..>...'...;H..........U#0.=..\.JE"UI.''.jI...._.2../....-95.R.cSV..Z[..i.B.r.y.k..O.:...{.s%...I...B....(...g.'....a..:.p.r<.#..n....!..../-..hJ<.a\3..C.....V.k.y...r.....Uv..4.3..A..".._...#BB)...

<<< skipped >>>

GET /free/frg/products/575350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 25 Jan 2009 14:27:04 GMT

Content-Type: image/jpeg

Content-Length: 29740

Accept-Ranges: bytes

X-Varnish: 1679729950 1678424226

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d...................................................................................................................................................................................................................................................!1.A"..Qa2.q.B#...R$....br...3CS.D%........................!1..AQ.aq."....2...B...Rbr.#.....3C..c$d..S.DT5............?.Z.......-se..d..X..:...b_.L....'.B.K.[PCm....N.......Sr....?.T.%...K..8..09&T....s...kb.5f.....@o..=2dZ.1..-TK.RTR.MM..t{.#.ey/...o$.{..$p.P4....*N....n\}...s.}&_...[....2.x..S.. ....'.kZ%*.es..5........;.E(q....<.....-..G"],......'......A_'zk.A.o......"".c..........J..nT........\[g8gs......w...u.@}a.94%?..HI...5..'......N....T.=..'....@....~|..6X.......LiKrM.$.....A..r......#p.oN.1..a$..........8.#.N\.../...6..]U..O!c."K...C......@Qi...%.%e*. ....4....A ..Sp......((W.^c>.....#.4kD.7.|."..u.GVKt},0.R.q)\..h@.....SLH.$x:.n.....u...^S..xe....e>..n...... z...Q...)i.....m..zBI.4W.h$iW..../*8.&[.c...U\I. >....u..8c.....C*..2;.K.*!.....rv...^..e....'y..c.\.VG'...W.>}qe.\...a..O......}.'.T......J7S4`.......%}G'..........t..S.........[U.x...rI...L.*...r...h..%,A#...?mS...}.TU*.....5^.2K..Ql..........& ...#.......^..~...s.;--8.3g............6).?..:.....`H.;.~.C..R...#...<...U$.m.....4.FEs;H...A...a.~2v..r...i..L./w...|..2!............7T$6.....%B.u......i.7p.f.{Ms..........Y.'_..#Dr6Ap/.D....*...$.k..bp..{N}..1... {..4....q....S._/........u.^>... bRB.i...).........4...R'b.....%...K$....w.J..7.#.

<<< skipped >>>

GET /free/frg/products/766250/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Mon, 19 Mar 2012 10:53:17 GMT

Content-Type: image/jpeg

Content-Length: 11446

Accept-Ranges: bytes

X-Varnish: 1111897285 1109846362

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:25 GMT

Date: Fri, 01 Aug 2014 15:05:25 GMT

Connection: keep-alive

......JFIF.....H.H.....C.................................. ..& ..$... 0 %' -,,. 150*5& ,*...C...........)$.$,-,,-0,,-,,,,*,),,*,,,,,,,,),)),,,,,,,,,,,,,,,,,,,...................................................B.........................!.1A."Qa..2q...BRb...#r.$............................*........................!1.."A.Q#2Ba34R.............?....hQI]....<hh#.!|.=.........m.>..U..,5.zZ.?tc...m.P.TanG.....i\rR..........z;..|..%\."...9........{F.N/a....o..:.5....=.I.Z...^;c...BvP.....G...8p..q.l..S.r....*~..Z(..%.y.....6>%.._.............d..h.K........c.h.S.h.......%.G.......A<...A.3..fy...;...~..U....*.&.t...M..J......-~.j.Jb.d.....C....;..>.nw8K.`.9......],[..P. ......'...C....8..Y.u).Ni.X....P.v.....lv...N......$|.R..#..%..'...ZK..R......X....r.Z:O...8...m,LdT*.{..{..)...s=....qL.pAN..y#.....Z.}.>.A.V..q..........h\..!c.X....1. ...M..r.'..x.{..7./.0,-.Dy.y`BH..t.b.O.}..........A..dUe..<.|}$..Q......)...W.\F.....G....F.t..B..u.QCNV.OlP.........v........<.x....2...".@=9.8]5.-.....7.&oE/m...x.X.....'pw.....I.....FGP.S..n......cr3N;f.%..)A...z........&....m.I....N.K./..'a$50Ib.&..2;.q.....M....j,.......;.o..Qsr.4..~g..i...CR5.E;.OK:'.P.o....\5.~@...u.NM$c..m=md...<...;.g...u..B..n.<..M.ql..W..kUH..Y$....v....A.G....G.Q.....3...#.k.=<....S....."...v.7.-....k..:.c:Yl...D......4..ml.-0j..*...........;.Dej.e...pG.........T.....?\d...I...Cd|.....I.I...~...^.......*.^.ceR4.v..u...D..h......4......J.....$s66..J#.m.S'.....n..,..@R.._.$.#]..`..ze..e.m.......6y...~.a._g....fI.$

<<< skipped >>>

GET /connect/xd_arbiter/oDB-fAAStWy.js?version=41 HTTP/1.1

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.ak.facebook.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

X-Content-Type-Options: nosniff

X-XSS-Protection: 0

Content-Encoding: gzip

X-FB-Debug: ZB 50aMstmsTvc/Q8Bzyb3YkyXotkTC nMtFOpOrjd9HqCdP06SGvCzueP0UYwZvOqczfcXu59vy W3jNMO3Uw==

Vary: Accept-Encoding

Content-Length: 9227

Cache-Control: public, max-age=30665886

Expires: Wed, 22 Jul 2015 13:23:26 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:01 GMT

Connection: keep-alive

GET /free/frg/products/554350/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 11:07:11 GMT

Content-Type: image/jpeg

Content-Length: 16660

Accept-Ranges: bytes

X-Varnish: 1110726342 1110402620

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3EB270A5EA1911E2A262D7F48EA80A8F" xmpMM:InstanceID="xmp.iid:3EB270A4EA1911E2A262D7F48EA80A8F" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EAF28A94E70E11E2BDD183F16790EF49" stRef:documentID="xmp.did:EAF28A95E70E11E2BDD183F16790EF49"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................................................................................................................................................................................................................................."..2.BR.b#3.r...C$....4u61S...%5..ATd.aq.cs..D.e.!...tU&......................."2.B..Rr..#...b...3S4%5.Cc.$d....s&.!1Qa...D............?.....$&..JH..g.$.6...-.VK..j..ls0..$..s....M. ..../,.u..?..}.(..;...........z..|J...8.c. ..........X.... m.]b..w.._....'.:ET..6O.u.i...T...^..^..z....c..`...T..Z..X.e.......? ..,.[......u.s.Q..\.5.......W6..'..W..9.(..W/.FlrI...\.: .M..u..

<<< skipped >>>

GET /free/frg/products/616550/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Sun, 25 Jan 2009 14:27:28 GMT

Content-Type: image/jpeg

Content-Length: 30153

Accept-Ranges: bytes

X-Varnish: 1108941155 1107966858

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P......Adobe.d..................................................................................................................................................................................................................................................!.1".A..Q2#aB.q.3$..RbC4%...r..&........................!1..AQa.q..."......2.BR..br.......#3..Cs$Td%&.c..4t5............?....}...~P.............pj.^jq...Qt..B.1.R.....4L>._#f.......z.....36.8...8..E(I...:/Y..z....W..g....h.'.@..;.7..WT=.]...QY...9].;v..0....|.c...............9..p....~L....\...xP..Z.qw.."...&..MG.W..f.Vp...w.....d.t..-..#oE....]..!.....Mc}.RHh..}.y7m-SB.>..z...U.$....o..9...1......X...&9..d#....w.l.^u.9o.s....R....U.~..C~.V?.8....O.D...G5.9....Ja........c........U...c ..wy{.....m...zWs-@..?..W.5...2...6...^...1.....T.|.zo5..-.y.m.Q.M...}A..Hy..d.^.M.H.^......E.M...j ..66...^Rh....[Kq.hE.H.RC...&...ut]5#y.......Z..v..~}...`-..J..p.C).................G..jZ..wm8..P./.9....,.<..T.!.Y...}.S...@.......v^. ..l^{i.|..."...u.m..r...2........VT "t.,..D........EuKM&.S........X....q6....2Zd...wkm!.wR..@..zd|[....K$..\^.b.-...f4?=.pk......PrG.v_zPfa9..Y.V.Q...Cf.vI@...V'..MG.V.0*hE.7.....s.l.F..K.i...i.BWy.}..>....U.O.N=..C.......4.U....mk/*M..);.....k..'...m.V.a.Bn,........{..>,l..I=.jFA.9<..<.?!.... L....3jV.]<..q.;^7]...V.r3h...U...bsZ.!.A...t.]..>....].*.&o.......q.V-.M.Z....re................ ....zz..0Ck.m.\.60.I%1....&w...G..,.yS...Xq~-.Y).5...1...5..#7..q.x\....../E~.XKp#......T........R.

