HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.FAkeAlert.105 (B) (Emsisoft), Gen:Variant.FAkeAlert.105 (AdAware), GenericEmailWorm.YR, TrojanVobfusVB.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 80f39c23c0864b8c36c60bc32d5a63c6
SHA1: 971736554edac908976fcfc5601af976d04c96ee
SHA256: 71e1997a0cf4769f782ba1fc8369d2b6b462ff77badfac513cb16602a7ec7276
SSDeep: 49152:4VL4NybWENEZY9vigH03SubpAb1k7GeATqEuckPbM:uL4N53ZY9LHq39Ab2eOhzM
Size: 2150912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-01-12 23:04:25
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
| Behaviour | Description |
|---|---|
| EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:2756
hotrolb.exe:1844
hotro.exe:3160
H_LOADER.EXE:2500
hotromaster.exe:1040
The Trojan injects its code into the following process(es):
HFM.exe:2624
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:2756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\H_LOADER.EXE (126 bytes)
%WinDir%\FSWKLY\HFM.01 (81 bytes)
%WinDir%\FSWKLY\HFM.00 (1 bytes)
%WinDir%\FSWKLY\HFM.exe (15801 bytes)
%WinDir%\FSWKLY\HFM.02 (56 bytes)
The process hotrolb.exe:1844 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\httpErrorPagesScripts[1] (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\navcancl[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\info_48[1] (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\background_gradient[1] (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bullet[1] (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\rent[1].txt (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\errorPageStrings[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\ErrorPageTemplate[1] (2 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (0 bytes)
The process hotro.exe:3160 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\b64[1].js (145 bytes)
%Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (1254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\92a411bc23[1] (21 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ahl6532[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ga[1].js (22035 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\adfly_2[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery[1].js (38959 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\1market[1].htm (768 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\CC61097B94A0A007D678F95504798376 (140 bytes)
%Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (1254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\kjuwM[1].htm (1382 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\view40[1].js (31873 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\96D7A99548C36B10D2E8035A3E0DCA1A (7972 bytes)
%Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (952 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\CC61097B94A0A007D678F95504798376 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\logo_fb2[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\logo[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\cloudflare.min[1].js (24826 bytes)
%Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (92 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\96D7A99548C36B10D2E8035A3E0DCA1A (244 bytes)
%Documents and Settings%\%current user%\Cookies\LFO58N91.txt (83 bytes)
%Documents and Settings%\%current user%\Cookies\XWUC2JM3.txt (273 bytes)
%Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (686 bytes)
%Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\nr-411.min[1].js (4323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\C6D6MG1D\www.downloadmovieshd[1].xml (13 bytes)
%Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (510 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D4F348B882DF3F205ECCB6243795CB3A (200 bytes)
%Documents and Settings%\%current user%\Cookies\11D1YS36.txt (125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\footer[1].txt (579 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\42[1].htm (875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\d_bottom_bg[1].png (167 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (200 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\en_tran[1].png (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\d_top_bg[1].png (156 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D4F348B882DF3F205ECCB6243795CB3A (554 bytes)
%Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (1248 bytes)
%Documents and Settings%\%current user%\Cookies\JA35W949.txt (1248 bytes)
%Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (1102 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\external[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\img[1].js (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bag2[1] (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\style[1].css (1762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery.min[1].js (57770 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\aa75b70072b3d2c372e725db858e1e89[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (0 bytes)
The process H_LOADER.EXE:2500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\hotro.exe (32 bytes)
%System%\hotrolb.exe (32 bytes)
%System%\hotromaster.exe (24 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DFA24D.tmp (0 bytes)
The process HFM.exe:2624 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\XFH\HFM.004 (1170 bytes)
Registry activity
The process %original file name%.exe:2756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 A1 3D 40 D7 DC 3B 40 05 27 4B 42 AC 3B 28 91"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\FSWKLY]
"HFM.exe" = "HFM"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"H_LOADER.exe" = "H_LOADER"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process hotrolb.exe:1844 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 26 7E 81 B0 79 68 12 AC 7F 62 3F 34 F3 00 C4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 01 00 00 00 00 00 00 00"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process hotro.exe:3160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 AA F8 DF 70 A9 5C 0F D9 94 D7 06 8D B3 01 F7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1398452974"
"Name" = "hotro.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process H_LOADER.EXE:2500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 3D A3 9E A4 F8 65 5E 34 AD 52 25 07 FC CF D6"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hotro" = "C:\Windows\System32\hotro.exe"
"hotromaster" = "C:\Windows\System32\hotromaster.exe"
The process hotromaster.exe:1040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 AF 09 E8 49 D5 D0 7A 55 A8 D4 FF C9 A6 58 9A"
The process HFM.exe:2624 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 8F BB 6B DA 45 E0 CE 72 69 CF 1D 57 34 D3 50"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HFM Start" = "%WinDir%\FSWKLY\HFM.exe"
Dropped PE files
| MD5 | File path |
|---|---|
| 140c898473524303a63d1b5711ed9318 | c:\H_LOADER.EXE |
| 7059cdba57a398f80a9afd3de0ffbd07 | c:\WINDOWS\FSWKLY\HFM.01 |
| def249d7a5f5aa0ae0caf1d3b9700171 | c:\WINDOWS\FSWKLY\HFM.02 |
| 3d09e558be6c81f8e5fdde46888944d6 | c:\WINDOWS\FSWKLY\HFM.exe |
| d6b2bff6198642950f1bcf491131a38f | c:\WINDOWS\system32\hotro.exe |
| e30b602e465fac39a59485dee86db375 | c:\WINDOWS\system32\hotrolb.exe |
| bcf7e6fd8b994f3f9a6e23324a4bec6b | c:\WINDOWS\system32\hotromaster.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 40340 | 40448 | 4.79593 | 81e45a5c05115536674bbb4173bba1a8 |
| .rdata | 45056 | 9232 | 9728 | 3.72834 | 02fe36e76de5cc9f834ba0e75c9a5052 |
| .data | 57344 | 8032 | 3584 | 1.58991 | d4668da877d58af66239b78e3837253f |
| .rsrc | 65536 | 2090928 | 2091008 | 5.31858 | 4a044b790cff0618b49d079f2b4871cf |
| .reloc | 2158592 | 4752 | 5120 | 2.51801 | c1c353bf28dd868ed81faaad547dfa87 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl | |
| hxxp://e6845.ce.akamaiedge.net/crls/gtglobal.crl | |
| hxxp://www3.l.google.com/GIAG2.crl | |
| hxxp://adf.ly/kjuwM | 69.65.39.16 |
| hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js | |
| hxxp://cdn.adf.ly/static/css/adfly_2.css | 66.55.92.34 |
| hxxp://cdn.adf.ly/static/js/b64.js | 66.55.92.34 |
| hxxp://cdn.adf.ly/static/js/view40.js | 66.55.92.34 |
| hxxp://cdn.adf.ly/static/image/logo_fb2.png | 66.55.92.34 |
| hxxp://cdn.adf.ly/static/image/ahl6532.gif | 66.55.92.34 |
| hxxp://www3.l.google.com/ga.js | |
| hxxp://cdn.adf.ly/static/image/d_top_bg.png | 66.55.92.34 |
| hxxp://cdn.adf.ly/static/image/skip_ad/en_tran.png | 66.55.92.34 |
| hxxp://cdn.adf.ly/static/image/d_bottom_bg.png | 66.55.92.34 |
| hxxp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei= | 69.65.39.16 |
| hxxp://c.global-ssl.fastly.net/nr-411.min.js | |
| hxxp://www.downloadmovieshd.com/vid/42/?did=267 | 108.162.196.83 |
| hxxp://beacon-3.newrelic.com/1/92a411bc23?a=2344945,2334836&ap=58&fe=4593&dc=4593&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZc0xHFVZcSxYLXERBU15cRiJWXxAXDF9aUEQfTFoyUV4WEQZd&f=["err"]&jsonp=NREUM.setToken | 50.31.164.176 |
| hxxp://e6845.ce.akamaiedge.net/gb.crl | |
| hxxp://www.downloadmovieshd.com/vid/xternal/jquery.js | 108.162.196.83 |
| hxxp://www.downloadmovieshd.com/vid/42/style.css | 108.162.196.83 |
