HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.FAkeAlert.105 (B) (Emsisoft), Gen:Variant.FAkeAlert.105 (AdAware), GenericEmailWorm.YR, TrojanVobfusVB.YR (Lavasoft MAS)Behaviour: Trojan, Worm, EmailWorm
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 80f39c23c0864b8c36c60bc32d5a63c6
SHA1: 971736554edac908976fcfc5601af976d04c96ee
SHA256: 71e1997a0cf4769f782ba1fc8369d2b6b462ff77badfac513cb16602a7ec7276
SSDeep: 49152:4VL4NybWENEZY9vigH03SubpAb1k7GeATqEuckPbM:uL4N53ZY9LHq39Ab2eOhzM
Size: 2150912 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-01-12 23:04:25
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
EmailWorm | Worm can send e-mails. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:2756
hotrolb.exe:1844
hotro.exe:3160
H_LOADER.EXE:2500
hotromaster.exe:1040
The Trojan injects its code into the following process(es):
HFM.exe:2624
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:2756 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\H_LOADER.EXE (126 bytes)
%WinDir%\FSWKLY\HFM.01 (81 bytes)
%WinDir%\FSWKLY\HFM.00 (1 bytes)
%WinDir%\FSWKLY\HFM.exe (15801 bytes)
%WinDir%\FSWKLY\HFM.02 (56 bytes)
The process hotrolb.exe:1844 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\httpErrorPagesScripts[1] (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\navcancl[1] (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\info_48[1] (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\background_gradient[1] (453 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bullet[1] (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\rent[1].txt (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\errorPageStrings[1] (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\ErrorPageTemplate[1] (2 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (0 bytes)
The process hotro.exe:3160 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\b64[1].js (145 bytes)
%Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (1254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\92a411bc23[1] (21 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A574ED5927B3CEC9626151D220C7448 (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ahl6532[1].gif (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\ga[1].js (22035 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\adfly_2[1].css (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery[1].js (38959 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\rent[1].txt (153 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\1market[1].htm (768 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\CC61097B94A0A007D678F95504798376 (140 bytes)
%Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (1254 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\kjuwM[1].htm (1382 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\view40[1].js (31873 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\96D7A99548C36B10D2E8035A3E0DCA1A (7972 bytes)
%Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (952 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\CC61097B94A0A007D678F95504798376 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\logo_fb2[1].png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\logo[1].png (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\cloudflare.min[1].js (24826 bytes)
%Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (92 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A574ED5927B3CEC9626151D220C7448 (871 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\96D7A99548C36B10D2E8035A3E0DCA1A (244 bytes)
%Documents and Settings%\%current user%\Cookies\LFO58N91.txt (83 bytes)
%Documents and Settings%\%current user%\Cookies\XWUC2JM3.txt (273 bytes)
%Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (686 bytes)
%Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (276 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F (176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\nr-411.min[1].js (4323 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\C6D6MG1D\www.downloadmovieshd[1].xml (13 bytes)
%Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (510 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\D4F348B882DF3F205ECCB6243795CB3A (200 bytes)
%Documents and Settings%\%current user%\Cookies\11D1YS36.txt (125 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F (533 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\footer[1].txt (579 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\42[1].htm (875 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\d_bottom_bg[1].png (167 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D (200 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\23B523C9E7746F715D33C6527C18EB9D (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\en_tran[1].png (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\d_top_bg[1].png (156 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\D4F348B882DF3F205ECCB6243795CB3A (554 bytes)
%Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (1248 bytes)
%Documents and Settings%\%current user%\Cookies\JA35W949.txt (1248 bytes)
%Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (1102 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\external[1].js (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\img[1].js (764 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\bag2[1] (837 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\style[1].css (1762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\jquery.min[1].js (57770 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\aa75b70072b3d2c372e725db858e1e89[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Q97FLGTK.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\WKQPJ647.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\FBFQC18A.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Z9NOM951.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\ABCEXIJM.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\pixel[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\QWD6KJBU.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\OW0BQYUD.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\HVIFFA6M.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\XH47U5AY.txt (0 bytes)
The process H_LOADER.EXE:2500 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%System%\hotro.exe (32 bytes)
%System%\hotrolb.exe (32 bytes)
%System%\hotromaster.exe (24 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\~DFA24D.tmp (0 bytes)
The process HFM.exe:2624 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\All Users\Application Data\XFH\HFM.004 (1170 bytes)
Registry activity
The process %original file name%.exe:2756 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 A1 3D 40 D7 DC 3B 40 05 27 4B 42 AC 3B 28 91"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%WinDir%\FSWKLY]
"HFM.exe" = "HFM"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\c:]
"H_LOADER.exe" = "H_LOADER"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Personal" = "%Documents and Settings%\%current user%\My Documents"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
The process hotrolb.exe:1844 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3D 26 7E 81 B0 79 68 12 AC 7F 62 3F 34 F3 00 C4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 01 00 00 00 00 00 00 00"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process hotro.exe:3160 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 AA F8 DF 70 A9 5C 0F D9 94 D7 06 8D B3 01 F7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1398452974"
"Name" = "hotro.exe"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
"IntranetName" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process H_LOADER.EXE:2500 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 3D A3 9E A4 F8 65 5E 34 AD 52 25 07 FC CF D6"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"hotro" = "C:\Windows\System32\hotro.exe"
"hotromaster" = "C:\Windows\System32\hotromaster.exe"
The process hotromaster.exe:1040 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "89 AF 09 E8 49 D5 D0 7A 55 A8 D4 FF C9 A6 58 9A"
The process HFM.exe:2624 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "71 8F BB 6B DA 45 E0 CE 72 69 CF 1D 57 34 D3 50"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HFM Start" = "%WinDir%\FSWKLY\HFM.exe"
Dropped PE files
MD5 | File path |
---|---|
140c898473524303a63d1b5711ed9318 | c:\H_LOADER.EXE |
7059cdba57a398f80a9afd3de0ffbd07 | c:\WINDOWS\FSWKLY\HFM.01 |
def249d7a5f5aa0ae0caf1d3b9700171 | c:\WINDOWS\FSWKLY\HFM.02 |
3d09e558be6c81f8e5fdde46888944d6 | c:\WINDOWS\FSWKLY\HFM.exe |
d6b2bff6198642950f1bcf491131a38f | c:\WINDOWS\system32\hotro.exe |
e30b602e465fac39a59485dee86db375 | c:\WINDOWS\system32\hotrolb.exe |
bcf7e6fd8b994f3f9a6e23324a4bec6b | c:\WINDOWS\system32\hotromaster.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 40340 | 40448 | 4.79593 | 81e45a5c05115536674bbb4173bba1a8 |
.rdata | 45056 | 9232 | 9728 | 3.72834 | 02fe36e76de5cc9f834ba0e75c9a5052 |
.data | 57344 | 8032 | 3584 | 1.58991 | d4668da877d58af66239b78e3837253f |
.rsrc | 65536 | 2090928 | 2091008 | 5.31858 | 4a044b790cff0618b49d079f2b4871cf |
.reloc | 2158592 | 4752 | 5120 | 2.51801 | c1c353bf28dd868ed81faaad547dfa87 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl | |
hxxp://e6845.ce.akamaiedge.net/crls/gtglobal.crl | |
hxxp://www3.l.google.com/GIAG2.crl | |
hxxp://adf.ly/kjuwM | 69.65.39.16 |
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.7.1/jquery.min.js | |
hxxp://cdn.adf.ly/static/css/adfly_2.css | 66.55.92.34 |
hxxp://cdn.adf.ly/static/js/b64.js | 66.55.92.34 |
hxxp://cdn.adf.ly/static/js/view40.js | 66.55.92.34 |
hxxp://cdn.adf.ly/static/image/logo_fb2.png | 66.55.92.34 |
hxxp://cdn.adf.ly/static/image/ahl6532.gif | 66.55.92.34 |
hxxp://www3.l.google.com/ga.js | |
hxxp://cdn.adf.ly/static/image/d_top_bg.png | 66.55.92.34 |
hxxp://cdn.adf.ly/static/image/skip_ad/en_tran.png | 66.55.92.34 |
hxxp://cdn.adf.ly/static/image/d_bottom_bg.png | 66.55.92.34 |
hxxp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei= | 69.65.39.16 |
hxxp://c.global-ssl.fastly.net/nr-411.min.js | |
hxxp://www.downloadmovieshd.com/vid/42/?did=267 | 108.162.196.83 |
hxxp://beacon-3.newrelic.com/1/92a411bc23?a=2344945,2334836&ap=58&fe=4593&dc=4593&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZc0xHFVZcSxYLXERBU15cRiJWXxAXDF9aUEQfTFoyUV4WEQZd&f=["err"]&jsonp=NREUM.setToken | 50.31.164.176 |
hxxp://e6845.ce.akamaiedge.net/gb.crl | |
hxxp://www.downloadmovieshd.com/vid/xternal/jquery.js | 108.162.196.83 |
hxxp://www.downloadmovieshd.com/vid/42/style.css | 108.162.196.83 |
hxxp://www.downloadmovieshd.com/vid/xternal/external.js | 108.162.196.83 |
hxxp://www.downloadmovieshd.com/vid/xternal/img.js | 108.162.196.83 |
hxxp://www.downloadmovieshd.com/vid/42/img/logo.png | 108.162.196.83 |