<<< skipped >>>

GET /free/frg/products/608450/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 13 May 2009 07:03:16 GMT

Content-Type: image/jpeg

Content-Length: 26064

Accept-Ranges: bytes

X-Varnish: 1111897183 1110386755

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:21 GMT

Date: Fri, 01 Aug 2014 15:05:21 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......P.....&Adobe.d...................-...E8..e............................................................................................................................................................................................................................................!. ..01"#$A2..@354.......................!..1.AQa"2q...B#....Rb3$....r..C....ST.c 4D......................!.. 1A0Q".@.aq....2....#`Br....................!1AQaq....... ...0@................................D.bK.eX.U...:..H[z..k......h..mM.8......M..U..1ur_....N...q ...j$.x....Y...Ct.c.u.."F..1.O.Q.......l@...f...(....9..Y.f.=J.......$X..Xt.....YN..*.@.0...#......U....EJOE...c.T.4 ....4.k...x.H..Od.f.C.$z.6..R.9.......^.e.{*Y..2.._....<.5..5.hn.q{"....X.D...p p.N.\.o.?..V.....\u.6...g].^.....kg.d..A..5.n..9.c..=.A...uX.)....b..d:..y.Y..._.........z......P@D/..S.`..f....W.O...vr..co.]#..k..&...6qo..T...X....R....e.tR.$..6..T... v<m...vH.".NX.s.-S>.....K..to6.g.P.vi..H..c.O.>gi...c0G.....(....|..A.....{~u..... f.;X..w..=..e.....E..F.j.R.......M...c}-Z......\......Y..m....R..OsFK...............mM..d..s..].]=..............W'..T.#2.1Ku...>....j..cw9.&.CR{...P.-^.;]..E..Z..S.N..t.X....J..cdO.r..J..d.)}@r...x&J.T...^..leHP..Z..@=>X..Lu...I......1P@@T...S..t.....BA.B.7"........../...l} ;eda5".EH...l.....u..M:3.-...8<!......d....]).k.....Cc.f.*U-#e.... .Cu1.gHWw,tnjT..C...S...?..T{IsZ...&....j....l)6...ad[...,....=.N.]..5./)z..7F>.P...r..... .:.....a.......U.j..^Gyc<..]{$...9.L%.{..-...b.

<<< skipped >>>

GET /free/frg/products/631850/boxshot.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Wed, 15 Jul 2009 11:11:31 GMT

Content-Type: image/jpeg

Content-Length: 23693

Accept-Ranges: bytes

X-Varnish: 1111897182 1110402691

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......d......Adobe.d.........................................................................................................................................................................................................................................................!1.#$.3C..AQa..."R4q..2bScDT%....Bd...s.5EU&....t..6eu..'..............................!1Q.#Aa.3$..q....CS.4...cs....DT%..d5."..t.62B..&...Uu...............?..<........k..c.E.6@#on].3.....( .._O.....&..5B..^sYQ.......?>..." .....8q[|.....c..C.~.....2....../N..1.}.....0].D.M....d..~.Z./........".....w..$..I............8.5..D8...N8..1..>.V .=...d..%..X.1_.......\*..<b....i>......A...]...^!U..~y..dS&F.d..........>f.....j.Ei...g.....,..<.y.......z...g.E....8..PUX#,...ws...JQ!."..B.ZJ.m..F.t...l*a...j.f.._. ......_......>..\8.O....5Ys$.o..y......&t'.z...).|....i....z9..M....3LK..!..>......"O......Q.5.*..;....)..C.:..4.V.^`..W..P..0.</...)i........E~}...#l}.|...]......R)r.tY.../F;)9f..6......6g.....<J...9.q...C.n...5..`.0....8>.c..yCve...8o>}TJ..KT/.PB.,.4..2o...}:.&.~..p.{._.B..&..........=.UF.3..7.~.."W.2.C..L&....C.."IvwqQ..%.iz...{r{......0.........)........r...z...6j....U.F........h.....`..............{.J....:...I.....b4.....3.M..p........{".TI...r6..kf.`.n....o,3....m(]n9:M.s.|..J.\...z...X...EP.{..d......S;....7...<.4>.#.@......< ...U.......R...kA....F......Mm...]...-....7.5qn....'c...&.o....}['s.G..........<...U...5...O..a5.....")..^..j...C..kP3.....[)..6V..]..Op)..

<<< skipped >>>

GET /js/plusone.js HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: apis.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript; charset=utf-8

X-UA-Compatible: IE=edge, chrome=1

Timing-Allow-Origin: *

ETag: "418518750ca35248ccdccce02192455e"

Expires: Fri, 01 Aug 2014 15:05:19 GMT

Date: Fri, 01 Aug 2014 15:05:19 GMT

Cache-Control: private, max-age=1800

Content-Encoding: gzip

Transfer-Encoding: chunked

Set-Cookie: NID=67=VAwxPeEWnf-V572H3NDhiALl0goy6niXxd0X8aMQOSMmv8znUA6vWNcHu3mNN_oKf9zeHEjjr2xL9e77yJGxH62Tk0ph6xiK-6jNDi6arNC357sOEXOSJ6HVXTyHx-Ne;Domain=.google.com;Path=/;Expires=Sat, 31-Jan-2015 15:05:19 GMT;HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic

1298.............Ziw.F..._!a2..b!e;..Btl-../.$.I(...h..@.."......n...<..93.,5z....}... .m.X...a.'..z{:..u.a........ .n.#Q..c.....y.&.n.]A...1O|...x?..I,...UB.K...F..........2.F......F!z.WK.<...W D..g...xT....}J.X......<p...c....oG.g...1wI.....\.b.^.-R....G.9..Ln.e.(.x....K?.S>3.%Y...&.N.{n....A.....^.i.C]~b..2...uU.j.L.*.......i.R{}..WI.o.L.{...6...4..f~. .].hx......]1....?.k.b]..3...I.....k.F...M....D..(2."......*m.0.!.....b3..{.....F3.f.t.q.Xu...Oy..?...=..M.X3[U3..i.....Tv...L.M..?..41<......I3.{*F.7.........S.2>.....h.....AA..5.....{....P....-n....S.n.F.M....z;}c....^..-.`..j.[y..w.....c....]..#'c...... Ol.N..L.l.f.........@.vy7.J.^@.....hP.v.K%^(..L..I%^).R......yE.Q.#....G.....C.#Ao.],u.Wv...!....T$.-...&v|.tO~....=I^...%c.9..V...S......Nk..94...b.g......B...i.B..\.$... .V.=...l.X..kB\.C..^-.V3..&s......4...u..vFXR.Y _f...q.bo....|Er.d...a....s.o.a\hM..i.-..:.....g.......L.k`...4K..\b.,.{..d..PLl....o(Gr..]-.......1q...#L.<.q7........y`..`.le..c2R.....GP.i.....o.u..5.Ns4..hM...@..p.......1....{..qpa..F.[..il1pa..ls.OC.h..........0C.]..2..%....H._.r... ..=......}3r.W.. ..`.j.....@i....K....T.5...no..F....H.%g{...6W.\F........V43?o...).i...n.*-..X...r...%..s.c...bs.x.....y.u..`.i*(.sg..l...X.c..>Z}.....i.....S.D.C8u.e....i...gS...h..d.............d6....L|........U.';5.{R<7...Bc3].nh..xn..e......d..T6.2.&...U<..#.mHP..8q.dyr.'.A ...>..h.$N...P.l\al".i1q.[.a...d...../v...Xv..e,s,r..P.9.ts.1[..*.H..].E@QH........._.A..;....]w.u.....H.l..(a.p..........8y7.......=..(u.@4z...-...b

<<< skipped >>>

GET /static/marketing/main/img/hover_elements_sheet.png HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 29426

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:23 GMT

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

.PNG........IHDR.......A.....'.V.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: res://C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\SDM148\resourceDll.dll/HTML/index.html

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

Cache-Control: no-cache

Date: Fri, 01 Aug 2014 15:04:07 GMT

Connection: keep-alive

GET /my_games?gameId=595450 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 15999