| hxxp://www.downloadmovieshd.com/vid/xternal/external.js | 108.162.196.83 |
| hxxp://www.downloadmovieshd.com/vid/xternal/img.js | 108.162.196.83 |
| hxxp://www.downloadmovieshd.com/vid/42/img/logo.png | 108.162.196.83 |
| hxxp://www.downloadmovieshd.com/vid/xternal/footer.txt | 108.162.196.83 |
| hxxp://ajax.cloudflare.com.cdn.cloudflare.net/cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js | 198.41.212.126 |
| hxxp://beacon-3.newrelic.com/1/92a411bc23?a=2344945,2334836&ap=22&fe=3328&dc=3328&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZZUtdTghcBRcIVkIbRlhJ&f=["err"] | 50.31.164.176 |
| hxxp://lp.sharelive.net/pixel.php?sysid=406&appid=267&subid= | 94.31.0.27 |
| hxxp://www.downloadmovieshd.com/cdn-cgi/pe/bag2?r[]=http://www.downloadmovieshd.com/cdn-cgi/nexp/dokv=abba2f56bd/cloudflare/json.js | 108.162.196.83 |
| hxxp://adf.ly/callback/aa75b70072b3d2c372e725db858e1e89 | 69.65.39.16 |
| hxxp://ajax.cloudflare.com/cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js | 198.41.212.126 |
| hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js | 74.125.22.95 |
| hxxp://crl.geotrust.com/crls/secureca.crl | 23.9.117.163 |
| hxxp://js-agent.newrelic.com/nr-411.min.js | 199.27.76.175 |
| hxxp://www.google-analytics.com/ga.js | 173.194.43.41 |
| hxxp://crl.geotrust.com/crls/gtglobal.crl | 23.9.117.163 |
| hxxp://gb.symcb.com/gb.crl | 23.9.117.163 |
| hxxp://pki.google.com/GIAG2.crl | 173.194.43.34 |
| bam.nr-data.net | 50.31.164.166 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /nr-411.min.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: js-agent.newrelic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
x-amz-id-2: PbUwlD/woEsn5A wHJLD5wSZTT ecr/JvfmtHoS VfiTf1WrDhpGpES0hvZCyTz2
x-amz-request-id: B86B72DCB2E45219
Cache-Control: public, max-age=315360000
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Last-Modified: Thu, 01 May 2014 23:15:58 GMT
ETag: "9050946217be03f42647b3f708ef10d3"
Content-Type: application/javascript
Server: AmazonS3
Content-Encoding: gzip
Content-Length: 5773
Accept-Ranges: bytes
Date: Mon, 23 Jun 2014 06:18:52 GMT
Via: 1.1 varnish
Age: 1325392
Connection: keep-alive
X-Served-By: cache-jfk1024-JFK
X-Cache: HIT
X-Cache-Hits: 16639957
X-Timer: S1403504332.030173302,VS0,VE0
Vary: Accept-Encoding
...........[mw.6....B..*....8NB.V.4......fv?Hj.M....TA..G.............I../.....Y\f.J.......V.=.(...$v..L-L)...@.J.UM...........|/..e"E....P.../])T).^...F...U]n..J..{...{ e...&..\..$.z.<*S......}..=a........\.......u6Z.. M.`hA.^.0..}.p....."".|.{.....=....TU.>.~f....<.G..F.S.-.j....v|.,......{.6....&.............I.D&$K..G.Z.qz...?...........7.....4.w.'Qo....~./....G.v...Mg.b.s..o...6 ......m.*?...@...S.....d..J&a..0.........'0...a^f..a.1...?.1Z............n....N.......4...P.u..w...E^....Col...Q1.1..-Px...V...F....<.A1.LU.Q.6.Se.....-..~.n.G..m.d ..SP.d..g.....&.x0'..4...fr.. .\.........H.B..5..H..2M.....rf~....;.D#.....)Z....0...2..T......!.T.7...p)..d-..(.U[.,4O.J.#l..0.........S..a.....R....c...^r...2.....<.}...4B.-T.....>...@.K.7...r;.W.x....D..S"VoW...lA. ..g...\*O..2Oda.......|..3....J.I.P8)$.H.*.R..,4...{$.........nE...a.&..=..oy.9.....k.x.....U....$.&A]..lAF%......k....&iX..>).d.,..hRVX.9....;...p.)..S.............l.Z.9s.....0RVyG..<..*...e.....l a.<..=.,..[.....a..>...JT...[./.t5B.K]w..g...(M.......1D9l.W..{bS...........v..l...X...^.e..J.......'...^Y.,.....{....Z...2...E.m....].zj......x....2M.......<,.`.a(....T... B.l.^.....xP.......f.!4t=.].=...Fd..U.F.9......F~...bb..v...vR.V.0..|x'.0.....R...Z..!Iw.u...([.s....U..r..|..)...t.M.1..aw.}..H..C9Nd....`.vq...H.y.u.E.A.(_..3E...../H..0v.~.X..^P-Rbh<..^...v...%`c.C0c..].W..7V.h5 .........vP..e..mhY............5..7..o$....V...Kl.....:-...o*..hCc......A......-...\......0,...;........3[..q.l....b.......]x.Yp.,.F..?.ES.[....F
<<
<<< skipped >>>
GET /cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: ajax.cloudflare.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d3c65f5ca903574506465ce0de483f7581403504334321; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.cloudflare.com; HttpOnly
Expires: Tue, 23 Jun 2015 06:18:54 GMT
Cache-Control: public, max-age=31536000
CF-RAY: 13ee922980210785-EWR
Content-Encoding: gzip
d3d.............Yms.6..._!..LT0-.i...h.......&.M..e@..(Q.LR.]K.....&[i.f..Er.X,.....g_w;.q.._.2...?.xCo...a.;..]g.m..`..3x6:?.......g_ug.D.Q........(W..h.v.b...(...(..:..L..,.$.....O.v....W.^......,.l...,.\.e...w.m9:...LCh..d.z.e:t._J.u..WHn>.t..\HO.2.......72...~..p......-...h..m...5.o.Bg72.$D...g|A...b.zi.....E....Ta<....r.>...."......"-.6...Anh.6..'.......n.xs]..._.}....Z...:l2.r.^.iY...N^...a<...f..(.u....Q......@C....h..Dy.....-...<v......#..S...L....g.z.....?<.....G....N..E..n. .....!c0_.E1...{h.@8.$..(..w...'...=..Z....._...y.N...k..axu...{.Dg..A....p..t....4CY.B1....)-.8U.H...,.GIm.....!T....3......N..km......q.....<..u.vs.okOz..y....UW.X#..1..n....H.`,p..@.b..H7?g.F......X'.b.b...^..f..\...;`.K..f./......Kq............A..!.X.... ...5#....\....S..L....Gg....9.x.. ....=..vn..\....i..D..w..H.....P%pD..Q..1....s^.Y...M.......@.....8C...p.-4.d.;.T.....,..z.E.G........f$I.'...)_........-...u.......i ..u:..s...J.h.|...C_.u.....q....,.w.....F...~.\.LO......N {.F..l.|E.3...5.&..r.W?..B.;.Bf..AK.....T.q&bW5H.?...0...FH...J..hVym.......%!s.....9yZ..s..\2.4.[....!_......*g.........%.*.4........*..k.."...^........G.bQ.....Q..... ....#......c........v8\..Z.#.].H..GPh.#R..u.rC}K.Y.s.....\2...ZtC......9..l..L..AZ..j/.X...'..>#..$S.a...>.H....ee...^.P....6..\....b.XXUV.ND:;.......'..\.mQs..p..;.c7.../.[......FW...V.....=.m..3..h..>s.d[6..g....>.!..Vk...g|...U6.|..5D....SG.v.y.e........D....K.B...KZP.....w.G.....z4._j$.........l..-..N..^......u..*.G.J.1&..B.U.H..f..'.i..2LT.&....cR...hC.
<<
<<< skipped >>>
GET /crls/secureca.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.geotrust.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "f04c0433daabadaa78dc278baacbcdd8:1403502613"
Last-Modified: Mon, 23 Jun 2014 05:50:13 GMT
Accept-Ranges: bytes
Content-Length: 1780
Date: Mon, 23 Jun 2014 06:18:40 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0..Y0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..140623054300Z..140703054300Z0...0.....&..120627171036Z0........140521155053Z0.....-..140617185011Z0........120627171058Z0....``..120627171034Z0.....3..020515130611Z0....j...140226123519Z0........120627171039Z0........120627171002Z0........120627171038Z0....i...120627171035Z0........100301134531Z0........100623141752Z0........120627171026Z0.....)..140617185515Z0........120627171025Z0........120627171050Z0.....#..140606204021Z0....S...120627170949Z0....H...120627171011Z0........120627171026Z0....._..120627171036Z0........140618143145Z0....7...140416231149Z0....%...020514181157Z0........140605215230Z0........120627171058Z0........140618224415Z0....x...140507204001Z0....}...120627170911Z0.....8..120627171035Z0....."..120627171030Z0....]E..140618144819Z0........140429180917Z0........100729164439Z0....x...130924204342Z0....M\..140430000442Z0.....D..120627171051Z0.....N..100623141726Z0....X...140427081922Z0........120627171036Z0....7...120627171052Z0..../(..120627171032Z0....zo..120627171025Z0....v...140618150003Z0........120627171039Z0........120627171031Z0....*...120627171032Z0........100729164732Z0........120627171017Z0........120627171028Z0........120627171030Z0........120627171031Z0........140618143256Z0........120627171028Z0........120627171029Z0....hA..120627171034Z0....~...120627171035Z0........120627171003Z0.....$..120627171037Z0....x=..120627171055Z0........140416233935Z0....t6..140425041720Z0....S...1404
<<
<<< skipped >>>
GET /crls/gtglobal.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.geotrust.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "3af1227a9006c319b97222bd604d8385:1403503211"
Last-Modified: Mon, 23 Jun 2014 06:00:11 GMT
Accept-Ranges: bytes
Content-Length: 554
Date: Mon, 23 Jun 2014 06:18:40 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0..&0...0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..140623054300Z..140703054300Z0..0....4...031011141952Z0....5...060809140549Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....6k..070711055050Z0....4Z..020521134804Z0...*.H................/.7.`.r....w.}#4.....).O.F..=...j....3..05...}.lG....6..s.%3.9..R......#@@.nw.N..n...SJj... h.F.\........*.dd.w.L..ae...)-.K)..p.r..P.J.....`....t...Uf.4.9.....8).....`.h...O.......c.....x..39....b]....VVIT[.....x..u.....8........Asm.2...m|8....|.......HTTP/1.1 200 OK..Server: Apache..ETag: "3af1227a9006c319b97222bd604d8385:1403503211"..Last-Modified: Mon, 23 Jun 2014 06:00:11 GMT..Accept-Ranges: bytes..Content-Length: 554..Date: Mon, 23 Jun 2014 06:18:40 GMT..Connection: keep-alive..Content-Type: application/pkix-crl..0..&0...0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..140623054300Z..140703054300Z0..0....4...031011141952Z0....5...060809140549Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....6k..070711055050Z0....4Z..020521134804Z0...*.H................/.7.`.r....w.}#4.....).O.F..=...j....3..05...}.lG....6..s.%3.9..R......#@@.nw.N..n...SJj... h.F.\........*.dd.w.L..ae...)-.K)..p.r..P.J.....`....t...Uf.4.9.....8).....`.h...O.......c.....x..39....b]....VVIT[.....x..u.....8........Asm.2...m|8....|.........