hxxp://www.downloadmovieshd.com/vid/xternal/footer.txt | 108.162.196.83 |
hxxp://ajax.cloudflare.com.cdn.cloudflare.net/cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js | 198.41.212.126 |
hxxp://beacon-3.newrelic.com/1/92a411bc23?a=2344945,2334836&ap=22&fe=3328&dc=3328&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZZUtdTghcBRcIVkIbRlhJ&f=["err"] | 50.31.164.176 |
hxxp://lp.sharelive.net/pixel.php?sysid=406&appid=267&subid= | 94.31.0.27 |
hxxp://www.downloadmovieshd.com/cdn-cgi/pe/bag2?r[]=http://www.downloadmovieshd.com/cdn-cgi/nexp/dokv=abba2f56bd/cloudflare/json.js | 108.162.196.83 |
hxxp://adf.ly/callback/aa75b70072b3d2c372e725db858e1e89 | 69.65.39.16 |
hxxp://ajax.cloudflare.com/cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js | 198.41.212.126 |
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js | 74.125.22.95 |
hxxp://crl.geotrust.com/crls/secureca.crl | 23.9.117.163 |
hxxp://js-agent.newrelic.com/nr-411.min.js | 199.27.76.175 |
hxxp://www.google-analytics.com/ga.js | 173.194.43.41 |
hxxp://crl.geotrust.com/crls/gtglobal.crl | 23.9.117.163 |
hxxp://gb.symcb.com/gb.crl | 23.9.117.163 |
hxxp://pki.google.com/GIAG2.crl | 173.194.43.34 |
bam.nr-data.net | 50.31.164.166 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /nr-411.min.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: js-agent.newrelic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
x-amz-id-2: PbUwlD/woEsn5A wHJLD5wSZTT ecr/JvfmtHoS VfiTf1WrDhpGpES0hvZCyTz2
x-amz-request-id: B86B72DCB2E45219
Cache-Control: public, max-age=315360000
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Last-Modified: Thu, 01 May 2014 23:15:58 GMT
ETag: "9050946217be03f42647b3f708ef10d3"
Content-Type: application/javascript
Server: AmazonS3
Content-Encoding: gzip
Content-Length: 5773
Accept-Ranges: bytes
Date: Mon, 23 Jun 2014 06:18:52 GMT
Via: 1.1 varnish
Age: 1325392
Connection: keep-alive
X-Served-By: cache-jfk1024-JFK
X-Cache: HIT
X-Cache-Hits: 16639957
X-Timer: S1403504332.030173302,VS0,VE0
Vary: Accept-Encoding
...........[mw.6....B..*....8NB.V.4......fv?Hj.M....TA..G.............I../.....Y\f.J.......V.=.(...$v..L-L)...@.J.UM...........|/..e"E....P.../])T).^...F...U]n..J..{...{ e...&..\..$.z.<*S......}..=a........\.......u6Z.. M.`hA.^.0..}.p....."".|.{.....=....TU.>.~f....<.G..F.S.-.j....v|.,......{.6....&.............I.D&$K..G.Z.qz...?...........7.....4.w.'Qo....~./....G.v...Mg.b.s..o...6 ......m.*?...@...S.....d..J&a..0.........'0...a^f..a.1...?.1Z............n....N.......4...P.u..w...E^....Col...Q1.1..-Px...V...F....<.A1.LU.Q.6.Se.....-..~.n.G..m.d ..SP.d..g.....&.x0'..4...fr.. .\.........H.B..5..H..2M.....rf~....;.D#.....)Z....0...2..T......!.T.7...p)..d-..(.U[.,4O.J.#l..0.........S..a.....R....c...^r...2.....<.}...4B.-T.....>...@.K.7...r;.W.x....D..S"VoW...lA. ..g...\*O..2Oda.......|..3....J.I.P8)$.H.*.R..,4...{$.........nE...a.&..=..oy.9.....k.x.....U....$.&A]..lAF%......k....&iX..>).d.,..hRVX.9....;...p.)..S.............l.Z.9s.....0RVyG..<..*...e.....l a.<..=.,..[.....a..>...JT...[./.t5B.K]w..g...(M.......1D9l.W..{bS...........v..l...X...^.e..J.......'...^Y.,.....{....Z...2...E.m....].zj......x....2M.......<,.`.a(....T... B.l.^.....xP.......f.!4t=.].=...Fd..U.F.9......F~...bb..v...vR.V.0..|x'.0.....R...Z..!Iw.u...([.s....U..r..|..)...t.M.1..aw.}..H..C9Nd....`.vq...H.y.u.E.A.(_..3E...../H..0v.~.X..^P-Rbh<..^...v...%`c.C0c..].W..7V.h5 .........vP..e..mhY............5..7..o$....V...Kl.....:-...o*..hCc......A......-...\......0,...;........3[..q.l....b.......]x.Yp.,.F..?.ES.[....F
<<
<<< skipped >>>
GET /cdn-cgi/nexp/dokv=97fb4d042e/cloudflare.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: ajax.cloudflare.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d3c65f5ca903574506465ce0de483f7581403504334321; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.cloudflare.com; HttpOnly
Expires: Tue, 23 Jun 2015 06:18:54 GMT
Cache-Control: public, max-age=31536000
CF-RAY: 13ee922980210785-EWR
Content-Encoding: gzip
d3d.............Yms.6..._!..LT0-.i...h.......&.M..e@..(Q.LR.]K.....&[i.f..Er.X,.....g_w;.q.._.2...?.xCo...a.;..]g.m..`..3x6:?.......g_ug.D.Q........(W..h.v.b...(...(..:..L..,.$.....O.v....W.^......,.l...,.\.e...w.m9:...LCh..d.z.e:t._J.u..WHn>.t..\HO.2.......72...~..p......-...h..m...5.o.Bg72.$D...g|A...b.zi.....E....Ta<....r.>...."......"-.6...Anh.6..'.......n.xs]..._.}....Z...:l2.r.^.iY...N^...a<...f..(.u....Q......@C....h..Dy.....-...<v......#..S...L....g.z.....?<.....G....N..E..n. .....!c0_.E1...{h.@8.$..(..w...'...=..Z....._...y.N...k..axu...{.Dg..A....p..t....4CY.B1....)-.8U.H...,.GIm.....!T....3......N..km......q.....<..u.vs.okOz..y....UW.X#..1..n....H.`,p..@.b..H7?g.F......X'.b.b...^..f..\...;`.K..f./......Kq............A..!.X.... ...5#....\....S..L....Gg....9.x.. ....=..vn..\....i..D..w..H.....P%pD..Q..1....s^.Y...M.......@.....8C...p.-4.d.;.T.....,..z.E.G........f$I.'...)_........-...u.......i ..u:..s...J.h.|...C_.u.....q....,.w.....F...~.\.LO......N {.F..l.|E.3...5.&..r.W?..B.;.Bf..AK.....T.q&bW5H.?...0...FH...J..hVym.......%!s.....9yZ..s..\2.4.[....!_......*g.........%.*.4........*..k.."...^........G.bQ.....Q..... ....#......c........v8\..Z.#.].H..GPh.#R..u.rC}K.Y.s.....\2...ZtC......9..l..L..AZ..j/.X...'..>#..$S.a...>.H....ee...^.P....6..\....b.XXUV.ND:;.......'..\.mQs..p..;.c7.../.[......FW...V.....=.m..3..h..>s.d[6..g....>.!..Vk...g|...U6.|..5D....SG.v.y.e........D....K.B...KZP.....w.G.....z4._j$.........l..-..N..^......u..*.G.J.1&..B.U.H..f..'.i..2LT.&....cR...hC.