Date: Fri, 01 Aug 2014 15:05:12 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........}.v.8..o.9.....H..Z.or..%..l..L.};}y(...P......>...}..$...I..%9v:VF..M.@U..Z............=..........{.....1V.._......c....Wd..l....#7v......7.1.q<.m4nnn.7k. .5....j...AD.N.....~=...r....~P.#.6..E.......n.....p.(.....x. v.......I{.!.2.5.m.....C.0.Y9.n|/....)%=....;..K....Sx;w.J^..J..G:..B'.H(...2...... ...\..~............/OW. .:.A'.e*\...j..x^pS.M.]h.....P*.E.k...y.........d.vH}.2..}..._Z......0..4..m.......KDVZM..lnmmn.n.mVH.@_p84]G....n....5w6...`...JR..,.-....7[F.......7SF}.......A.. X..k..]...bF.._...`...G.yxs.1.z}..-.....v.....{..V?.....A.. ..<..b..-.]=9=<9...l..non...nm..l....^...........%MMG.'.0)4.7M..... ..k $.o_...i.FF....g..0.i..5/.-..R....._.^...._.6.T..G.<yslr`.4.1.a.%;.....n..,..HI......L..7xi.1.7.K.......;VR..`_.......W.D..6..8...1...G...Z....u .:........!5.Q0.mx......~.=.N.A.j.m..R....F}.....@R....{..G...(a...a))_.....p\..5.....=/.X..5....1.......o...>..1..o.B...;..oG.....=h.oF....A.."k..G.~C..... j....H....k.o.).0...``...k...oO G..K..p}..9.E....,!3.....6v5b9.}76...[[k.-....5[-.2;...\..].C;t.:.....f...?.Ck|......n...(X..~....?...^.9...A..M.1.V......J.Oz.#..GQ..9..d..8 ./.Z...g.n...\.....N;..0g.!8.U.G..#....v.5.C.c...}h......].0._.......h..:.D.....-I.o........../.6.^.......<.z..~.z..*...GQo.v.......4)...\..o/....z......6....h.B.H=.z$....5..EZ........_....J.w.GQ....]......o.6[kfs.l.'|...rnC...-...K........Q.*...*..BR%.w..s4...~..R.........e".......o..ud4i..Dd../ip...e.RI.!..(U.]K.h......Q......*Q..BZ9..7.87..s.*........Z.\.2.\.yP...._........<...n.~.S........:.p..;.

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/json2.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:12 GMT

Date: Fri, 01 Aug 2014 15:05:12 GMT

Content-Length: 5435

Connection: keep-alive

...........<ks.8...j.....J.L..L.F....8u...)..\..TA$h..H-..u.............J.".4..~.......p-.|5.........G7I/..Y.?w/3n.|o..w..........T....o...c...x,.....~<.*.........[q|"..........|z$......'...Gq...?l.S.z.q..2.f..l.f.K|%.ERD.. ...0.....T._..d.Tq..._.k.yi..]/M. ...^.......{!...7.......x...;;9.p..W........X.~|....=..N.?........b.......Z|<;9..mL(.#%.T.\eB..(..H .D2.T^.S.s.w._.|.......MD.....6.M..X.4S..x.9m.....5.).Iz*..l..a../j...x#~......._d....|5H&..i*7...2C10...0.a.......|!sX8....DX$k....."....L....Tw.`..t0"p..........b..H..5kM..ei.;.l.<D).G%...........f..,`....T.$.....$Y.9|...\..b.FQ?8.6.z...!0L....J.^..i8..p).b9.~.....zf.B.;... L6.s.@.%.E?.H].....\...[...g.;.,..x..^9...i1a.{.X...#.^......7..D.%L.../<.J.G"z.&K|...../..W..E..=)bX.0 4...#...U...@.<....."...H#..U....)..|m0p)..8l....n....4.Q._j..M.p#S.KS....@\...3@...u%C#.Vm[.~cMa..>*.E.#....2EWW.VK.'P.f........R...,.B.k...Z.1.a.:I7..CV.=.....W7r...H.".-..-.....q........y.oV...|]*...e(n.e....qo#..cDz.....]......Z..DJf9Y.?...s..1..X........s.3x...Uw...iW@!.....>{.....J..!|~&.]....L.......:>...o...0.....=......if:C................._....A..WM..M.2..r.!.XU.fm8K....p..........AZw.........U..4...I.x.H...3...G....7tcC.U....j{....!S..^.v....../*|...6...o...@.hM..s@ .vA4.a.>7.-S....[.....u....bi'......y..\<..V..5.QH^J....x.G.oo...;{q..&dxH....V...d0~Ai ....h.l..B...."..=..<..{?MV ....4;.......6#1.(...,K..,)e.3,.~...L1 .=.....g..b.f...F...^l.y.W...'./.....A....!.............l......_.6&D...!..kyi..^k....*.h.......d....`.P...>.........[. $.

<<< skipped >>>

GET /system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 3350

Date: Fri, 01 Aug 2014 15:05:12 GMT

Connection: keep-alive

Vary: Accept-Encoding

............io.F....?L.FDA.%.......h..0l.E.I...I.S...b........P..]`w..".=o.5.>........dCv....0..i....yY.l...<.K.g..e.~......,....!.....`..b../.X...{.qq.{.......,..Y...V....T<..s..D.....z^U<.O..<......C.sR..~...9vx..<G.......... ....?A.K.sX.|x...9qx.O..,_.'..T...`.C..V. ..4.(/...) 2{.Ky....!<....P....N..h...Z...|.F1...R|.@..K<i;..^........JN...oyq.I...B..jPc1.Y.o....R.ky.7.........< ...4..{..D/.:x......P.P.WO...h...e..Q,5Ob.25 .xT.7".....Y.O.1.U.1B.ES.............N.K....4.AG.C.........?.6..._...^S..5Kx....../...Z....4W%....).S.j.<.'.e.E..E....b....%F.g.~9......g.....,|....'y)!2....4em.R.[.oRNS.;..L.....m..l>}?..r...G....>.q.I.j..K...Z.63.7X/..#0...F.."...J.J.a..?qT...r..Ry}.Fb.!K.(y=. .M{`....7..q.G.....]..4.... .E.C.....P...\X.E.OQ..H....Ws}..H..E...2ghg.5Q...'}o*..H......@..(-!;.A..L..hY.....,..;..y....../`o..6.I.Oe8G.v!-.y.......Y..g..LmQ..W^^.).....8....5........YeT.y...3....I.(..Y...^.#.'~........[Bb..}....F.$,.,....e........_K..C......O..._....\.V.z.w_.PQ...N.O..z._{7\b.iK.j..9..l.C.PQ..=.d....E..O.........E....G;....2...a.....B..U...V@S..H..)8.l.G....B...^.".r....,o..D.......A...5W.......]...;?=8;~w.{.,.Z.z..P....}v..b.T4.L=...T{Cu%.f3.%.....lsS...t[#.4F....$.Z......:.iX2..L.F.^t....N..F.)u.-.k..(b.... 5GyLq.,..j..3..e.T?M..5S.l....X........q...L..{.(...@.....I....:.....ya....zXAo.Qr..l.{...%{..d{.y...A........"...nW..v.9.2....z...:.C........'.lmX....t.{.*tES......%/ja..{...e.%J.......).:....~...HBsd...Y*J.........B..=D.......IT...YU@.....3d.}.;.._y.d.,.7<....w...J..

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 33690

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:13 GMT

Date: Fri, 01 Aug 2014 15:05:13 GMT

Connection: keep-alive

Vary: Accept-Encoding

...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[..r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG...{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U..44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP......<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.lw.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. z......\...:\.%.p...AB{..@.u......9..fC.{?..d.[..dC....h...!X.V.w.[Q.....:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....iAJZ.{...?.f.......@.JG.}0.........^......&..5.....`.F.Y....<...........@..@..-....1.Dg..`......V....78M.X yM.b.x(u....Q..f.l...f....E....3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D...S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....<...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....tUD..V.h2..........].Y4.N5........7j.}...3. .@gN0I8n.M..}n4Pz..5.....h>...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 436

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:13 GMT

Date: Fri, 01 Aug 2014 15:05:13 GMT

Connection: keep-alive

Vary: Accept-Encoding

..........uSMo.0.=;R...r...M.=m6..............d...6....].Q9......<.Q.U..`s..^q.NU.....,..Eg34..0<..5l[.t...f/......~..&..Gm.aA...s.-.D..B%..gO.wc..\...)..(.....m...cR"..\..c...`.,G..a,.C.*.....To ."..I....s..0.....K......n..!.q0\....8;./..].Vd..\..niAw.~.Z....N~..b..I...b.Xm........U.....2...,.S...T..R.C"....w....X./.F.iB....F...(c1J.'l..5.N,z!.wO......M?.H.C...........%j.X...HD...\....EO......1t.& ......ML2.L#....y..Th._.>..K..........