<<
<<< skipped >>>
GET /GIAG2.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: pki.google.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Mon, 23 Jun 2014 02:48:44 GMT
Date: Mon, 23 Jun 2014 06:11:54 GMT
Expires: Mon, 23 Jun 2014 07:11:54 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 871
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 407
Alternate-Protocol: 80:quic
0..c0..K...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..140623010004Z..140703010004Z0...0'..@..q.S....130910151922Z0.0...U.......0'..@ .*..)v..131112093101Z0.0...U.......0'....&..E.@..140411093120Z0.0...U.......0'..h.x../ ...130913110309Z0.0...U.......0'..5..[......130927105255Z0.0...U.......0'....).(_.I..131028093755Z0.0...U.......0'..x.%,......140522102708Z0.0...U.......0'....f.'..{..130910150931Z0.0...U.......0'..O..D..."..140407142442Z0.0...U.......0'....!.jD.E..130612174206Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U........0...*.H.............lV..^"......\.J...}..j..<..\7."tP..l......k......1.3..].YCz5..V.g7f\.....f..9... ...i.......8*..Y....q.&=...2Vt.2....<k?....}fZ.c.o.Q..4..c.......v....n..C....`.... .....N..E..X...1J.%..|....):../S...Q..m9b.`.7..Z...K.t..y.|GQ..4=.{.Q.\.....^9..Rp...M_..|.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Mon, 23 Jun 2014 02:48:44 GMT..Date: Mon, 23 Jun 2014 06:11:54 GMT..Expires: Mon, 23 Jun 2014 07:11:54 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 871..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600..Age: 407..Alternate-Protocol: 80:quic..0..c0..K...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..140623010004Z..140703010004Z0...0'..@..q.S....130910151922Z0.0...U.......0'..@ .*..)v..131112093101Z0.0...U.......0'....&..E.@..140411093120Z0.0...U.......0'..h.x../ ...130913110309Z0.0...U.......0'..5..
<<
<<< skipped >>>
GET /pixel.php?sysid=406&appid=267&subid= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: lp.sharelive.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:55 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Mon, 23 Jun 2014 06:18:55 GMT
X-Server: web1
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
X-Stat-Server: web1
Content-Length: 21
Keep-Alive: timeout=7, max=1000
Connection: Keep-Alive
..........3............
GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 01:06:01 GMT
Expires: Mon, 23 Jun 2014 13:06:01 GMT
Last-Modified: Thu, 29 May 2014 22:33:33 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15836
Age: 18769
Cache-Control: public, max-age=43200
Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f.....ZhiI..dY.iB.b.KI.o.gF.-'..9....nbyF..h4...../....z..|..y .b../......A_.S.....w......$2=.\..8e..:.G..]..<.b....M_7.,.I...{..t<./s....x...,...(r4...8W|&N._K...M...p.\9...'.I.._.Jz.!.6.....8........P...F.......]H...-..!.M.t...?..6..5O..1..p0..7.n$y*.z..Z...".W .8XE.....z.a....`.n....t....v.u..6.....A:H...=..z.....!...5.u ...........9..d.@1.....B.o.......K......p(;. ... W#.M..4.0.u|.8..{..5...v.T.....5.@)..M..wr.....A>.v..%w..C.B..,Wjj8......j.r./.Y..RI.6.(........T....Dq......Al...b...:.r.........}1.C...ZYv..y.r.=d^.....T....L.U(.2 ...`..5......8.tD=..........c.#u.h...-..yu.....r..?D....j.JQa.T.....f...G.q?r....7_llo>..@....].n;...e.oU_@.8_.@.......#.V.....@G.8vG...~.UL&...,X.a.Gl...C..c....W........i..2....w.V.{S...T(w..KF........1.".......V..N.J V.y...K.....4.... .W...Y.......k$...r...P..H.J.^.......|... .w...D@PF.a..,|\AH`..._..k. x...A...d$.X.~.H|.3..w>.@M"...s....1..Yi.#..G.........tO....v...1...{k.......np...8y...Aa....V1.UvB...UJ.q.YC.=.W....1..Yns....s.8.....}..}.0h:......[.Q...B....S.4@.R.}.(..Z.%..q....=Q.$HD....|.[Yq5A..rR.|.r...A....,....^.3.w...4.:..3.=...>.Z_.A?2X.W..vl...Y.Q].....`VUv......9.R%<.k)..POLv..rm..Gc._j.cr/...yBjJ....:7....'....uQ.7.W..0s/K...|..*bY...&...peE.50.......&...T)-.-.)......A.."....aK...M.#.Y..... Js......ns.......V....F;Q....0.P..S.L..l...B..&...nfX3d.....Z....5...6... :.[.{.".!.7*.0...ylO..N...n ....r.M .q..j@C........5..-..]W.u..D...m..J.5k..nT...t!...._..=..G.Y..^Y..f..]...d.N^....9....m1-0..`K.uB..R.MB.......%.!.