<<
<<< skipped >>>
GET /crls/secureca.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.geotrust.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "f04c0433daabadaa78dc278baacbcdd8:1403502613"
Last-Modified: Mon, 23 Jun 2014 05:50:13 GMT
Accept-Ranges: bytes
Content-Length: 1780
Date: Mon, 23 Jun 2014 06:18:40 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0..Y0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..140623054300Z..140703054300Z0...0.....&..120627171036Z0........140521155053Z0.....-..140617185011Z0........120627171058Z0....``..120627171034Z0.....3..020515130611Z0....j...140226123519Z0........120627171039Z0........120627171002Z0........120627171038Z0....i...120627171035Z0........100301134531Z0........100623141752Z0........120627171026Z0.....)..140617185515Z0........120627171025Z0........120627171050Z0.....#..140606204021Z0....S...120627170949Z0....H...120627171011Z0........120627171026Z0....._..120627171036Z0........140618143145Z0....7...140416231149Z0....%...020514181157Z0........140605215230Z0........120627171058Z0........140618224415Z0....x...140507204001Z0....}...120627170911Z0.....8..120627171035Z0....."..120627171030Z0....]E..140618144819Z0........140429180917Z0........100729164439Z0....x...130924204342Z0....M\..140430000442Z0.....D..120627171051Z0.....N..100623141726Z0....X...140427081922Z0........120627171036Z0....7...120627171052Z0..../(..120627171032Z0....zo..120627171025Z0....v...140618150003Z0........120627171039Z0........120627171031Z0....*...120627171032Z0........100729164732Z0........120627171017Z0........120627171028Z0........120627171030Z0........120627171031Z0........140618143256Z0........120627171028Z0........120627171029Z0....hA..120627171034Z0....~...120627171035Z0........120627171003Z0.....$..120627171037Z0....x=..120627171055Z0........140416233935Z0....t6..140425041720Z0....S...1404
<<
<<< skipped >>>
GET /crls/gtglobal.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.geotrust.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "3af1227a9006c319b97222bd604d8385:1403503211"
Last-Modified: Mon, 23 Jun 2014 06:00:11 GMT
Accept-Ranges: bytes
Content-Length: 554
Date: Mon, 23 Jun 2014 06:18:40 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0..&0...0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..140623054300Z..140703054300Z0..0....4...031011141952Z0....5...060809140549Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....6k..070711055050Z0....4Z..020521134804Z0...*.H................/.7.`.r....w.}#4.....).O.F..=...j....3..05...}.lG....6..s.%3.9..R......#@@.nw.N..n...SJj... h.F.\........*.dd.w.L..ae...)-.K)..p.r..P.J.....`....t...Uf.4.9.....8).....`.h...O.......c.....x..39....b]....VVIT[.....x..u.....8........Asm.2...m|8....|.......HTTP/1.1 200 OK..Server: Apache..ETag: "3af1227a9006c319b97222bd604d8385:1403503211"..Last-Modified: Mon, 23 Jun 2014 06:00:11 GMT..Accept-Ranges: bytes..Content-Length: 554..Date: Mon, 23 Jun 2014 06:18:40 GMT..Connection: keep-alive..Content-Type: application/pkix-crl..0..&0...0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA..140623054300Z..140703054300Z0..0....4...031011141952Z0....5...060809140549Z0....4]..020522080843Z0....4\..020522080900Z0....5Y..050722125926Z0....6k..070711055050Z0....4Z..020521134804Z0...*.H................/.7.`.r....w.}#4.....).O.F..=...j....3..05...}.lG....6..s.%3.9..R......#@@.nw.N..n...SJj... h.F.\........*.dd.w.L..ae...)-.K)..p.r..P.J.....`....t...Uf.4.9.....8).....`.h...O.......c.....x..39....b]....VVIT[.....x..u.....8........Asm.2...m|8....|.........
<<
<<< skipped >>>
GET /GIAG2.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: pki.google.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Mon, 23 Jun 2014 02:48:44 GMT
Date: Mon, 23 Jun 2014 06:11:54 GMT
Expires: Mon, 23 Jun 2014 07:11:54 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 871
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 407
Alternate-Protocol: 80:quic
0..c0..K...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..140623010004Z..140703010004Z0...0'..@..q.S....130910151922Z0.0...U.......0'..@ .*..)v..131112093101Z0.0...U.......0'....&..E.@..140411093120Z0.0...U.......0'..h.x../ ...130913110309Z0.0...U.......0'..5..[......130927105255Z0.0...U.......0'....).(_.I..131028093755Z0.0...U.......0'..x.%,......140522102708Z0.0...U.......0'....f.'..{..130910150931Z0.0...U.......0'..O..D..."..140407142442Z0.0...U.......0'....!.jD.E..130612174206Z0.0...U........00.0...U.#..0...J......h.v....b..Z./0...U........0...*.H.............lV..^"......\.J...}..j..<..\7."tP..l......k......1.3..].YCz5..V.g7f\.....f..9... ...i.......8*..Y....q.&=...2Vt.2....<k?....}fZ.c.o.Q..4..c.......v....n..C....`.... .....N..E..X...1J.%..|....):../S...Q..m9b.`.7..Z...K.t..y.|GQ..4=.{.Q.\.....^9..Rp...M_..|.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Mon, 23 Jun 2014 02:48:44 GMT..Date: Mon, 23 Jun 2014 06:11:54 GMT..Expires: Mon, 23 Jun 2014 07:11:54 GMT..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 871..X-XSS-Protection: 1; mode=block..Cache-Control: public, max-age=3600..Age: 407..Alternate-Protocol: 80:quic..0..c0..K...0...*.H........0I1.0...U....US1.0...U....Google Inc1%0#..U....Google Internet Authority G2..140623010004Z..140703010004Z0...0'..@..q.S....130910151922Z0.0...U.......0'..@ .*..)v..131112093101Z0.0...U.......0'....&..E.@..140411093120Z0.0...U.......0'..h.x../ ...130913110309Z0.0...U.......0'..5..