GET /system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:13 GMT

Date: Fri, 01 Aug 2014 15:05:13 GMT

Content-Length: 4815

Connection: keep-alive

............ks.F... .............7I...9.:.N'..Y. .1E*$e......}S.,%m.........X.......5...DT..P.f......4g..d.....=.].u...i.WC6......h..*..s...~..x=.9.........q%.*.....tCv......?/.^.d......D.....=....#.?.c.H......g.],..~..H#eO.....@...N..}.ds~...f.J...b.4.L..aU.....Y...`....2.I.(~U(.Q.......M\8.k"X.~.Z.....r..$P.........G@,....w*V.....m..._.-c>..3.b .>-......*.:.....I....,IZ.e:Z...4e._..X..:..f..........p.r...W?.a.\...........O......o._]..........W/"&.M...[.H?..".E.....#....W.1N'....O.|*....e..a.Q....Y.y.`..yZsR..M.2..p..I?.....{..$....3f.X......f..g.f.P,.....J.]Q......f...X.."OB..C...b...EN.a^).e.........t..../.".4..[..o.1QF.q7..e)4.....b|.2q 2Dt..q....cg.a...z.x.fI)`......08M.[6.xU..H..U..........[."...9 .E.xOS......D8C..E..L...T.o"T`.4......../8..g".....?....j^".b..z.....L...........$....N..}...acB)....0`A.........o...Z..&......~.r.j..T...D....../........)....H".AMo........EQ.R..0Pc.1...}.q:@p0.o............-.......B.!..d`;s....p:..M.r...cJs....p..F.M.[....\....o....r........%.2QK.5.S..79xJ8z.=....{.|...g.'.Mqb..y...5...5..=mb...$.P......p....q.P.(..XV..: ...A.....>...-..u8P.(s5.Y%.~.WR.9......j6...Q...Fy.$Q._H.b_}......@.k........~.....j]~.....*0.`y.yf..1... ...zDr.p.\.FE[F....A.iRp'..)...}R.s...a..tF...'0.je.....0IK=...,.........>....>..S.5.,.......)g.,..O]..SP..($...d|!.9`.z...,..Q....JT../..a....Q)...'Z..g..Q.h..D......y.....=:...........Z...<&.A..O.3..3$l\.'g_J...p..>.\..qb.t.../xY.....f.kKi.16.u).().B..m5..a.-..4.l7..q`....F....S......`V..D.`....o..e......PC."8..R....:...HC...@.i....6

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1417

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:14 GMT

Date: Fri, 01 Aug 2014 15:05:14 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........WMo.6.....P...5#..z.e.(..m...h.KQ..E.thJ.(;.W..CR.%....:@l...7o.3.......%.O._<g.c..`/........i...r.?y...V.fy!R...i0.^_}.4.{............i..\.l>..,Y.4.6.~...\_.s&$.....=."..H.)..4.|.....T...}..,...L.nq|>D..P.E.....S....)E.z.6..._}x,U..B.......U.$...irJ.be...`....s.%U...._....MU)...';R....'I....'..A...|.....Z.....Q3........Rbk3.zxQ....U..-..b.....PW9...,XX...6....!."^.L....`.e.@..l...;z.....#..d*......q.KVU..L.3.&...9.-.|...7Ya.0.....d.3...._.NC$VE...FFEq.>m1Z..~...i.."z.....J..#h....q...$'.u.m.....i..H..1.F..tR.|9.q......*Kz`>..!...iai..U..".V..{....7e...." DQ..e.&....W..d..9..-.l.\..<..gAQ4z#...-_..Q....c....K.C..Y...k.C...y.u9.k58.T..4.C.?..........9......M.d.|..k....]..vf.....y..#O%[....b.(..1u....W..t.p...vV::...r..go....J5|C.p._..B.1T'.r.......(....! .....~@.#.~~.=n3......j8.f]].../...^Y....?....BKf.y.6..{....O.._."...6......A."./@..A... ..iz....X.....A..6....?D..cn....L..8R.ds.(.....v.U..A.....)p1Amkn..Sg..w5;.R.K\5....bQd2:!.#l..u%....R.j.. r. p.].Q.....j..|Av.8.f...gI..K..\.f...g".p.'.@.........)..pj...n.N.%.s..-.5plEw5'o...{Z.o..{.S.};...v...gw....nO...\....j.{Z..g2E..........l...w7..*V....*. .J.1.@..%M.f.\.....P.=?;*........03.U7.C5.9.>m.......ye1...l...8x".#..Y{.W.:.'.Q.....G."..f.w..X.).i.E.35Z~ZL...].....NtI..%..{..kN..M.{.Z........N..ba..$D...,...n.#J...1..ih'.z..u...=p.L}.4..2Ms....fxr.!M.:1.H6...a...o....tC..Y.....y....p..E.^..p.Q..#(...]...Mk..Y..[Y.....'}..8....Y#Q.......

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 2559

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:14 GMT

Date: Fri, 01 Aug 2014 15:05:14 GMT

Connection: keep-alive

Vary: Accept-Encoding

............iO.H.s.......I.KJ.:.az....h:...j5.Q.......6...{..WH`....\.....go|...[^.|e...v.........ly....o..?n...>|a........_..~....n...?.X\2_...07..A..*..`.p.U!..B.FS....&....*Vb.r.pSQ...,.by!.".J...$.............._w.\..J...^x...t...v.hf.*..........D......RL.........@....UU..J......@.5.....:...5.d..6........@ Y.'..@]7I....,..;.3.Y..B.]3 .*..X.Y kE.....A..} ......"...gb..6b....N.L.n f.v.9..m.D..#.efT..Y.):?v"."..L..ZM./...d.s.$[......I.......[.l.*.c...B|.yqt...7..Z9p.{.9.........w...".....d~4R..f.q.yR".h........Cf./.6Q.D...`..0N.......dC,..........M....fq.V...G..o....'.f.a.FjQ...1.f...Hf.;.e.?..."\.qPE.Q.x...<X.}jk9g(..fl....D...b..U..X...7.....D...<...F....=...J!..... >&..L#...5g.`$.,..T..@/.h......b.e....[.....Y...9}.9. .K4..[.wC.T...!.?i.'T....</.j..y.W.@.5.(|ZN....7...WQ..f........;9....YZ.GfT.y.DNS....y.`M.6. ..$#U...:C.....gJ......)..D8..r#....O.[,.T.Ue.....r.i.M..R..J.;K[...W.P.R..#.I%..Eq...1....oa..13\....].T........sVG}.iu..&.r.j.9.......".{;.7...)...~......Q.U%....U...i.h.}..{...%.9Z.xz.y.B..Z.......N..'....Tc:..H.o...Kk.M..&..=.I..fjO............H[.94.F1...qh?M.....&g=pE..B.=..U.E.(}d... ...u..^...k.v....6/..c.5.....L.......["....j^??...s.....1...*/#3...H.,|..v.bJ.."..dCD7.....'.y.xn.0.J..aq....E .~29a........w...{CK."\...\..o.?]WU...k%.j...n...7?.y....w/|...c.... ".\.j.28z....Oe...Gn..<.'F.=X... .q......8...K.....`....b...X...q.b..b.?..#....}P^(.......a.6Nh.. .....ALQ...j}..)..m@.....^.........1..".%.p.....[....0..h....]1.....B/.;..A....f....f.0..L.>..$......8_.h..SJ.P....=...v.

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1037

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:14 GMT

Date: Fri, 01 Aug 2014 15:05:14 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........V]o.H.}&R....V.S.J}"...S..8X...jeQ<v......Z........6i..JE6.s..9...#v1C~.24@....f.._P$.}J.F..3.>^.....K..)%...........;.@.O.\O|4....Q$..>...6..cZ?.qB.[LVx5..8....Yr7,....C..,C...w......P.q0..i.......<..@.H.L.....a.RB.S.8..$.....pr.A.6N..$1..F,z..E.p..\r.0%....... .=..`..Z,...N...(..L....F.s&7..E..0...X6%....X.........X..<...K ).^.^.|..4w.6BY.|.U\..%Q..^...0F....[DV.........%....6W..S..m:..<3r.un..*..=.d..... .CX.X..so^D....^.c.\..4_.y...U..:h...._.....*.u{i..N....V.G...v....../..Fm...QE..L.Q......)....f.ej.p3e...zU.j\..T.jtE..$.|...!#..x..:s....ld1.T..&q.......=~S...........B....U..h.l.d...%...Qx.vy...q7/XJ6.zo....d....9%j^....%[.T....A..-v....=@..T........z3@..2...F.X.$(\U-R...p..'..J|...zZ......n"jK..i..l.u.IZ...R./.;.Uh.X...$&..(.......2....b......"......8...V.C.l.0i>..aY...a~.LSr.......~U.. .gR3d.k....w.......a.S]..y...$...X.F..s._....G.J.N...y....5.#.6.H;'E.i.....=.p[ .\.,.5..j.....W..........I........l.V.......w..?.&.....}.@.....c...J!.S=q.=......|h.j......>...^..........i....]......?.k~. ..J..K...../H........