<<
<<< skipped >>>
GET /vid/42/?did=267 HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:52 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=ddc3489bb4baff32a5a4989683945a0451403504332170; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: z/LE5Kc7y0Eo17Fs3FiaSQ81qy8m35nsZeJmLCTSjeJAuoI8T5Wp1hAvVwUpADfr
x-amz-request-id: 118FF19D7BB78C88
Last-Modified: Thu, 12 Jun 2014 06:14:16 GMT
CF-RAY: 13ee921c187b0ee5-EWR
Content-Encoding: gzip
17b...............N.0...H..0w.[q..I..H ......h.i....{..o....h9!l..x...h..b.s^<=.@........9.P...\.E.......&...^.`..N[.n...f.~W..:.]..W......$.q ..)W....Y6..7.....d:...A..kH*A/;..q.:&..8l......zV....Z.@..x-..T..qd......h......q..).qA....FW.z1..G....K...G......0CYI...Jo.|*....O../s.R.L>u|..#.....L.......".i...7N|:6lif.foV.h;g[..{.bg}....Y....P.......u.5.......Y{."}.c}6.v...iy.W={.......251...U]o.0.}.R....B.%.Utj.y..:..&.=..8..Hl.$0T..wm'!.2M..$.......\^\yq).1................"....8..RzC.....' 4=c..RNuSl....7.z~M.....\...VDE. ..].L....5r0....l..VB........a9.-..l........-...iH".t....&...O..D.4.T^..p..A..8....;O..@Z.*et.9 .5.....S .xnhQ.j..;. .;U"4..8..._.s.T.q...'Q.9...B..'.P...5@.....#&4..%....\b..4.D. .. ..R.>....Z..{.Fg.`....R....o...K^..?y.).?.bx..C....j..h.._.E.$2.......cr./..<.qeR|....O ...2~}....iMp_.q...[....D.Ms..z..o....&6zl..f$UK.a...f.)L..*.P.F.d...5FF.4..#h.7.J. .......mc...qN.7..9,s8...Q.[..._1.H....A..\6.x..).Qm>F3b3....5...E.....:..4..'R/.$..m.y..$...r..........1c3.....n.0.......).d[...u..i..{.NA0..N.$.a;m<..>*......E..(.....t7.........f;..~.......#|8...tT. .<.'.z; ..k!g..c.8ci&S.{.*.z,mN.6.V.$...lp.$..(.}.....|0>j...$2.....*...u....Z%E..6"#U.;.D2.H...S..HM.r...1 %...pu..(.g..7.6S.."N.)8........... e..$.1...\......{)q7.!..P........kL........."9...8.2...1...[..d......lTT/.......]h..:.x..Z.....zr..x......?..L.[..*Tm_....x%A.....N/....[..B..D../....k..a...{t...j......\....q.Z5..X..-..nw7..?...rT8.R.]..W.w.........e9...W...0....{[..wm)......I..m.R...;YETZzJ..l&3.N.j:.Q..&.P.[.p{
<<
<<< skipped >>>
GET /vid/xternal/jquery.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d8402590b549c39d9e446492eeb41de3d1403504333164; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: 3oQnrHW03yckPafAeHUYqHbo6lUwFeB4TubtFT7b35MC/6BHZNsdQ2j42KqIPKxe
x-amz-request-id: 152D9CBDFA0AA821
Last-Modified: Sat, 15 Mar 2014 17:31:09 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee9222493c0ee5-EWR
Content-Encoding: gzip
60e7..............i..6.0....?....i.$..~.4Y.^....q.r.Q.yH....*-.X.......PT9.....%.................M..o.#.....|.n|.....n.[...R..z.....5.m..Y.....bq....u.i..#..(F..O.*.....h....t.J..f....z.6....(.....]..t...y....j.4Z,.m.]..n>.n.t...?......,....J......#..q.x[@..5.....N.........hD......Y.k.N..e.n.M.........g.7.N.5.:..t0#t..6........V.5f..m..=....Oi..{...~.j%.`3K..7........N]g.fk.....`.F.v..?......Y$..`..7..~.Zb......~..H..6n........;w.YN}J...~>..h.J.LP..~.......{..5..q4}s.M...N......*.k.(...y......v;.........."IOO.7....I_..i..^....."..H....D.F.F.i:..G.L..:Vd.8.C......d..K....|..=...q..S=...F.....0...O.....)..[.J.. .NP\.A.lz..aM...Ik..J.{!......l..|....a....o.A...........k.y5]c2~....2...,......<..........#..A .A...h..E......e."B...............r%."..O.\,.<...Z..(_..j_..#`..j.M.6_..,....Nr.G.v...o..b~z.qGaI.......fi,.`.6!.m..B..^..,..b..d.k...Mo..r '.... n1.......Mq......Fn.Z.-.....oZ...?9;.......f.S....`Z.1X...Z...!.#.......2|.h..3.X.s...z........=4..-B.... .....K...2.(.nVlV).&]:.....t7..e4.e:..K>V.d...C...v. L.%<Q[.._........@h..'..o.a.}.*...y4.A....)..u...&.....-.-%@s.".E&.....A..q.W....q!.#.r......l...'N7j:-...i....W..P8.......<~..:.V].Vq.'..@d.BD..2...\....... .A........f/.M.Q.....V..'.....N...L..|l6.......!q..}..j.......F*.?H..p.....#..<...ko..........L..}.K..,...[izF.F...a.......Z.-0...k...4...Wl.g..T2.$.....2.......3^...)...W..'k.yD........j.X..uk0J..W.b.kw.1......H..PaN.e4$....}........{.0.Eqk...N.8..R....=.hN..!..B.wPq8.f..$.[......$..i.......N.~......b.".D& ..$.-.:a@\......^3..l...z.
<<
<<< skipped >>>
GET /kjuwM HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: adf.ly
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Date: Mon, 23 Jun 2014 06:18:42 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.5.8
Set-Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; path=/; domain=.adf.ly
Set-Cookie: adf1=668e57544f6910e95c22591759704a2f; expires=Tue, 24-Jun-2014 06:18:42 GMT; Max-Age=86400; path=/; domain=.adf.ly
Set-Cookie: adf2=e8b8e1b450a222f8d1c56b9a088a166b; expires=Tue, 24-Jun-2014 06:18:42 GMT; Max-Age=86400; path=/; domain=.adf.ly
P3P: policyref="hXXp://adf.ly/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa IVAi IVDi CONi HISi TELi OUR IND PHY ONL FIN COM NAV INT DEM GOV"
Cache-Control: max-age=0, no-store, no-cache, must-revalidate
Pragma: no-cache
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 23 Jun 2014 06:18:42 GMT
Cache-Control: post-check=0, pre-check=0
Content-Type: text/html
1000.............<kW....3.B(w.t.e...l.K..d&...L......-.%.V.C...~....a..[...$sw}r..U]]....?....C>...Q...>.|.i4&..=i...4.........0.t.... ......;OO..M-M.c{D.q.\...{...smB{i...Q5.\?...........('bn.. .o=.U.s.....1.5_.<..;.@...?$,..;.|R.....~..p.5.K..krKd.~`L.8H&............3......]...p.M..a...L.}.r...o&...O...&.x.....uu.. ..3.....a....VlN....h.}c.^.....0-......q.x...f].=.....(2.[.Y.X./.....z.e.g.wH...5gVb. ........... u.C.%}.|.S- .u..3..N7......>.&[[&..".4.\f...\..Q.EA....#....K...E<.........z.Ex...K.=.$.A..p....&.qto..S.E: ._..[.b..._.. ...,..mg.t...zz..S.....4'.7M....(..x6...K.Y>h..T......*.......f..1..H..b:..c.d.!?....$?....Q.....a.Z.A. .......p..^.v..@/........|..h%L..|...F. .u$...x4"..K.O.......GeG....ge>....r....&.........p...;7.!.......m....n.M...{I,..a.p..a.Ta......i*y).4..B.S...'<.........AX2..?.;....F`N....F.c-..4....7... ..-..].....`..ns...b.?......)..M..f.m.Y......{q .`.D28.,...6.u@.q}n*.i..g[.k.....3*f.......1..b....q..}..fs3;pp.zy.................k....{....Z.m.:-k..c.;...q.-)1..u.u...nIi..o..;/#....^9..;.?E.GM.X...3:Jni.....:(...K..`...vQ..!.(4f../U..D.N.)g..>....5..Me.C/H|.......C.~...jL..7.q6.f.I0v.......w..x...K`?.C..5....P...(..Z.~z...n..M..-.ZR...02H:..|..]a`...... K.p...TK.<.e.......1.Z.;..Y..-.W.....F..X.B..@f.W.. .s.y.1K..RTuq.\.\T..4......*.....k.V..,.K.....(3...8.~.....-.%.O..ATx..u..t.....>...%5.....").t..r..:q.1.......r..........r...3 .n.......LB&I./.0../..(.x....D.5.. . ..PS....2.=..t.iw....&s{..E.........&1.p..6....x@..............5.n.....p...@......%xJ
<<
<<< skipped >>>
GET /1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei= HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b; __utma=255621336.468587299.1403486636.1403486636.1403486636.1; __utmb=255621336.0.10.1403486636; __utmc=255621336; __utmz=255621336.1403486636.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
HTTP/1.1 200 OK
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Mon, 23 Jun 2014 06:18:52 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.5.8
P3P: policyref="hXXp://adf.ly/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa IVAi IVDi CONi HISi TELi OUR IND PHY ONL FIN COM NAV INT DEM GOV"
Cache-Control: max-age=0, no-store, no-cache, must-revalidate
Pragma: no-cache
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 23 Jun 2014 06:18:52 GMT
Cache-Control: post-check=0, pre-check=0
Set-Cookie: adfly_197198=1494770; expires=Tue, 24-Jun-2014 06:18:52 GMT; Max-Age=86400; path=/
Set-Cookie: market_197198=1494770; expires=Mon, 23-Jun-2014 06:19:52 GMT; Max-Age=60; path=/
Content-Type: text/html
Content-Length: 4072
............is...{g.. .T.FK..h....>S....j...Y.Krmr..........A......F.....WS5.]...WSFsxz.s5g.zS..........B(&T.....^fZ...Wu..$^6..d*...e....__.....)Xbg~..........XFo.....z..g...0..4g.W8e.'.......i..O.^...../..|.i.d.....c.._...W..K.. .)^.@.FD.rmO........0\.R..).. .uQHU...N.....(..YPDv.l.en......0.LU.O(n...5).feX.Q<.u.........W..6".]..K..............&..Y....a....V.x..F..... .@"n..i1PCBSyz*...u.....!N..&{.@..*...A5..b1..J8.AQ.-.k...........h.-.r....v....../Z..*?a.t....$l.U,....!.h#.B..4.'e.. U7U'..2...>....`K...h5..._3.h..0$..Eo..VMyI...I5.=).0>.5X..v...9 K:a.Z.}7.....-..z..h.s\Gg....9.....,*....^..t..`...|........s.X.M....,..k.w..S*...C...<...*x..0X. .........k...a4f.(.J.K}fH....Zm#Q(....O$J..Ad...>.[gTe. .W~.h.....OO...B...`....-..5/.D..0..wz........._.....b.:=.nG.Y...z|$.=....H.nXs...Yt.P...T... ...^.......e....Y.. `c"..n/....'.5...u.......@......>XK..O4.I.........e}r._.~..<.{.a...#1.......O>1....?...t..r^.WN. .....PS...%.d...m.....A.v..(........r....&L..2..@........Q...>.......y.i.N8..GSZ.].X.`R...0.I.S.M....C.....O.cB.P8..W..#...7a....d.Q...!....aRhQ.]...J;`d.q.`..=9``...... .rp...l.......x...Ne...........j...9id ..!.9.I.ze.= ....h..I...F..V...............d...D.(.....F..diX.Dp.'^J:g.E...wG..l...c......C.1...C.h..^A$..n........3.NP. (..\LZ..R.........Lx..p.6AG....P...4.....l.B.yKg.5.....D..... 5.6=.......b.....b`Q:..#..<..BH....P. 8.....n...Q.ii..55.7.........@...........8..vV..Vb.AA...Rv..<)..{.yK..c..a......:E.5.7@.b...D....mP.w.A..!2...p.&T.'..q..J7.B.....>..4.5..{..c.Q.