<<
<<< skipped >>>
GET /pixel.php?sysid=406&appid=267&subid= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: lp.sharelive.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:55 GMT
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Last-Modified: Mon, 23 Jun 2014 06:18:55 GMT
X-Server: web1
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
X-Stat-Server: web1
Content-Length: 21
Keep-Alive: timeout=7, max=1000
Connection: Keep-Alive
..........3............
GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 01:06:01 GMT
Expires: Mon, 23 Jun 2014 13:06:01 GMT
Last-Modified: Thu, 29 May 2014 22:33:33 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 15836
Age: 18769
Cache-Control: public, max-age=43200
Alternate-Protocol: 80:quic
...........}kW.:..w~....c...pk..f.....ZhiI..dY.iB.b.KI.o.gF.-'..9....nbyF..h4...../....z..|..y .b../......A_.S.....w......$2=.\..8e..:.G..]..<.b....M_7.,.I...{..t<./s....x...,...(r4...8W|&N._K...M...p.\9...'.I.._.Jz.!.6.....8........P...F.......]H...-..!.M.t...?..6..5O..1..p0..7.n$y*.z..Z...".W .8XE.....z.a....`.n....t....v.u..6.....A:H...=..z.....!...5.u ...........9..d.@1.....B.o.......K......p(;. ... W#.M..4.0.u|.8..{..5...v.T.....5.@)..M..wr.....A>.v..%w..C.B..,Wjj8......j.r./.Y..RI.6.(........T....Dq......Al...b...:.r.........}1.C...ZYv..y.r.=d^.....T....L.U(.2 ...`..5......8.tD=..........c.#u.h...-..yu.....r..?D....j.JQa.T.....f...G.q?r....7_llo>..@....].n;...e.oU_@.8_.@.......#.V.....@G.8vG...~.UL&...,X.a.Gl...C..c....W........i..2....w.V.{S...T(w..KF........1.".......V..N.J V.y...K.....4.... .W...Y.......k$...r...P..H.J.^.......|... .w...D@PF.a..,|\AH`..._..k. x...A...d$.X.~.H|.3..w>.@M"...s....1..Yi.#..G.........tO....v...1...{k.......np...8y...Aa....V1.UvB...UJ.q.YC.=.W....1..Yns....s.8.....}..}.0h:......[.Q...B....S.4@.R.}.(..Z.%..q....=Q.$HD....|.[Yq5A..rR.|.r...A....,....^.3.w...4.:..3.=...>.Z_.A?2X.W..vl...Y.Q].....`VUv......9.R%<.k)..POLv..rm..Gc._j.cr/...yBjJ....:7....'....uQ.7.W..0s/K...|..*bY...&...peE.50.......&...T)-.-.)......A.."....aK...M.#.Y..... Js......ns.......V....F;Q....0.P..S.L..l...B..&...nfX3d.....Z....5...6... :.[.{.".!.7*.0...ylO..N...n ....r.M .q..j@C........5..-..]W.u..D...m..J.5k..nT...t!...._..=..G.Y..^Y..f..]...d.N^....9....m1-0..`K.uB..R.MB.......%.!.
<<
<<< skipped >>>
GET /vid/42/?did=267 HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:52 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=ddc3489bb4baff32a5a4989683945a0451403504332170; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: z/LE5Kc7y0Eo17Fs3FiaSQ81qy8m35nsZeJmLCTSjeJAuoI8T5Wp1hAvVwUpADfr
x-amz-request-id: 118FF19D7BB78C88
Last-Modified: Thu, 12 Jun 2014 06:14:16 GMT
CF-RAY: 13ee921c187b0ee5-EWR
Content-Encoding: gzip
17b...............N.0...H..0w.[q..I..H ......h.i....{..o....h9!l..x...h..b.s^<=.@........9.P...\.E.......&...^.`..N[.n...f.~W..:.]..W......$.q ..)W....Y6..7.....d:...A..kH*A/;..q.:&..8l......zV....Z.@..x-..T..qd......h......q..).qA....FW.z1..G....K...G......0CYI...Jo.|*....O../s.R.L>u|..#.....L.......".i...7N|:6lif.foV.h;g[..{.bg}....Y....P.......u.5.......Y{."}.c}6.v...iy.W={.......251...U]o.0.}.R....B.%.Utj.y..:..&.=..8..Hl.$0T..wm'!.2M..$.......\^\yq).1................"....8..RzC.....' 4=c..RNuSl....7.z~M.....\...VDE. ..].L....5r0....l..VB........a9.-..l........-...iH".t....&...O..D.4.T^..p..A..8....;O..@Z.*et.9 .5.....S .xnhQ.j..;. .;U"4..8..._.s.T.q...'Q.9...B..'.P...5@.....#&4..%....\b..4.D. .. ..R.>....Z..{.Fg.`....R....o...K^..?y.).?.bx..C....j..h.._.E.$2.......cr./..<.qeR|....O ...2~}....iMp_.q...[....D.Ms..z..o....&6zl..f$UK.a...f.)L..*.P.F.d...5FF.4..#h.7.J. .......mc...qN.7..9,s8...Q.[..._1.H....A..\6.x..).Qm>F3b3....5...E.....:..4..'R/.$..m.y..$...r..........1c3.....n.0.......).d[...u..i..{.NA0..N.$.a;m<..>*......E..(.....t7.........f;..~.......#|8...tT. .<.'.z; ..k!g..c.8ci&S.{.*.z,mN.6.V.$...lp.$..(.}.....|0>j...$2.....*...u....Z%E..6"#U.;.D2.H...S..HM.r...1 %...pu..(.g..7.6S.."N.)8........... e..$.1...\......{)q7.!..P........kL........."9...8.2...1...[..d......lTT/.......]h..:.x..Z.....zr..x......?..L.[..*Tm_....x%A.....N/....[..B..D../....k..a...{t...j......\....q.Z5..X..-..nw7..?...rT8.R.]..W.w.........e9...W...0....{[..wm)......I..m.R...;YETZzJ..l&3.N.j:.Q..&.P.[.p{
<<
<<< skipped >>>