GET /system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 2522

Date: Fri, 01 Aug 2014 15:05:15 GMT

Connection: keep-alive

Vary: Accept-Encoding

............ks.H.3....s{F.....-..E..K..> w.uu...`k#$V..}6....!......GH.=.=....o....V@.~.....9....y&.."........z...>.?....%.C......~..c.7....z...S......}:E.)ZK.Z.9.S....Cl....|o..)...g.........].*F.v.D...:C...............m..o4.....R..l.1.F...3...'...._.&....[..v...(.D...hL..A.........:.../......3#....t:.[..yy!.......$..2.$st.{...G@.S...3.}p..>..G.....b"F.TF....I-..^D..X.T...ZR...X.\r.C...;3...'.."CF...0....I......%...kfF...U.V..%E..............CM{..PC.zx.........j..<!..Sep....A..._...........F....rC*UC.....D.I...x....b.. N.6.\.,...}.*6F..........#u!CU3...p..|o...."%...G..........R....G....`.=..yt!E...X.3W"T..t...0..y.p...M.U7...l#).k..^6-...Rb.A...O.....F..h ..2. ..&R....[.~.r.YP..T...Gs.(~.i..;%!M...H.L;.b.Swl.|..*..@..K.)V.M.X"l....4...0y....N...1zri..ej.Z....K9mX._K.?.........h .E....3IX.UUj.~.....l......o=......i.....z=.2_@#K..*].*X..G.# ...N".U.'..:......C-h0.....B=.YM...d%K.g.7.9E..p..J.R&......-...Z.._..Y.6.J.t...0%...Y;..........2#.P..`.r.3...|s.y.G %r...R......>..f>..0.y.._.yi..<....<.9..ex..9.*.N"u..ae.>...!.....|.#..0.U......S..V...Q....c...."..0.a....b%....f/.....i..r5.$..>...........V.R{.`.....s../.z..<.'il.....Q.\%.z....|.ueB.....Q3Q_<.......g.eU*g.'....0.o.I..cLS.J.(.......}LP..Fw..v.w0u\...i....a....Z...5...*.9G`.L]j....LGK.[...|...N....{a...W.K..K.!M..".b.f..`c....wn.,%.^...<F...1......h.8...........j*.....T......6k....O.h..V.EG....U.-5%...vK>..y........a..$.g..Bi.....R.s.[.5...Q.....:}a>p#|.f<..&EQp..H[..`..\.M...Y.........h..Q.%~....l.oW..0q5...w

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:15 GMT

Date: Fri, 01 Aug 2014 15:05:15 GMT

Content-Length: 1228

Connection: keep-alive

...........W[o.6.~v...Sa@.F.....WOi..X..)......e3.I....E...o.-_.....X".......y...P.....*._WB|g4...5YR....8=.=.i.........C.....gU..^,.U..!V....!....B.z.(.%.zPX....g..... &..?I...1|.../......./..~..m......'.U.,>"?V6.^..j...... ......VD..a..Ud...z....bDOAT....Fy.....=`....c..I.5...........A...3=...I.k............,h...}..qK.&.....'a...=....qs...1D.)F.c=g.....cl.b.....X#...q...1'.....e..V.............0.....Q..q.X.TR....B......M..>&._E..........,.h.<.....p..z...H...R]...8..o..*...8.:.,r.[..j....`xK8..@.... .8.....kl@.IF..bKu:...U..Bc.X.4MV...ox9..VNcY.L..]q.oM.......v......F.z......t.....t...}....mLl.*...._g..7..{\.4U..n.2-..;.=CF.... .....N..O.~.*.D.....F..'....V./_..W.Ss{..J,Of.Z:..D.m.j...%R%Y..\..KI6.g.j.........(..G.u..Ri2..L P Z..a.3..}.......t..k.4~..*..U8..........Lt..83....z.....O|/5M.....M.,./..m..v...fq...]Y3.J.$.g0.h...C[u8.?.M}....f..T."6.M.3.77m6..X...Lc.Jc.....5.WD...d.........F.V..6.?p.......C.......S)..}.3..../6..Z`P....\.Q.....-..n(A.....h4......em.Gj)...snr}..i.D_...._.N.m.[.........v...3p.`..}6..@...b..}F....~..\E....}..n...V....".B[@<9I.$..... ....-.*!m ...L.Xj....30.|..'.....'N..fN....6IW.....x..p@.I..{x..v...^..`/..E.\.Z7j...[wj..:8m,.{.@4).'.........r'j......u. ..o...<.UFS.|...y`S..b<`v........

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:15 GMT

Date: Fri, 01 Aug 2014 15:05:15 GMT

Content-Length: 3944

Connection: keep-alive

.............w.8..........I.nw...%i..[..I.6.{O.......4%..oF.?!..]...h4..{....t......w....<h.N.d.i.....$.'>7.p.....8.........F.}.b.6....F2....U.... .9..je.s.....f.M..D..3/.U.s>...'...,j...."p./.4}../)...^.]bD.H4b\Rr9....[.. ..Sb.Y...Y.../J.|.G`.G..n.!..%.'......<:.b.. l.D..wq...LY0.... /p..qC..Y.x........$.. :f~...t0..!.....q.....83N.......xm.h.-.....1...y8n........<.;ww..fs.\|rw.&...W1..M...L.lJ.s...x..3... ....5..an..d.F.....>j...f..D..Ni.... ..9%.b$0.....[/).Gs.. .....8..p.....D.nk.nK.6.S?..'...y.Ot.#.i....^...M.`...C..h....7../.f....e.......H_..2.ty.D..e......)(.......Y.......0y.F>w?........ZR!..5.U.p.../[....tu......T..<....i....,.d......-.]L.(.\t0.....v...f..).m!....^.Vg/M9\q]H..<.._rK. .O_'...~..|.. h.......s..<..".9..GK.. "".F.....<...$.i.......I:(.....5...M.....4...L......'.(X..v.3............X..J.q.....4...-.=.z.g...kI&......H...........s.'......P\.mw.......eox..c.@...k:.`..^....\.l...yq.....m.5...w....B..K..B......f...V....9SAA.jT...Ua....X4..96.....].D*....$..k.J.m.m.< .|..../.(.}..|..]....1O......Cm_.LGQ...x.q...w...n..W..%...Y....cm...u....mwG.......A......].T#............cv..Y........|...2qK.~6}.L.i.".. ..u.C.k.Z.....".........`B.......Z%...P..l..M0H..@.;......f.}B.e..4<....D-..@..!d.$2_.h6...J......HA0..S...6..q...d.}S...-.....UY.....e&h.q.D.h......4. ........l_...P....~9....=G........3... ,db..a..M.~.h...M... '.2.y..y.T.d9....5.E'/`... .....!..'...m8`....].:9....s.*........Xe\......j.%p.w...:`ub{.d.J.$!.."..c...PD........V.m.[(d.:#.T...k....g#dM.g...,..1...

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:16 GMT

Date: Fri, 01 Aug 2014 15:05:16 GMT

Content-Length: 580

Connection: keep-alive

...........U.n.0..i.....(@..t.:....h..]..`....&....H..%E..m..:..{.xw.....Z...........#m:].4.....\.....g._J:...y..]..7`...I.eG.....4.? #`e....|..Y..<..V...p.b....R.r....k....;6......eW...O..`yNC..........0#..._.9.....]../W......y(.2.., v.:X....ggt.p.@..Q....C?.V.@,..&.t;.u.eT3...|..;.....v.F....DQ"..D..u..}\.ew.".-`g.XU.a.i.3.......{..s...:..N...`..h..4R...?..s....Nav..i..,x@R.i.JM8.....DR...K7..I.Ff......r.Zc.......K.Sk....7..sE.|o.y..i...,......J.{_....;...va.....K..t.|.W....t.A.|u./l. /....:...g.TT......E).be.;....... u.....S.....'P5..JE'......u..pq.7..c...N>......rp[o.......

GET /system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:16 GMT

Date: Fri, 01 Aug 2014 15:05:16 GMT

Content-Length: 1394

Connection: keep-alive

...........Vmo.H..L...9..v.Lr.OP...E.W.%..S.E.{...uw.&.........^....y..y..i.y...o@?.,.0IR..~]&..H.9.2...1...p.k.0.S...3.O.-IS.,.*.U..#...f.;.lA.L....../..-.d.~.i..........%O..'........2M..{F...<.Q.{....;...G..?.t6:}8.....p.k..=%.>..{....h.xb....).:....fp.......?..=..]...=.O...X>n...cvs..Q%.L6U......g..x..?.^...%..-R....,.1!3..e.X..gB..2.....*{..J.J............2...!eS_..........CL...}.QC....u....z.o]$.-.$.hX.D....?.>.o.G....Z..|x}3~.p}.76....[."9qm.n.z...................-..J....I..ZY.,......7e.|....M.q..........@.0._..(,.!(..,............JUY."O..7..F:a........;...4...~.....'.....%.Du..K..$.....o....b..ZiT.9n9.J.o$]..;....U(.....,...z.~.G.~....%...*...h..|j.T...d7&v..W`.m...v6....w.....PC^..l.b.;.........BG..h6..)Q...A.8I.t..s...e.#7...f.....|J$1.(cI....mW..7lW........N.r.g4.......]Q..!.-Z......[:.kjKP.m..t...[...MA..b.l5*.}..f,.k...~.E(K...b.....E........u....?Pn.B2'/...H..^.-%........1...v..W9.4..eyS/.W.U.W.#.....]Bi.t.*...z.....%9.c.-..$....._..O[..^.........b."|d.......%.<'.O..G#$Rr...'x.u.9..V.......N..C.DcSG.N....z.[.......u..bs.\Y[..)DB...8Ab' ..e,.^)%yN.x...@.[..h8..^`X.m......VD3.=..7........9.$X..p..&|..:.[...@_....v...mAq.... .....o...\D_....9.-MG.......Zv...e..2:..?.YZ.._&.....Q.}g.w...$...t.K..E'*......=(.Xo./6.&....'j....n.T.....G....,5t.i.%.~!.....|...%YR....x.....>..F.....!U....jt...^S.,].bzx...q.......QL..]......u./Z P..k.....\Pw.9..V....2.......J......W.......