<<
<<< skipped >>>
GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Fri, 20 Jun 2014 15:21:54 GMT
Expires: Sat, 20 Jun 2015 15:21:54 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33186
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 226613
Alternate-Protocol: 80:quic
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D.. (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_...~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U......r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x...C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rYx..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..<.F..q5C..vR.iO)Z.(..&T..v.Z#.. .._ts..1.H..=....H1...6..@....9..v...=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...<.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=.....P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....
<<
<<< skipped >>>
POST /callback/aa75b70072b3d2c372e725db858e1e89 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://adf.ly/kjuwM
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: adf.ly
Content-Length: 562
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b; __utma=255621336.468587299.1403486636.1403486636.1403486636.1; __utmb=255621336.0.10.1403486636; __utmc=255621336; __utmz=255621336.1403486636.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); adfly_197198=1494770; market_197198=1494770
hithere=R5VCQI07LIjjBMDwOEyjAMuuTUkjVLUzNACi4UwMRNSEkIiULVCkJTyuZAWyZOl4cQijIN6uIYiDIMs1IQmDlMkuZAWj5L0zIAjioUwMLNCEJImUbVGkFTzuaACyIO63MICzwNiwcU2jNLywZ4XiNM3gIIjFoTxDMBTCcV2FL5CkJLzgYs3DJMlucQ2zgLi0O5jWgZ4kNlSmwciUdB2yJOyxZ4XSNN3gIQjloT4gMMT3cdsvIRnmdbipcdmFVIz7aACjIL63NADSgRxJLNCVJTtgbs2TJZpsbJGWUai0OFjGAcstI9m21YvoYAmClMsuZQVz9LvhcxyGIb6pIpk35bvNIJiiwOiiYQWnNb0ladWW9YuyIVj2oc51LJCCJL6iIkjDoOilMFCT4Z44OUDDAO1iORDWcNzyNcDTEZ1yNcDzEM3jIJiDwZizaIGmFMz3aACDIM63IImWYN53NEDWEYxiNoWjQI4kNlT2dXhnY9WGVbhiMwTidIj1OcGDEMyxOIDilOjiYIzXUZ22MJjCkL3wYomjQIx4IJny0eO=
HTTP/1.1 200 OK
Content-Encoding: gzip
Vary: Accept-Encoding
Date
GET /vid/42/style.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d1a29a4f15a66591a8a099ccda297f92d1403504333192; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: JxqfVsPo1FbAWUi7ir2KLQ0bqpGopH QwXpnlAweMtLq6B93Stx6rChRFb KEypW
x-amz-request-id: 114AB11C34153946
Last-Modified: Thu, 12 Jun 2014 06:14:28 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee922270540ee5-EWR
Content-Encoding: gzip
532.............XOs.8.?'3...z2.;....1....zw.....*@`M0..9...w_=I`..$.^.'1......=)......D."R.;.o.4q......I.........Y.H.0|a&..Uo............'...d.A....0B.....F..*H^8..,.....*.3.."c9u...k. ..r....e.t:U.?.....X^.\?.y.>K'...D2...yN5...........v.)...K4.@2.Q`}b.\.d'y.F2..ADsIEi.z...@M.......|~...<.{.....[X...o%..`e4e!....b.u.pf....O...ob...s.j.!...<...n..#..Gk....V...F..6.C.Mp..2.vLh.. ...............y.........;)y...~mu.^#...L...........vW...x......<cqm...L......hJ....;.]...,F..GJ...%...=.l.w....'.$f*.7..Q...kx&~....nx$....L............3#.....pcdk=....Uj..*.4.. `S.).....I.:..5.... ...SH.Y`.... fB..rZ...Y..."...;...T.$..*.k..=...N&u.N.B.._.=^M.6.%b.V....dW.h.p...=..b..U\Y.Q=.x...-.c].ty.jk.'M..3.L.L..#....B.)...:....._W./W.._I..c......PY..;...>43.).o.&Q....mHJOm.D..T..>.g.....q...Og....g.<.. eM.t.Fw.iR.....=...S..?....DB...S.P...R..tF..wb......s..Q..L....)......n~...H....f...O.....D.{X.B./...I.q.T..$h......m.._..i.....N.....by.......}F.... .Z)...E. D.G...z?..P... J..UXs......*.6....j.....D&B...a.e....M.......s#...5.|s.........l..8F.x.8.....R..i.........d..\6.e._."n..Z.9.Q-&.Z]........)U..H$w$C[*..W..}.\SW...Y.\.Y.~.@..@.6..S.*..V..mQ^....i:2{........P=(d...[..w..4F0._..I..H....-...zr.?.OG...w..{t...=..v...........f.T6.W...J..j..I EA2T.C....(Y.r..n...G..}...5.um.yi.8...L......~......3J..f.y..P.N.....;.....n&.{.[[~..,.."=.....0......
<<
<<< skipped >>>
GET /vid/xternal/external.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d888951e18dc1409b194d64dcf274ab9e1403504333255; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: Ohnd/yqYKLMap 2YXPUHjdkH5hmtjNuofRx/vb0z6B2FRwX5ldMr9fLlbL4OOEmR
x-amz-request-id: AA4E0C233D529042
Last-Modified: Tue, 17 Jun 2014 11:49:49 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee9222d0600ee5-EWR
Content-Encoding: gzip
39a.............VQo.6.~N........T....G.b.{J..Y..AP..Yb,.*I......).v.l.0.X:~.......?..$UKY(..B.....=..V2.BI.....*....}...kRrm..I...@...I.4..O ...Gi.LY...W4..8..[VE.eOE....$h^.n..j..>.Uo.[.T..Y.....&..uL.r'.[j......-jxwt?...iP.Y.2.9.c2.7.5.b.=.....6!.4.9&..Qo...y;...l....m.H....E)...Z..`;.(..G.......i.......gQ..../\....b.l$..~.".d....,E.S..SyC....VrA(%g..Bc..7wT..sW.......*.T.o..a..RH.......TuY...A.Ss.u.....i....c.....Bs.Qm.SB.@....U.U..%V.esn.<..M.$D".......w.J=...#O...........A.U..\.Z.........vu.j&xW0f.\k....`..r.0W.QtM.-h....#.J.....D..{._"..O...._c...........{.......whd.Wq}...p.6.c....%j.=.....t.r;/.d<<......Q...........F..|..;...#J..)6....;=..>UI5w.Z.n....?4...O>.......k.z)y.."1.N..1n }..W$..0Cw.Pp...L.../..e..JZ.#..e................I.nx......@...m...c..0(.......P.R......]..Xj..F.|..U...J&.ju.M.E.....y`..k..r.J..J.o.50..)|.o..\.i.]..L...>o....H..n.%.>.v..@f...g.|....1N..1..k..........2.#.V.)...'..j....o. ..*.....0......
<<
<<< skipped >>>
GET /vid/42/img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: image/png
Content-Length: 8348
Connection: keep-alive
Set-Cookie: __cfduid=d4d6ab53f9e9ae39cd102d551ef8fe9be1403504334279; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: dTXZuD37f/c8Mvj2ex786FoSQ3Eok/O2UhAu YfQeMV67AtxK6iCS6EA60hObq r
x-amz-request-id: 688FCDD643C3E6ED
Last-Modified: Thu, 12 Jun 2014 06:14:16 GMT
ETag: "0316f69a4d3f81febbe17593082a979b"
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:54 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee9229312f0ee5-EWR
.PNG........IHDR.......8.....^.|... cIDATx...w.......yN.>...00.)CW.A........M^5....1M.^.....)F...M.....(h,t.0.6....i......30.0......l.s...^{..Z{...#H.......|.... ....b....$.$.I.... ..A..WA..X.a!.e..J..J.&............t..V.b5.2.....$.&)....]...;...f*9...I........ ..R<..........$........!.`-..6..9.}......@.z(...Z..;..a..-.....31....IR5...6h..y&...F.......7!.7..............t.T..@c......a......$uO..J.....-W.7.F._...`.......p..D....3!o$....{.b.......X....B......II.....I%.....e...@......`tl.[n.......N..WC.......P......$....nc....~..)Pt.....&\...............*..&...4_M....O.Z..*Bk...........]..w.V>...P[b8..ub.o%...4_...u....>...w............_A..0.>.Z==...!.. e....'.....A.Q.?.d.{ww..}....;..<....X..II.U..|..W.`.G..'..[.K.aC..v..Kf.7.a..{..IkYR.|.SF..8..P.=...4../A.......2.........H....4.%.t#e..A.....S..9..xx.t..o.."-J...%..g.b.S..Wh.,...\...J.uZ.....;.jv...K..5' .]....V..I....Q]..........~..!..em.:0M.3..{.....i...%!..4.74..%'!..V..4Zm......C2..u...]B..c.Q........M......j.Bd.....llX.....N/9.(.v...'..T....\.........L.U...[^.........@<H....0.<....9!-.8F...74.b.........$!.o....^S\.8........(...B..,...>........$...F$-{....M..x....o.7...~....fN....4.2.x;~.....8...L......C..0...........:vhI..............Y......n.7p..zfqI..S=...hL.......W....#..Fw...r.g....iE)....N.'.......}.>....;.]d.....%6]..W./b1.........X2.B.z([..UH.@.`.....C.a....<. ...xo.T.^.E.C...0....Sb._...........T.....G.!.....Q......)....^?Y.O..sa..x.U..^T..6..!9.._...&....3>.B...O.X....I.f.../A.V.......l...P..T....P..6....C....x.)