GET /vid/xternal/jquery.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d8402590b549c39d9e446492eeb41de3d1403504333164; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: 3oQnrHW03yckPafAeHUYqHbo6lUwFeB4TubtFT7b35MC/6BHZNsdQ2j42KqIPKxe
x-amz-request-id: 152D9CBDFA0AA821
Last-Modified: Sat, 15 Mar 2014 17:31:09 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee9222493c0ee5-EWR
Content-Encoding: gzip
60e7..............i..6.0....?....i.$..~.4Y.^....q.r.Q.yH....*-.X.......PT9.....%.................M..o.#.....|.n|.....n.[...R..z.....5.m..Y.....bq....u.i..#..(F..O.*.....h....t.J..f....z.6....(.....]..t...y....j.4Z,.m.]..n>.n.t...?......,....J......#..q.x[@..5.....N.........hD......Y.k.N..e.n.M.........g.7.N.5.:..t0#t..6........V.5f..m..=....Oi..{...~.j%.`3K..7........N]g.fk.....`.F.v..?......Y$..`..7..~.Zb......~..H..6n........;w.YN}J...~>..h.J.LP..~.......{..5..q4}s.M...N......*.k.(...y......v;.........."IOO.7....I_..i..^....."..H....D.F.F.i:..G.L..:Vd.8.C......d..K....|..=...q..S=...F.....0...O.....)..[.J.. .NP\.A.lz..aM...Ik..J.{!......l..|....a....o.A...........k.y5]c2~....2...,......<..........#..A .A...h..E......e."B...............r%."..O.\,.<...Z..(_..j_..#`..j.M.6_..,....Nr.G.v...o..b~z.qGaI.......fi,.`.6!.m..B..^..,..b..d.k...Mo..r '.... n1.......Mq......Fn.Z.-.....oZ...?9;.......f.S....`Z.1X...Z...!.#.......2|.h..3.X.s...z........=4..-B.... .....K...2.(.nVlV).&]:.....t7..e4.e:..K>V.d...C...v. L.%<Q[.._........@h..'..o.a.}.*...y4.A....)..u...&.....-.-%@s.".E&.....A..q.W....q!.#.r......l...'N7j:-...i....W..P8.......<~..:.V].Vq.'..@d.BD..2...\....... .A........f/.M.Q.....V..'.....N...L..|l6.......!q..}..j.......F*.?H..p.....#..<...ko..........L..}.K..,...[izF.F...a.......Z.-0...k...4...Wl.g..T2.$.....2.......3^...)...W..'k.yD........j.X..uk0J..W.b.kw.1......H..PaN.e4$....}........{.0.Eqk...N.8..R....=.hN..!..B.wPq8.f..$.[......$..i.......N.~......b.".D& ..$.-.:a@\......^3..l...z.
<<
<<< skipped >>>
GET /kjuwM HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: adf.ly
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Date: Mon, 23 Jun 2014 06:18:42 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.5.8
Set-Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; path=/; domain=.adf.ly
Set-Cookie: adf1=668e57544f6910e95c22591759704a2f; expires=Tue, 24-Jun-2014 06:18:42 GMT; Max-Age=86400; path=/; domain=.adf.ly
Set-Cookie: adf2=e8b8e1b450a222f8d1c56b9a088a166b; expires=Tue, 24-Jun-2014 06:18:42 GMT; Max-Age=86400; path=/; domain=.adf.ly
P3P: policyref="hXXp://adf.ly/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa IVAi IVDi CONi HISi TELi OUR IND PHY ONL FIN COM NAV INT DEM GOV"
Cache-Control: max-age=0, no-store, no-cache, must-revalidate
Pragma: no-cache
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 23 Jun 2014 06:18:42 GMT
Cache-Control: post-check=0, pre-check=0
Content-Type: text/html
1000.............<kW....3.B(w.t.e...l.K..d&...L......-.%.V.C...~....a..[...$sw}r..U]]....?....C>...Q...>.|.i4&..=i...4.........0.t.... ......;OO..M-M.c{D.q.\...{...smB{i...Q5.\?...........('bn.. .o=.U.s.....1.5_.<..;.@...?$,..;.|R.....~..p.5.K..krKd.~`L.8H&............3......]...p.M..a...L.}.r...o&...O...&.x.....uu.. ..3.....a....VlN....h.}c.^.....0-......q.x...f].=.....(2.[.Y.X./.....z.e.g.wH...5gVb. ........... u.C.%}.|.S- .u..3..N7......>.&[[&..".4.\f...\..Q.EA....#....K...E<.........z.Ex...K.=.$.A..p....&.qto..S.E: ._..[.b..._.. ...,..mg.t...zz..S.....4'.7M....(..x6...K.Y>h..T......*.......f..1..H..b:..c.d.!?....$?....Q.....a.Z.A. .......p..^.v..@/........|..h%L..|...F. .u$...x4"..K.O.......GeG....ge>....r....&.........p...;7.!.......m....n.M...{I,..a.p..a.Ta......i*y).4..B.S...'<.........AX2..?.;....F`N....F.c-..4....7... ..-..].....`..ns...b.?......)..M..f.m.Y......{q .`.D28.,...6.u@.q}n*.i..g[.k.....3*f.......1..b....q..}..fs3;pp.zy.................k....{....Z.m.:-k..c.;...q.-)1..u.u...nIi..o..;/#....^9..;.?E.GM.X...3:Jni.....:(...K..`...vQ..!.(4f../U..D.N.)g..>....5..Me.C/H|.......C.~...jL..7.q6.f.I0v.......w..x...K`?.C..5....P...(..Z.~z...n..M..-.ZR...02H:..|..]a`...... K.p...TK.<.e.......1.Z.;..Y..-.W.....F..X.B..@f.W.. .s.y.1K..RTuq.\.\T..4......*.....k.V..,.K.....(3...8.~.....-.%.O..ATx..u..t.....>...%5.....").t..r..:q.1.......r..........r...3 .n.......LB&I./.0../..(.x....D.5.. . ..PS....2.=..t.iw....&s{..E.........&1.p..6....x@..............5.n.....p...@......%xJ
<<
<<< skipped >>>