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 4875

Date: Fri, 01 Aug 2014 15:05:16 GMT

Connection: keep-alive

Vary: Accept-Encoding

...........<ms....u3.../9Q'...K..-w..I=u.._.v.WC...'......>..... E.oj.>...E`.............KIp.{.....................qr..\.Q..a<..........g...#..W{1....m...........j.n..%.O....}:...;..CQ=dT..... ..3...."9..".Y..v... |f_.q.\.....Is.eS........L[...x#...N....98.....Z.q...2PJ.Wvk.{o....................G......dK..a.2....&..i......F.I.;...~.1....c..d.}.7..{t.;.t.(;.g4Y0s:d...#.zA.{.h...i.I.q-:.. .J]...'.yD..(..fns.....v.%.b..Y.h.../..J.7.~...eu.....<.......e..`.m.%Xb.pLl9.....3.r/.,.E.j...2.4..........{...M....K.)p..,b3..%..-.Gr.L.Z....:.m..%@...QcSJ.i.2.......qkh...Q...rm......^!T......b...4.{0....W/."..=....E.)k.NR......4.....#:Z.1P.......I....._..%.4x.&...;.&)... a.8.&.....0IC......=B......L&....<....x..NA...|..]..T.,.s......3.h.q..<nX..Q?....2....O.....!....7p.0.].=6u.Q..j<....V.;M.i...4bir.ms@~%.!V.j.&Wu.....CT..:....7...n....R.H...m.z&.]........].u.D.....>$.p;K\...?...S...:.......o..~.....*c..K..jR.W..[q.U..T-{!N......h.Q.>zi..-..................."..=......nhH.3i`B..&...>rk`.....X...=M..'....2.i........|V[..&.s..4Tp#.mn...7...1NGo.&.k....D.....$.....S..R.L...?..^G.<..l......))..%./X.U# f..}8:.X...6..F0.D........h..)W......E..z.7..%...i..S.0.#..P.4..%......(......@z..OF....5.92...C....MbzI..d.......{.....&V.c)9Qk9f..2.._"cd.e.Y$..J.7(a...0..W.vddD......7.H.E.. #:.f$..q..<hM@.........ol..5..X... !..\z...i..Hk.AoJ.3.-.b3j..c...kuie<l'.. ..#^..d...~.........^.....v..P{i..~...._c.my1p.....6D.....X.....AY.i9.....N....g.2}Rw...E!Zw.A.ZaLmV.m..#...MO-....N @.ME-.x.~D.T../..,.s...

<<< skipped >>>

GET /static/marketing/main/css/main.css?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:16 GMT

Date: Fri, 01 Aug 2014 15:05:16 GMT

Content-Length: 2803

Connection: keep-alive

...........Zmo.6.....b."M..._...z..mw..n...h..@[...,........_%R")....a...p...P|.7Y..`..?.h...DEoQ..7.[.o.7h.>.z.,.%..5B..{.>.<D1...,..J......).S...(p!i..OG|<...z...Wp ...>..{.L.._.../..x..x7.g...~.....G.m........3......S.....?}..3....6.PZ...4._..-....wB..7....m.(.P...1..Cg..{p{J.K..o...,u.2."11i../.W.m.........'.W.r..........n|%.....n..x.......%~D.NbH..hm..@...P...&.[.. ..t...)..8..9}..&X.....\.a...a...{47.0`....).D_.7.@..j1..)...y=......Gpw.o....@._...`..Dp.?..Ml.2.Q.3.\g...U.l...Xl...#..i..3p:...'..P....}...&^:Y.x...o....<.&..7p.8...z}2....e......E.2..Y...zo....i2[....tF. .k7.I.....t......".a.=.......HHr..4|.\R6i..|V.1.@@.z.]...%.".!hy.....9.....q.L.G.j.15...LT{...p2..24.QDt..j..B.>..0..(..7[...<.....H\.`.U.@...Qe.....t.p...'.y.......a.^..#&&A...D....E.Cf$...T.r.r.#......l$Y..6..1...G[9...Mo.#...?30O.5..Y.._.#..{9ikVBU......9. ..E..1..o....`N.H.x.Q........-.&..Gm.....z.$.X...H..4.w...jP..75..z.K.;.k}..F....G.......-K.x#..(.`..H...M.b..UN.A....B..8e.5%.r ....W..../}............n..Ix.......*l..6......!I.Iz..*.`.2.&..'..$..Y<h-Kj.i.....,R.....;=..J=6..1xvw.......^.\8'.{[...iF....K.........&n..9L.........NU.d0.|...t..SU....2Ud...4.I...n..[./.......=PZ[c..a.>.0.P^cI.a..k....VCb...A.~.#{.@.... ..\.4....d.....(..Q..kena.c...h{.2R.PV..I........&...<H=Gqu(jA...(.:....u..u|7.l... V.Gm..|i3..S.J*.F,....i.=.6n..j.\m1..R"A ........1...u....X...........@.p.O....pt$...Q.....y.X....'.(1.N....%..........h....5uKk......Ph.7..XGBN.<v.<.<..D&.9?I...>.......}.kT<.k&l.m..c.@U[..',...

<<< skipped >>>

GET /system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 336

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Connection: keep-alive

Vary: Accept-Encoding

..........}P.n.0.<..?X..(......AN.I,.odo ...k'.....}xfvfm..?.g..u.\../........f..>lYx.XSc...!?j......V......:.U..E.I..2.h:.}..H..Hbm....pm..C....V...Z...{.u`$..L..Y..;kE........tU.H_.....%../2{.!...i....NI ..@.N.$r.m.8h........p.......I.3Q.4(I.h&,.3...). O..3..(.p.........X.^'^"..Ji[....NI....AO\.]YQ.......$...(..Bi...)r..1.....2.........

GET /static/marketing/main/css/sprite_sheet.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Content-Length: 2713

Connection: keep-alive

............[..6....WP.<.......=......g...&...e<=S.. .0: k.v.&...GGG../.yO;...y^^.....Z.'............omW.K....s..^.............?..n.w9.o~.....r.........G..!..$e..u.....5...z.7....2m........E............./....~M..Ls..>:(.=q.;........V.o..>.........C.H..kQ.E...R._>{. ..Jq}=....>{.....]ux._ o......g....?JW..x~~)....=Is..}.T..~.[~{zH...1.O..hy........b|...;..xj_....."..-D..=1.9..#...%.,..<~.de.G..........4B....R...F``...H.....w.9...!.Q.p8k..p...w...T.6........c QqHz......5D..).T.V.p`.f.........6..|.q.y<|....e.1)rQ%.6r.Yi..R...d...`....e.....q.V.dm..().[{{..q..a..z...W........!p.%4...<1.]...@.{..x.....fm.b.R...W....\/.O...Qi..;>..Z../....$...`....p$X......O..d.m.Y...2B......%hp.44Ty...J...o.h..I......Z..TgRGk.?Q..]..V@.6...../.....8...LTh...K.tH.w...d..........v.]Ov.4.#..T..$.J.c....mH...........X/|..[.Cpk.[s.m.'.25.<6P..."...S....!.....H3.Cpe,.z..-x{s....W.@.p..P.@....f.........E....J._T..qC.......&...z`D13.1...H......Ka.J..n.*....(..-y..b.j.l.8........H..W>.]3....#..D..>.n.......b.3 .t...g......M..5l..........S...4..x....|C.?@&.......~...3%.Dm6...0.2}*u.X.o.Z.0.$..l........,P...K .... . ...,.o9/......q...N..hItdo ...'.....<....0.....2...J..$6..y.O.LW..V...3h[..PH..%...B...,..|F{...........-..;.GT.$6..!e.......lQ.....7.. zO..b3..c?X*0.....=...t...4.qB.Y0W..."'..Y.......# .G....L........*5.(^.`.].......I......J.x.D.A..=,L.Vsu..../j3...~..OP..&T. ...)K.Xl.W.,6U.....w...O. D..s.............A.N..C......Cp/.f.ox......j..V.d.>....EcW..r5...K....|.....*.A..*..F6....L.cr.]...i..