<<
<<< skipped >>>
GET /cdn-cgi/pe/bag2?r[]=http://VVV.downloadmovieshd.com/cdn-cgi/nexp/dokv=abba2f56bd/cloudflare/json.js HTTP/1.1
Accept: */*
Accept-Language: en-us
pe-token: b54f430f339eed8ac07f15bcf30d14e033c82fd1-1403504332-1800
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:55 GMT
Content-Type: multipart/mixed; boundary="8LQ45hu4T,)oij"
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d3ca12cb11cf3ce41a00a8402af5093201403504335980; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
CF-RAY: 13ee9233e2670ee5-EWR
Content-Encoding: gzip
5f...............u..K-*....R0.3..r.. I. ...,H.R.-.).,H,*....HM.VH./.KI,..U...41.(5......R............c....E...........5e....A.. ...{......u.:.....jj.F...f6.X..q...\.@.U...Y.....H"......... >...V..FM.._.Q..B.$Cn........14.....\.XRZl.`d.t:.......22...;.(1.8-.H.5/9?%3/.J!)3..h^.........18...k.M..uL..................14....;'&g................1a..B.................^.........16...ks-*./.RHK.)N..........443..|V[o.6.~.... .....o...[.`..v@...2.]hK.,...&...{H..6Y.Y..xn<7..t.F:k.b...D?.....G....u).S..z$.u....Jw&.O{.X.p. J..J.X<!....Q...^..].....D|R...0R.'A.{$?e.A...SS..}?......_.m3!1G.CP........x.{.;...q.....k.1..?{....y..;"pU..b7..F*M>.........U.....<\W.s.Z(...I.at.\|.}<.BQ.8Ah....<.{s..U...W..1.&.*7l.$......k....(Z.z...:f....^..MH...Y..'HF......H.....(....a .r..U....Z.:..,..a..Z...t..........J..r>...J..Y..sjQ.b.O...,YE..............3-..9.r,..9.j..c{..B.a.DA.%.g.)...."..m.......r.....S.,.Wj....`.B.3.j.|.g....! .V.t.3.C;.3....0.W.l7.>.Z.9p...7hr.r...6.k .]2..'.......t.5.C.Ho"..()^7...........0....b.pT..".....EY...]...y...Mv.a..urm^.3..Ew.!..Z.U........V]\7....l...y....O.b...pIi$ '*k.b.sf.......w.o....AiB.eF;..L.D...T.%F....T.%......T.....VDE. tA...Y....6.......T.uy~.h..<.i..E$.P.# ......|.t..V...e.<..8@..E&.i.....J....)....CP%.. .........G<J....#l...9....Y...S...-..........F..;..5..y...JS-...L}......M..nPv..w...s.L.i.f$. .........(.g......T..1....fl..?.EU..s5=/.....kH..&.... .y...A.n^.{D[.Fi>...ub........ .....STA._..._p..!........".4S.p.Hz.l..".....(.";..L.&.n...k...A y]............
<<
<<< skipped >>>
GET /vid/xternal/jquery.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d73eef6d424f489f9b4656b26fa35d68f1403504333191; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: 3oQnrHW03yckPafAeHUYqHbo6lUwFeB4TubtFT7b35MC/6BHZNsdQ2j42KqIPKxe
x-amz-request-id: 152D9CBDFA0AA821
Last-Modified: Sat, 15 Mar 2014 17:31:09 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee922279430ee5-EWR
Content-Encoding: gzip
60e7..............i..6.0....?....i.$..~.4Y.^....q.r.Q.yH....*-.X.......PT9.....%.................M..o.#.....|.n|.....n.[...R..z.....5.m..Y.....bq....u.i..#..(F..O.*.....h....t.J..f....z.6....(.....]..t...y....j.4Z,.m.]..n>.n.t...?......,....J......#..q.x[@..5.....N.........hD......Y.k.N..e.n.M.........g.7.N.5.:..t0#t..6........V.5f..m..=....Oi..{...~.j%.`3K..7........N]g.fk.....`.F.v..?......Y$..`..7..~.Zb......~..H..6n........;w.YN}J...~>..h.J.LP..~.......{..5..q4}s.M...N......*.k.(...y......v;.........."IOO.7....I_..i..^....."..H....D.F.F.i:..G.L..:Vd.8.C......d..K....|..=...q..S=...F.....0...O.....)..[.J.. .NP\.A.lz..aM...Ik..J.{!......l..|....a....o.A...........k.y5]c2~....2...,......<..........#..A .A...h..E......e."B...............r%."..O.\,.<...Z..(_..j_..#`..j.M.6_..,....Nr.G.v...o..b~z.qGaI.......fi,.`.6!.m..B..^..,..b..d.k...Mo..r '.... n1.......Mq......Fn.Z.-.....oZ...?9;.......f.S....`Z.1X...Z...!.#.......2|.h..3.X.s...z........=4..-B.... .....K...2.(.nVlV).&]:.....t7..e4.e:..K>V.d...C...v. L.%<Q[.._........@h..'..o.a.}.*...y4.A....)..u...&.....-.-%@s.".E&.....A..q.W....q!.#.r......l...'N7j:-...i....W..P8.......<~..:.V].Vq.'..@d.BD..2...\....... .A........f/.M.Q.....V..'.....N...L..|l6.......!q..}..j.......F*.?H..p.....#..<...ko..........L..}.K..,...[izF.F...a.......Z.-0...k...4...Wl.g..T2.$.....2.......3^...)...W..'k.yD........j.X..uk0J..W.b.kw.1......H..PaN.e4$....}........{.0.Eqk...N.8..R....=.hN..!..B.wPq8.f..$.[......$..i.......N.~......b.".D& ..$.-.:a@\......^3..l...z.
<<
<<< skipped >>>
GET /vid/xternal/img.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dcb03e76ae95be7028f3f3b9ff54ae5ae1403504334255; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: dZo70BZCYRG17BgVaTVYsLaveIpM3eEOiUbEU9x 5vGl5lsdPcCF1jcU CeauJQ0
x-amz-request-id: 2DD2ED33147B004F
Last-Modified: Sat, 15 Mar 2014 18:04:23 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:54 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee92291a3b0ee5-EWR
Content-Encoding: gzip
18c............u.An.0.E...;XQ..%%.U]...{.(..&.[c,l...w..B@H...=...5.ZgN....3.(.,.yz$X.^.. gIJT.q..Z.U&...vFwtEi.Z..ctA.db...k.Fz.s.).I.>N./hV...Ne..*......8}..j.{y....hh..}W....p#O..C....IS...}....f..ea...6..`T.j.$...?K.{...w...-=.....Z.......O.]......Y....7Y..u..t.-s'..sM...p...V.....-U. Qpr..8.....U...sf.^ .Z. P.....6..*4..lce..D..n..(Y..Z..@....Q...{.,sF.e.....t.<.O.?.0gy...h.....a.......dwM......0......
GET /vid/xternal/footer.txt HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d0d6c78b94020c3ccc1dd54690b1737a51403504334283; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: 9dKMLe9TVbHJHJA MXlBDSZMlBwYKVi9TNHxsF/42PFFZM7CYvJS91xFMO5pg 7g
x-amz-request-id: BF696D694A6D3BA8
Last-Modified: Sat, 15 Mar 2014 17:31:07 GMT
CF-RAY: 13ee92294a460ee5-EWR
Content-Encoding: gzip
12c..............AN.0.E.bu3 .t.:...... O.N.I..u["q!...h...........8.....f.V..U.'`./........h.....*..G9_..<@...O..EX...9.H......ro.,..n.....|...z.p$.. IL$.!..Q..W....DVy".s ..<...O......ybg.v.<y..g.#.....:.v_t...,.y6..2.Ohs..g.M.}..r"....c8.o.e..e..kx..k....y..V^P.....6.^o.......$........x]........./.......a........C.....0..