GET /1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei= HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b; __utma=255621336.468587299.1403486636.1403486636.1403486636.1; __utmb=255621336.0.10.1403486636; __utmc=255621336; __utmz=255621336.1403486636.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
HTTP/1.1 200 OK
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Mon, 23 Jun 2014 06:18:52 GMT
Server: LiteSpeed
Connection: close
X-Powered-By: PHP/5.5.8
P3P: policyref="hXXp://adf.ly/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa IVAi IVDi CONi HISi TELi OUR IND PHY ONL FIN COM NAV INT DEM GOV"
Cache-Control: max-age=0, no-store, no-cache, must-revalidate
Pragma: no-cache
Expires: Sat, 26 Jul 1997 05:00:00 GMT
Last-Modified: Mon, 23 Jun 2014 06:18:52 GMT
Cache-Control: post-check=0, pre-check=0
Set-Cookie: adfly_197198=1494770; expires=Tue, 24-Jun-2014 06:18:52 GMT; Max-Age=86400; path=/
Set-Cookie: market_197198=1494770; expires=Mon, 23-Jun-2014 06:19:52 GMT; Max-Age=60; path=/
Content-Type: text/html
Content-Length: 4072
............is...{g.. .T.FK..h....>S....j...Y.Krmr..........A......F.....WS5.]...WSFsxz.s5g.zS..........B(&T.....^fZ...Wu..$^6..d*...e....__.....)Xbg~..........XFo.....z..g...0..4g.W8e.'.......i..O.^...../..|.i.d.....c.._...W..K.. .)^.@.FD.rmO........0\.R..).. .uQHU...N.....(..YPDv.l.en......0.LU.O(n...5).feX.Q<.u.........W..6".]..K..............&..Y....a....V.x..F..... .@"n..i1PCBSyz*...u.....!N..&{.@..*...A5..b1..J8.AQ.-.k...........h.-.r....v....../Z..*?a.t....$l.U,....!.h#.B..4.'e.. U7U'..2...>....`K...h5..._3.h..0$..Eo..VMyI...I5.=).0>.5X..v...9 K:a.Z.}7.....-..z..h.s\Gg....9.....,*....^..t..`...|........s.X.M....,..k.w..S*...C...<...*x..0X. .........k...a4f.(.J.K}fH....Zm#Q(....O$J..Ad...>.[gTe. .W~.h.....OO...B...`....-..5/.D..0..wz........._.....b.:=.nG.Y...z|$.=....H.nXs...Yt.P...T... ...^.......e....Y.. `c"..n/....'.5...u.......@......>XK..O4.I.........e}r._.~..<.{.a...#1.......O>1....?...t..r^.WN. .....PS...%.d...m.....A.v..(........r....&L..2..@........Q...>.......y.i.N8..GSZ.].X.`R...0.I.S.M....C.....O.cB.P8..W..#...7a....d.Q...!....aRhQ.]...J;`d.q.`..=9``...... .rp...l.......x...Ne...........j...9id ..!.9.I.ze.= ....h..I...F..V...............d...D.(.....F..diX.Dp.'^J:g.E...wG..l...c......C.1...C.h..^A$..n........3.NP. (..\LZ..R.........Lx..p.6AG....P...4.....l.B.yKg.5.....D..... 5.6=.......b.....b`Q:..#..<..BH....P. 8.....n...Q.ii..55.7.........@...........8..vV..Vb.AA...Rv..<)..{.yK..c..a......:E.5.7@.b...D....mP.w.A..!2...p.&T.'..q..J7.B.....>..4.5..{..c.Q.
<<
<<< skipped >>>
GET /ajax/libs/jquery/1.7.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Fri, 20 Jun 2014 15:21:54 GMT
Expires: Sat, 20 Jun 2015 15:21:54 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33186
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 226613
Alternate-Protocol: 80:quic
.............~.F....?......!J......7.......Y...h....w.T*.".Y.Y...|.D.. (g..;.....b=q.8......?.....w.....>.......g{s.....2...........e. WK?VI.h....~.<n...fy6.....e.z...8.{.U......(.. .e.8....V...}.[..|../.......j-.~'...Q.....%Q.KV...Ec....q.{...x........*..^...^Vn........&_...~.....o.Z..~..^....{?.S..&.w.W.|A...r......t.../V.,.Dt.Pf...&yYLv.U......r.Q}.^']...*W.:H.........~_=.r..s.^..T..=l.]..)Vj.......^.ys...x...C_.h..&............`.^b<.^:_m1'Y....c.....e..1Oo....q...q.x......o...........?..q:..;.>.whu.....=.... . P..i...I..E.!..f.&v(.......m...r...w~.SW.......6p>...........,.........Lsj...L7..j.......y..'.F..h44..SY.V.......i.mw...4Yi.H{'.._..].9?...}..Jn................5Q%m.y.,v.5U.(.^..\-.R...?^m."...7e..vy...b...L..%....]..f...l5>...nw.rYx..|8..V.......0F..|4....<.q....d.(~...h....p.......q1.......y..ZF.p1..;.^..W.Y...(.....<x.F...iI.t..n..p.-......w.p:..I.\.:x\...H..T.j...../i..h....3....Y..w.......5...:..n.....U...]B..`.ZQ..nE}.....L..`..A..W....C.\'......e^./.j\[...6.v."..u...-..K.3Tb....24>,..hD.R..<.F..q5C..vR.iO)Z.(..&T..v.Z#.. .._ts..1.H..=....H1...6..@....9..v...=Q...RZ ..SIt.}.....J.me.....Yq`..5......5.....28L..~.-L.=...b)M'..Gd.....1..,.:H...f.....h..T. Q...~.|%#%....y....7....L......"QU.y0H...<.s....n....I'Z............A........K...k..2...P._..1Z...B..4~.&..h.o{.y..q.......Z..R...l......&.....>....P.......&.;W.3...L......@$...,....Q..U1..hC1.$ .;ByWj.M..... B=1....s_....:HP...&.7.&..>7.(=.....P.b8...Q..Nw,...E........t;.4..`..._ F.P.......t....hm..w...Q....