<<< skipped >>>

GET /static/marketing/main/css/tinybox.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Content-Length: 459

Connection: keep-alive

...........SMo.0.=._a)..{....@...a.!V...f.v..}mCRh....,y><3..sb ...h...V.*......c.a....).....2&T["..#"/...o.P..%*0..EQb.R\....]..6q.oq..q.k..`\-....Wga.D.{....V..X..M..A..I.,....\.eI ...A.y..E.~..V..;,..`h[.z}..q.C4.v....\7...I0....Qs.2....M.K.....E{..U..".=...B.......Z.....m....:M..h....g...m@....,....k.a..x....o@.'~..-.mlN.9....qg[7Y........0....X....M[x1.c........2K.,..*.4..:..K4..A....P...O..8%.....*'$.FV.~...F21X.._.....".4... g..6..[.q.y....9.T.k.......

GET /static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 36195

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:17 GMT

Date: Fri, 01 Aug 2014 15:05:17 GMT

Connection: keep-alive

Vary: Accept-Encoding

.............|T........L&3.I&.3.I2.!.$.8`.......1.J.1".H.R.,e)".......""......M...Z...K..H.RK...kY..d..y......b........s..{..s...s...?.=Za.F)La*.?Ua......~....-...........'. ..Y...9.m.^v.{....;..Vv7.,b....p&.M..o...g>....l(..m8.._................|.L..J.......n..6)..>.........]... ......o.......g.Vm..a_.-\]..?..._.............c..y.Gw}.!_.u...=.g..;..g^fW.y|....}.....y'ck.co...%....Y...3............1eh.........\..w.^6g.C.y.................=..j<_y....yPu.c.2b...=p....~;......w>8..C...!...3.....u..y....).......bo..O.eG.O-I....8H.z.3..X......2....=.W.s86...'...1L...9.......t.%..z..r...z....I.......}{&S\.......].V.).T...-....&.Ec...8....).>.?..7..'XZ-.._,....6.mN...o...C......n...?......g.d.b ...G9..2.2:2...f<..D.&.DGG........2..]....omJn.x_r.....7.o25.........'..o......oMn....|.......M.\.o\....KPH..'.1 ....`P.8.....F&.....,....N...O.d7.<v. bSq..L....W...*..X......I..x.l...O..g.._...x...9.......3?..q.OZ.X.p.E...:d...i.~s=......a..<.V.G...Oq.0..$V"&....D....*.G.`P....'X5.G.:..)...Kl`........oIla_...~...q...66......i.]l:....*...a.@.:......a.@.j......$x.<.6.M`...,....;.........^.... .w.AX.p....^..@7........._"|..kx...HTTP/1.1 200 OK..Server: Apache..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Type: text/html;charset=UTF-8..Content-Encoding: gzip..Content-Length: 36195..Cache-Control: max-age=86400..Expires: Sat, 02 Aug 2014 15:05:17 GMT..Date: Fri, 01 Aug 2014 15:05:17 GMT..Connection: keep-alive..Vary: Accept-Encoding...............|T........L&3.I&.3.I2.!.$.8`.......1.J

<<< skipped >>>

GET /static/marketing/header/js/header.js HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:19 GMT

Date: Fri, 01 Aug 2014 15:05:19 GMT

Content-Length: 1812

Connection: keep-alive

...........Xms.F......x".`.~I:.r..:....L...0B...I.H'....w.N...1i....t..... .Cc..4..0..:..c...`<4..J.rhh...4..g....oi\$.V*@%<........x..x........^[.[gM....:...Ub^.OI.9.c... .... X..G<J#.N<~gH....Ibh>...N...MrD...wl*<.l......[8=6.F~..d?y...d..L.`.*....v,......h.G..<>._.Zgo.S.N...uy,]y..!..YH5......i:'.g..8!.!.g=.....W...ub......Q.......&.#D.&)D...(...".q..}....:!..>...:1...Xb.e>Zs*z>..........J>.\.....<....J,(..`I..T...Yn.?. .(.hW.er..@...V.".-.>.tL.S..D.-........%QJ.4wQ..2.I.S)..4.4.E5S...T.J.7..........v?...!...........6...~...8......r..%.x.*...Yn.P....b..P...bg..".M.K L....1.i.;qJ%-..Z:.9.......g.....;.........2O)...2q_mL...}.........4In...."..en....F....P.T.Zg.i..b..D...b....&.....(O.Q.)...g..:....B.tnRB7....M....:.l..5..fC..Y.bEJ...XL.V..0...<.%d.....6.}..]>....r...>....\..*sNo...I .a.`D......"..,..4..H(W...P.&.Z..dYC;.5GK..bU..ac...:.P..4..2)...X@$s.l..r. y..d..6Y{<}C.......sb.U........(E.C.........a.. ......T..j.Q...$B(0"8..F.G.*.|&.....'....[.}8.(i-F_......(r[>.....OPU. *..veg.N.OF.(..?.=t..F.A....d..wP....y.a!U.tE.[..a6.........A.S...T....YY..;...1.Vw.Uih...l.^T..&6Ys`....$.K....N..z.^.....ON@..>.#E.~.....G..]..xK'..$?0e.b....5....h,.Z.a.pT....GJK....6.d...M2.11P...m......x...R....`_.Y..s....\...<9r....G.UP...t..J.....fY...D5w.~Bs.].p..\n..v.3.....rQW...K..h.....!.e{..k......g.7..._j5T^.p.....7.9.k@.5... .a..W.......Y..i,..p............Lb..=!..F..,(.8...1.)..y.:.4u.S-.>.| .I`}..zc..DNxY ..P......h.QKX..R..|'Yl..R?....S.h... 3c..g.|...g...j

<<< skipped >>>

GET /static/marketing/header/img/ui_elements.png HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 26274

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

.PNG........IHDR..............."T....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /static/marketing/header/img/icons.png HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 34162

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

.PNG........IHDR.......l......d.\....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F249C00A9951E111A7D697F015223A85" xmpMM:DocumentID="xmp.did:23E2C840532E11E197DDFBD349484D06" xmpMM:InstanceID="xmp.iid:23E2C83F532E11E197DDFBD349484D06" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B36963060153E111A7D697F015223A85" stRef:documentID="xmp.did:F249C00A9951E111A7D697F015223A85"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>p.......IDATx..].`....{wi.v..4. .......T.(]DQ..JS:XA)J.."E.). .B.-... .....K..7.../.$(........y.fg........i ./(B,...........$ ............K..........B,...........$ ............K..........B,...........$ ............K..........B,...........$ .............K.........B,...........$ .............K.........B,...........$ .............K.........B,...........$ .............K.........B,...........$ ............K.........B,...........$ ............K........

<<< skipped >>>

GET /static/marketing/main/img/containers/green_left_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1219

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:20 GMT

Date: Fri, 01 Aug 2014 15:05:20 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8570556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F87F856F556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................W........................................................A...4t....................q2.............?..<.....P.......[.........

GET /static/marketing/main/img/containers/green_right_rib.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 1232

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:21 GMT

Date: Fri, 01 Aug 2014 15:05:21 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F85E1ABB556311E18B85DF7AB3A24927" xmpMM:InstanceID="xmp.iid:F85E1ABA556311E18B85DF7AB3A24927" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:documentID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................................^..........................................................q..3....6...................1..2B.............?...%D @......U.0...#\...........

GET /static/marketing/footer/css/footer.css HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:21 GMT

Date: Fri, 01 Aug 2014 15:05:21 GMT

Content-Length: 403

Connection: keep-alive

..........}R.N.0..=...1.D.....0KG/P..M.........C.@..q..IV!:..dq..5....K.h@..c.unz......x......b]...W.D8...C.k......K..UwY....2.....^M}O,......?Z.[.$j..I......FG....R....C.>C.........wa.._.oQ...w..rl....t.1W-.P..g..r.....:..l..F.......#1i...8'[..<.......\.B.n6..*.V.vi ?.....,=. ..X'}0 N..z.\q...].~I}0.. ..!,.]*.D..H5.....Q.....o...E...m.d...VI}...p..XC..b...`....q.c#.....a..l..&.j.SX..U......7...6........

GET /static/marketing/main/img/containers/labels.jpg HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

HTTP/1.1 200 OK

Server: Apache

Content-Length: 3454

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 02 Aug 2014 15:05:22 GMT

Date: Fri, 01 Aug 2014 15:05:22 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:FABB056B558811E1B193BFB3C877D24E" xmpMM:DocumentID="xmp.did:FABB056C558811E1B193BFB3C877D24E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FABB0569558811E1B193BFB3C877D24E" stRef:documentID="xmp.did:FABB056A558811E1B193BFB3C877D24E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................c.0.............................................................................................!Q..1AaR.q.."2.#3C....u....Bb.S.t..5e67.........................!1AQ..a.q.."2Rb......Br.#CSs..$....34t%5...cT..............?...c..cA4.A..S....7.t.....F...#....L.0..ECF...v.`..Z....7.*...P...T?.^`..v}e.8.!...k..v..;.5..q....C.J_OW../r..1.Jk...m.I.............j.Zq....W..&.!...[ ....D....yvB^p..s. .....G.1h.v........}......2.{..n..N...K....$.a^.....J..C...;#.-..B5.....a..j

<<< skipped >>>

POST /action/JSONService HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://partners.freeridegames.com/my_games?gameId=595450

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.freeridegames.com

Content-Length: 103

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-641406905440442383; 143_FIRST_BROWSER=Default-MSIE 7.0

{"service":"geoService","action":"searchGeo","domainObj":{"site":"frg_partners","lang":"en"},"data":""}

HTTP/1.1 200 OK

Server: Apache

Content-Length: 59

Content-Type: text/plain;charset=UTF-8

Date: Fri, 01 Aug 2014 15:05:23 GMT

Connection: keep-alive

{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}HTTP/1.1 200 OK..Server: Apache..Content-Length: 59..Content-Type: text/plain;charset=UTF-8..Date: Fri, 01 Aug 2014 15:05:23 GMT..Connection: keep-alive..{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}..