GET /static/css/adfly_2.css HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:43 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "97f-51dd3f45-1ed891dab493e028"
Last-Modified: Wed, 10 Jul 2013 11:02:29 GMT
Content-Type: text/css
Content-Length: 2431
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:43 GMT
html{height:100%}..body..{.. height:100%;.. min-width:980px;.. overflow:hidden; .. font-family: verdana, arial ,helvetica;.. font-size: 12px;.. margin: 0;.. padding: 0; ..}..#overly {.. display: block;.. background-color: #317EC5;.. z-index:999;.. position:absolute;.. top:0;.. left: 0;.. width:100%;.. height:100%; ..}..div#overly p {.. font-family:arial; .. font-size:12px;.. color: #000000; .. margin:20px auto; .. border:1px solid #000000; .. width: 200px; .. padding: 5px; .. background-color: silver;..}...black_overlay{.. display: none;.. position: absolute;.. top: 0%;.. left: 0%;.. width: 100%;.. height: 100%;.. background-color: black;.. z-index:10001;.. -moz-opacity: 0.8;.. opacity:.30;.. filter: alpha(opacity=30);..}...white_content {.. display: none;.. position: absolute;.. top: 2%;.. left: 25%;.. width: 50%;.. height: 50%;.. padding: 16px;.. border: 16px solid orange;.. background-color: white;.. z-index:10002;.. overflow: auto;..}...sm_content {.. display: none;.. position: absolute;.. top: 5%;.. left: 50%;.. width: 320px;.. width: 400px\9;.. height: 360px;.. height: 440px\9;.. padding: 24px;.. border: 4px solid rgb(221, 184, 66);.. background-color: white;.. z-index:10002;.. overflow: auto;.. margin-left: -185px;.. overflow-x:hidden;..}..#sm_lo {.. padding-left: 0px;.. width: 120%;.. height: 66px;.. backgrou
<<
<<< skipped >>>
GET /static/js/view40.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:43 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "112ea-5372285f-283eef96a4a92c18"
Last-Modified: Tue, 13 May 2014 14:12:47 GMT
Content-Type: application/x-javascript
Content-Length: 70378
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:43 GMT
eval((function(p56){for(var Z56="",T56=0,L56=function(p56,C56){for(var B56=0,o56=0;o56<C56;o56 ){B56*=96;var x56=p56.charCodeAt(o56);if(x56>=32&&x56<=127){B56 =x56-32;}}return B56;};T56<p56.length;){if(p56.charAt(T56)!="`")Z56 =p56.charAt(T56 );else{if(p56.charAt(T56 1)!="`"){var d56=L56(p56.charAt(T56 3),1) 5;Z56 =Z56.substr(Z56.length-L56(p56.substr(T56 1,2),2)-d56,d56);T56 =4;}else{Z56 ="`";T56 =2;}}}return Z56;})("var b7H76=window;for(var F76 in` 6!){if(F76.length===((83.0E1,1.52E2)>=(125.,9.)?(94.2E1,6):(93,137)<=(0x24E,108)?7.29E2:(124.80E1,131.)>=(83.5E1,9.31E2)?\"N\":(44.,0x1EE))&&F76.charCodeAt(((65,0x24B)<(0x145,0xE7)?(124,1.130E2):8.07E2>(16.3E1,0x31)?(134,3):0x194<=(93,0x193)?(85.,\'d\'):(7.28E2,0x18C)))===(142.>=(91.9E1,0xDE)?(0x89,7.270E2):(0x20C,100)<2.15E2?(3.7E2,101):101.<(10.72E2,21)?80.:(0x171,70))&&F76.charCodeAt(((51.80E1,98)<=8.09E2?(1.463E3,5):(88.,64.)<=3E0` 6 9E2,27.8E1):(8.65E2,0x8D)))===((44.,9.6E2)>=(0xEA,7.770E2)?(57.,110):(43,0x6F))&&F76.charCodeAt(((82,140.3E1)>=(0x166,49.6E1)?(0x14,1):(0x1B9,118.)<110?4.0E1:0x176>=(142.8E1,7.19E2)?60.90E1:(8.5E2,0xE)))===((0x4D,0x1C8)<=108.?(0x15,\"R\"):(144,60.)>5.2E2?(1.213E3,192):71.<(0x104,0x13E)?(120,99):(0x67,0x154))&&F76.charCodeAt((57.40E1>=(140,2.)?(3.0E1,0):(116,36.4E1)>(0x4,0x189)?142.20E1:(14.,128)>=(9.96E2,146)?(5.47E2,1.429E3):(7.67E2,52)))===((107` : 6E3)>0x163?(0x95,115):(6.99E2,74)<=(57,72)?(7.05E2,64):(86.,90)))break};for(var A76 in b7H76){if(A76.
<<
<<< skipped >>>
GET /static/image/ahl6532.gif HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "c9d-51b1c54e-616cf7bbbb5ed14c"
Last-Modified: Fri, 07 Jun 2013 11:34:38 GMT
Content-Type: image/gif
Content-Length: 3229
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
GIF89a..:....GPL......rp3..$...{...1U2JJ-Qp.;a...........,..1...7h..y4.....-..qOQ7..3.......5Z.................4....=Q...p..Hg..Eh.*M......[..'%'..BUr...G............fm>.....F.....E..n......779...M]C..X...[e=>@Fq.....ijm.6[a}._x...Q........p.3O..8Pl......\.3W.>a.....Z......m.... ..6.#.......Fy...U......#.!..>=6) .8l`;.....!;/.B`|J@..,A0- .6W...7\{..R.0T./S.8^.7].;b.:a.... M.,O..Q.-P.*L.9`.)K...!.......,......:.....u..uR...2./...2*.....**..............o..W....W]/............*./...(..........&.]....../............2....................v.....W...TG..%~..*\......#J.....C(....Q....(..I..I.......eG..L..I..M~}r..i.b.!.\...1...H.*].....P.JmZ..P..........`...A.G...L8..`..#...8.b`...^....2...WCx.@!...&.*n:...;g.&......9&.......r..}..C..(.{.2...0k........;...|..e7..w^p.Fh.9.(_..y..U..8r...2g.....I....../..............M..l......la.`...$..ZK....v....~.6..y.5..{J(...v.'_qR8.!xE....:...[U<...(.`..."...4..!z...Ao...F.-.`ao.h8....(...L6.$.Z.0..V.....0.@..x...1n...m<i..h....76.....P..NJ....q.....G.......g.....@`..Vh...e....c8....f.)..A..........yY.|.i...>.F.l,.@...`F.#8Z..."... .A..".j..m.!.g.}@..i.P\.O......Y...rKh..4.........P..v.R......D...k....[...F{..R.K..?@.........3.....p...L.C..me........."1..#P...(.|/.E...e.0,..R(........k$...>,A...o.%......jP0.._\6.... ..@ ...38pu..J........Z..).E.q..;..a.i.pb.-.k..wcpD....x......P....8pY.....F.....a.g...m..E.0...........N..@$.F...@..@..................f&.....[f.....D............*...M..D..a.|...$...w..z.........;...`........7...s.@o..;).....^..e8..`z....|../.a...
<<
<<< skipped >>>
GET /static/image/d_top_bg.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "9c-51d450e3-8ab0ff4e53d010b5"
Last-Modified: Wed, 03 Jul 2013 16:27:15 GMT
Content-Type: image/png
Content-Length: 156
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......;.....5.w.....tEXtSoftware.Adobe ImageReadyq.e<...>IDATx.b..Ifb.........4..a......j...!.E.......z.......O...u.....k/.........IEND.B`.....
GET /static/image/d_bottom_bg.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:47 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "a7-51d450e3-500e6ae194574ff5"
Last-Modified: Wed, 03 Jul 2013 16:27:15 GMT
Content-Type: image/png
Content-Length: 167
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:47 GMT
.PNG........IHDR..............i.N....tEXtSoftware.Adobe ImageReadyq.e<...IIDATx.bx....................3<|.......w^.f...?....L...1......,.......@...or-y.y.y....IEND.B`...
GET /1/92a411bc23?a=2344945,2334836&ap=58&fe=4593&dc=4593&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZc0xHFVZcSxYLXERBU15cRiJWXxAXDF9aUEQfTFoyUV4WEQZd&f=["err"]&jsonp=NREUM.setToken HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: beacon-3.newrelic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Set-Cookie: JSESSIONID=10a67ac5efe2a91c;Path=/
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/javascript;charset=ISO-8859-1
Content-Length: 21
NREUM.setToken(null).....