GET /freeride_marketing/SDM/SDM_standard/css/SDM_PROGRESS.css HTTP/1.1

Accept: */*

Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=The Secret of Margrave Manor&GameId=595450

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT

Content-Type: text/css

Accept-Ranges: bytes

X-Varnish: 1111625333 1111321627

Content-Encoding: gzip

Content-Length: 346

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Connection: keep-alive

Vary: Accept-Encoding

.............n.0.E. ..HYS..I:..j.].?`.......W../...Q[../...... ~..w.u.^wJ..s,Y/L6h...I....u2.q<..s9m..F.Q..z,........AM...FqG...JVC.(.HUm ^oFe.&..$ ;Q.:2.$..S.7..R.bpo.&..P.4.'Y.....U*i.....W.d....j...F.?...B..a..i....1 .q.Ad...o.V....!&X^^7.}.-.....v...=5...r....&."|.#3]....Nt....$.Q......e.....vC.m;.]v..U4......8Y._............c....../C......HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:23 GMT..Content-Type: text/css..Accept-Ranges: bytes..X-Varnish: 1111625333 1111321627..Content-Encoding: gzip..Content-Length: 346..Cache-Control: private, max-age=259200..Expires: Mon, 04 Aug 2014 15:04:03 GMT..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive..Vary: Accept-Encoding...............n.0.E. ..HYS..I:..j.].?`.......W../...Q[../...... ~..w.u.^wJ..s,Y/L6h...I....u2.q<..s9m..F.Q..z,........AM...FqG...JVC.(.HUm ^oFe.&..$ ;Q.:2.$..S.7..R.bpo.&..P.4.'Y.....U*i.....W.d....j...F.?...B..a..i....1 .q.Ad...o.V....!&X^^7.}.-.....v...=5...r....&."|.#3]....Nt....$.Q......e.....vC.m;.]v..U4......8Y._............c....../C..........

GET /freeride_marketing/SDM/SDM_standard/img/header.jpg HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:24 GMT

Content-Type: image/jpeg

Content-Length: 24975

Accept-Ranges: bytes

X-Varnish: 684596343 684455615

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:03 GMT

Date: Fri, 01 Aug 2014 15:04:03 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:635F5D80FD3F11DF973A82E7643F8FE6" xmpMM:InstanceID="xmp.iid:635F5D7FFD3F11DF973A82E7643F8FE6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:94A0E3898D9311DF986DD6F6636C425C" stRef:documentID="xmp.did:94A0E38A8D9311DF986DD6F6636C425C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................d.|..............................................................................................!A.1..."...Qaq2.T.....B..#.U...Rbr.3Ss$DEV...4d..%.F.Cc..t.fvW....5u&6'7.......................!1Q..Aa...q."....2R....B.D..b...#3.r..C.S...c.$4E5............?..T...R.q..j3N).0.....mk.Vv0B .....`...v.-_(T.U{0......L.3.P.5?...j..

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT

Content-Type: image/jpeg

Content-Length: 48259

Accept-Ranges: bytes

X-Varnish: 1111680765 1109735540

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:04 GMT

Date: Fri, 01 Aug 2014 15:04:04 GMT

Connection: keep-alive

......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.................................................................................................................................................=.|..............................................................................................!a.1.A".Q.q2#.t....B.F.....Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q...?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.

<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT

Content-Type: image/gif

Content-Length: 79037

Accept-Ranges: bytes

X-Varnish: 1111680936 1111349232

Cache-Control: private, max-age=259200

Expires: Mon, 04 Aug 2014 15:04:05 GMT

Date: Fri, 01 Aug 2014 15:04:05 GMT

Connection: keep-alive

GIF89a|.=.................u..f...^.v..i.Q..3..Ku..W....o...........Vho/g...S.n.e.-f..h..F......R{......&...j.W.....0...R......W........d...(............H........F....F..............9UgQ..3.....u..3u.......%...-^....s....U..5..G........x...]...3.....4.......mOk........"..x.."...x...,p...B....*V./JY....d........J........6.$...Y.l........L...vS......G...........0...3..I...... .w.....Y....r)W...S..3...Y.I.........{.................!'w...T.>dye.....u............2.j"$`r....x.....)R.....X.g..G...U.....G.7..X...k..I.g........E......Z.......:}.K.................t...4=...R...~|wR=x.........ok............................................................................................................................................................~........ .c1J......................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:370D4B19B36411DF92A0A43CC032876F" xmpMM:InstanceID="xmp.iid:370D4B18B36411DF92A0A43CC032876F" xmp:CreatorTool="Adobe Pho

<<< skipped >>>

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=0-2429261

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 206 Partial Content

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Content-Type: application/x-msdownload

Accept-Ranges: bytes

X-Varnish: 494852606 494804948

Expires: Fri, 01 Aug 2014 15:04:02 GMT

Pragma: no-cache

Date: Fri, 01 Aug 2014 15:04:02 GMT

Content-Range: bytes 0-2429261/12146312

Content-Length: 2429262

Connection: keep-alive

Cache-Control: Private,max-age=0

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... ... ... .......5...O...(.......4...O...i......./... .......&...*.......!...Rich ...........PE..L...>.J=.................0...0...............@....@.........................................................................hI..........(...........8C..P............................................................@...............................text...6$.......0.................. ..`.rdata.......@... ...@..............@..@.data...dn...`...@...`..............@....rsrc...(...........................@..@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /meter/VVV.freeridegames.com/13.gif HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.scanalert.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Expires: Fri, 01 Aug 2014 15:15:00 GMT

Content-Encoding: gzip

Content-Type: image/gif; charset=UTF-8

Content-Length: 57

Vary: Accept-Encoding

Date: Fri, 01 Aug 2014 15:04:03 GMT

Connection: keep-alive

..........s.t..Ldd`dh``8s......O.F ..."@2.LL.......G. ...HTTP/1.1 200 OK..Server: Apache..Expires: Fri, 01 Aug 2014 15:15:00 GMT..Content-Encoding: gzip..Content-Type: image/gif; charset=UTF-8..Content-Length: 57..Vary: Accept-Encoding..Date: Fri, 01 Aug 2014 15:04:03 GMT..Connection: keep-alive............s.t..Ldd`dh``8s......O.F ..."@2.LL.......G. .....

GET /pki/crl/products/MicrosoftRootAuthority.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.microsoft.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 22 Jun 2014 05:05:27 GMT

Accept-Ranges: bytes

ETag: "ec45e394d78dcf1:0"

Server: Microsoft-IIS/8.0

VTag: 279122442000000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 603

Cache-Control: max-age=900

Date: Fri, 01 Aug 2014 15:05:27 GMT

Connection: keep-alive

0..W0..?...0...*.H........0p1 0)..U..."Copyright (c) 1997 Microsoft Corp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority..140621173809Z..140920055809Z0:0...:..../...V..091210010336Z0........$... ..020225080156Z._0]0...U.#..0...J\u".F....9.N...`...0... .....7.......0...U......$0... .....7......140919174809Z0...*.H.............S.>l.._....)j.k%..vm.'Y.....Q......p,..X.#..6......8...............xT..>.E..H.#......U...'.../....p....(5.....,..F:.......~.....M.."......I"....;0.]..,.OI}.....f.2~.].,u...hp.W,.'wj..%<......Y.N.. ..u',.. ..v$#A....l..9..m.T:s... .>Z.k...l.....kVyi......o.....

GET /do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: player.freeridegames.com

Connection: Keep-Alive

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:02 GMT

Server: Apache

Content-Length: 95

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1

..........<html>.<head>.<title></title>.</head>.<body>..... .....</body>.</html>..HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:02 GMT..Server: Apache..Content-Length: 95..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1.. ..........<html>.<head>.<title></title>.</head>.<body>..... .....</body>.</html>......

POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030000C298A8B377A25A8A6F58200010200F584AC3C04E25063D8C22EF900057EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=AB322AB415E4EA84511CAD131C36E00A; 143_TURNKEY=Default-641406905440442383; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

HTTP/1.1 200 OK

Date: Fri, 01 Aug 2014 15:05:04 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 01 Aug 2014 15:05:04 GMT..Server: Apache..Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Content-Type: text/html..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

iexplore.exe_1932:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512