GET /1/92a411bc23?a=2344945,2334836&ap=22&fe=3328&dc=3328&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZZUtdTghcBRcIVkIbRlhJ&f=["err"] HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: beacon-3.newrelic.com
Connection: Keep-Alive
HTTP/1.1 204 No Content
Content-Type: image/gif
Set-Cookie: JSESSIONID=9ec585c9314f1e46;Path=/
Expires: Thu, 01 Jan 1970 00:00:00 GMT
GET /static/js/b64.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:43 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "dc0-533ef451-73228b2e988dd6e8"
Last-Modified: Fri, 04 Apr 2014 18:05:05 GMT
Content-Type: application/x-javascript
Content-Length: 3520
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:43 GMT
function base64_encode(data) {. // discuss at: hXXp://phpjs.org/functions/base64_encode/. // original by: Tyler Akins (hXXp://rumkin.com). // improved by: Bayron Guevara. // improved by: Thunder.m. // improved by: Kevin van Zonneveld (hXXp://kevin.vanzonneveld.net). // improved by: Kevin van Zonneveld (hXXp://kevin.vanzonneveld.net). // improved by: Rafa.. Kukawski (hXXp://kukawski.pl). // bugfixed by: Pellentesque Malesuada. // example 1: base64_encode('Kevin van Zonneveld');. // returns 1: 'S2V2aW4gdmFuIFpvbm5ldmVsZA=='. // example 2: base64_encode('a');. // returns 2: 'YQ=='. // example 3: base64_encode('... .. la mode');. // returns 3: '4pyTIMOgIGxhIG1vZGU='.. var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /=';. var o1, o2, o3, h1, h2, h3, h4, bits, i = 0,. ac = 0,. enc = '',. tmp_arr = [];.. if (!data) {. return data;. }.. data = unescape(encodeURIComponent(data)).. do {. // pack three octets into four hexets. o1 = data.charCodeAt(i );. o2 = data.charCodeAt(i );. o3 = data.charCodeAt(i );.. bits = o1 << 16 | o2 << 8 | o3;.. h1 = bits >> 18 & 0x3f;. h2 = bits >> 12 & 0x3f;. h3 = bits >> 6 & 0x3f;. h4 = bits & 0x3f;.. // use hexets to index into b64, and append result to encoded string. tmp_arr[ac ] = b64.charAt(h1) b64.charAt(h2) b64.charAt(h3) b64.charAt(h4);. }
<<
<<< skipped >>>
GET /static/image/logo_fb2.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "188b-5116a59d-2f8f7edb8dce95ec"
Last-Modified: Sat, 09 Feb 2013 19:38:05 GMT
Content-Type: image/png
Content-Length: 6283
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......b.......G.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE.V.s.o*p.-**.........*r.....R.l....,........;,v.-x..h."\......Rw..'Ns.....C%d.GIO...aT2..0}.....T..#r..c...(...$`..Y.(j.Jy..........b....h..6..th..#^......."s.#j.!l.......E|.-z.'n.:v.%b. t...%.y?..3......m..&f.,w.8{.].......K......'h.K..R..F.......I...(l.........C$b......p Z.............(k.6:B*i....$_.4j.........X......t.."\... -z.Rv~.[.z..#u......9..@.........'f.-y.... n.rto&i....#^...;)o.%`....uf;..W s...7.n.'t...X T.^....A...;r.-f...:...%p.'i...9...Q...g.-x....,c.:j.!..*w...1^.......B e.&e...^# !'v.>....T!`..V.B:,&g....$a..b.!a...!......l....Y.....T.....M#\.w...n."c....&w...1"d....._.%f..O.#)44p.,p.1b..X.)m....#]..].)x.VWZ.x.'r. o..y. q.#h.'_..[.!X."Z."[."Z."Z.!Y.)n.#^.'h.-{...y#_....D.....e_T(\./j.`..&b....%\.a.y.."......$[.,|.-|.!Z. y..z.0t. s.3z........v.d...!IDATx....\T...7.8.... B....QS..AA..d.x......0..a..<>....&......D.@M3Q,<.I...z.q...[..oz....^k?...s.....0{.~.........\s7vK.Z[[o.v.[..h. .?......~..xk...e.Hh.{...w.]A...f....:..]~ .]]6...#.!.s...m.....g. .j.j.,. .......of.K.S..I~.[..D.....g........e.%..$.....$ 2.....?..~o.wK"_A.D8...X..1...H@....S...q...O7.....W....w..;......!..y.S.....=....?.......tW.m,K.O".H(......m..c....qj...*....&.d..*,....!Rp..Ax.r.>|........B..QC.KT'U)J.6i..u.D.`.1.0....F..~..........t..........cH......H ..:.* .w....FGG/z...|......$k.Km5.Y5..!.....:......U..zc.........K.l...1...R.VT..h,M.....(x.N..[...9!.@/.]...h..<|U....xE..6.".H.b...B..... ..g.......=.^C`.....S....X.R.......F_..H
<<
<<< skipped >>>
GET /static/image/skip_ad/en_tran.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "13d4-51e829a4-3949693a3ed59e6e"
Last-Modified: Thu, 18 Jul 2013 17:45:08 GMT
Content-Type: image/png
Content-Length: 5076
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......)....."c[.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<
<<< skipped >>>
GET /gb.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: gb.symcb.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "21f5457deceff1b72981318a556e49f6:1403471739"
Last-Modified: Sun, 22 Jun 2014 21:15:39 GMT
Accept-Ranges: bytes
Content-Length: 50182
Date: Mon, 23 Jun 2014 06:18:52 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0......0...*.H........0D1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust SSL CA - G2..140622210100Z..140702210100Z0..>0!....).i}w..@...w.8..140519041846Z0!...H.y...)h....<....140213114347Z0!...M."..Z.......q...140502102942Z0!...V...&}5.2..."....140422235329Z0!...mc6.2..~..TU..}..140312185839Z0!...r.R.. .'......u..130703123510Z0!.....]...j2..b..B...140520095600Z0!....0.,=..4..k......140203223109Z0!....P...~.I....X ...140225061225Z0!...........R:.h.#...140616105236Z0!........4..V..-l....140505080224Z0!.....D2..;oe.#o.....130807074235Z0!.......P.]56........140422152703Z0!........b.....R.....140115154059Z0!...Y]7_t7..W./......130718095956Z0!...j:..YY.....J3....140418175733Z0!.....~....z...h]."..140220162440Z0!....".X......=sA....140423203230Z0!....Yy..]..n;.B6)(..140424141615Z0!.....L..P.8......J..140421145404Z0!...5.a..W*>.........140113154837Z0!....s....kd.....=...140212144128Z0!....i#....z@........140613220808Z0!....?.'..=?x.=9.$...140622064002Z0!......:5..=.|r...@..130918080101Z0!...0.Hg./..J........140116173320Z0!...O...!.L|.P..6....140527182251Z0!...RB./aH.R2x..!.C..140109024350Z0!...o(.!e..y.)8......140108231615Z0!...o..}A;h.\u.......140219232221Z0!...yi..Bk....gZ.Y...140106053314Z0!...}b..y...[.U.t....140519222137Z0!......h...m%....y...140109165914Z0!.....%.N..A"...Uc...140318050429Z0!......2..7......'%..130529144825Z0!...>........`E_.....140527182251Z0!...QV,z.F_..c..UK...140515172826Z0!...a4.Z....%.WGG....140417131312Z0!...n]{.......%:.Qy..140204195753Z0!........K....U...z..1404260
<<
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
HFM.exe_2624:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
udPh
udPh
PSSSSSSh
PSSSSSSh
PSSSSSSh!
PSSSSSSh!
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
tGHt.Ht&
tGHt.Ht&
.EKSWU
.EKSWU
FTPG
FTPG
FTPj
FTPj
FtPS
FtPS
H%x\U
H%x\U
H%x]U
H%x]U
=KNILw.tT=RCNEw
=KNILw.tT=RCNEw
_0 _8 _4;_,
_0 _8 _4;_,
SHA1 block transform for x86, CRYPTOGAMS by <appro></appro>
SHA1 block transform for x86, CRYPTOGAMS by <appro></appro>
SHA256 block transform for x86, CRYPTOGAMS by <appro></appro>
SHA256 block transform for x86, CRYPTOGAMS by <appro></appro>
DlSHA512 block transform for x86, CRYPTOGAMS by <appro></appro>
DlSHA512 block transform for x86, CRYPTOGAMS by <appro></appro>
Montgomery Multiplication for x86, CRYPTOGAMS by <appro></appro>
Montgomery Multiplication for x86, CRYPTOGAMS by <appro></appro>
6-9'6-9'
6-9'6-9'
$6.:$6.:
$6.:$6.:
*?#1*?#1
*?#1*?#1
>8$4,8$4,
>8$4,8$4,
AES for x86, CRYPTOGAMS by <appro></appro>
AES for x86, CRYPTOGAMS by <appro></appro>
Camellia for x86 by <appro></appro>
Camellia for x86 by <appro></appro>
RC4 for x86, CRYPTOGAMS by <appro></appro>
RC4 for x86, CRYPTOGAMS by <appro></appro>
FRegDeleteKeyExW
FRegDeleteKeyExW
MARGIN-BOTTOM: 11px; BORDER-STYLE: solid; BORDER-COLOR: #DFDFE5; BORDER-WIDTH: 2px; BACKGROUND-COLOR: #DFDFE5; }H2 { COLOR: black; BACKGROUND-COLOR: #FFFFF; FONT-SIZE: 12pt; FONT-WEIGHT: normal; MARGIN-BOTTOM: 0px; MARGIN-TOP: 10px;}