<<
<<< skipped >>>
POST /callback/aa75b70072b3d2c372e725db858e1e89 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: hXXp://adf.ly/kjuwM
Accept: */*
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: adf.ly
Content-Length: 562
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b; __utma=255621336.468587299.1403486636.1403486636.1403486636.1; __utmb=255621336.0.10.1403486636; __utmc=255621336; __utmz=255621336.1403486636.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); adfly_197198=1494770; market_197198=1494770
hithere=R5VCQI07LIjjBMDwOEyjAMuuTUkjVLUzNACi4UwMRNSEkIiULVCkJTyuZAWyZOl4cQijIN6uIYiDIMs1IQmDlMkuZAWj5L0zIAjioUwMLNCEJImUbVGkFTzuaACyIO63MICzwNiwcU2jNLywZ4XiNM3gIIjFoTxDMBTCcV2FL5CkJLzgYs3DJMlucQ2zgLi0O5jWgZ4kNlSmwciUdB2yJOyxZ4XSNN3gIQjloT4gMMT3cdsvIRnmdbipcdmFVIz7aACjIL63NADSgRxJLNCVJTtgbs2TJZpsbJGWUai0OFjGAcstI9m21YvoYAmClMsuZQVz9LvhcxyGIb6pIpk35bvNIJiiwOiiYQWnNb0ladWW9YuyIVj2oc51LJCCJL6iIkjDoOilMFCT4Z44OUDDAO1iORDWcNzyNcDTEZ1yNcDzEM3jIJiDwZizaIGmFMz3aACDIM63IImWYN53NEDWEYxiNoWjQI4kNlT2dXhnY9WGVbhiMwTidIj1OcGDEMyxOIDilOjiYIzXUZ22MJjCkL3wYomjQIx4IJny0eO=
HTTP/1.1 200 OK
Content-Encoding: gzip
Vary: Accept-Encoding
Date
GET /vid/42/style.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d1a29a4f15a66591a8a099ccda297f92d1403504333192; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: JxqfVsPo1FbAWUi7ir2KLQ0bqpGopH QwXpnlAweMtLq6B93Stx6rChRFb KEypW
x-amz-request-id: 114AB11C34153946
Last-Modified: Thu, 12 Jun 2014 06:14:28 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee922270540ee5-EWR
Content-Encoding: gzip
532.............XOs.8.?'3...z2.;....1....zw.....*@`M0..9...w_=I`..$.^.'1......=)......D."R.;.o.4q......I.........Y.H.0|a&..Uo............'...d.A....0B.....F..*H^8..,.....*.3.."c9u...k. ..r....e.t:U.?.....X^.\?.y.>K'...D2...yN5...........v.)...K4.@2.Q`}b.\.d'y.F2..ADsIEi.z...@M.......|~...<.{.....[X...o%..`e4e!....b.u.pf....O...ob...s.j.!...<...n..#..Gk....V...F..6.C.Mp..2.vLh.. ...............y.........;)y...~mu.^#...L...........vW...x......<cqm...L......hJ....;.]...,F..GJ...%...=.l.w....'.$f*.7..Q...kx&~....nx$....L............3#.....pcdk=....Uj..*.4.. `S.).....I.:..5.... ...SH.Y`.... fB..rZ...Y..."...;...T.$..*.k..=...N&u.N.B.._.=^M.6.%b.V....dW.h.p...=..b..U\Y.Q=.x...-.c].ty.jk.'M..3.L.L..#....B.)...:....._W./W.._I..c......PY..;...>43.).o.&Q....mHJOm.D..T..>.g.....q...Og....g.<.. eM.t.Fw.iR.....=...S..?....DB...S.P...R..tF..wb......s..Q..L....)......n~...H....f...O.....D.{X.B./...I.q.T..$h......m.._..i.....N.....by.......}F.... .Z)...E. D.G...z?..P... J..UXs......*.6....j.....D&B...a.e....M.......s#...5.|s.........l..8F.x.8.....R..i.........d..\6.e._."n..Z.9.Q-&.Z]........)U..H$w$C[*..W..}.\SW...Y.\.Y.~.@..@.6..S.*..V..mQ^....i:2{........P=(d...[..w..4F0._..I..H....-...zr.?.OG...w..{t...=..v...........f.T6.W...J..j..I EA2T.C....(Y.r..n...G..}...5.um.yi.8...L......~......3J..f.y..P.N.....;.....n&.{.[[~..,.."=.....0......
<<
<<< skipped >>>
GET /vid/xternal/external.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d888951e18dc1409b194d64dcf274ab9e1403504333255; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: Ohnd/yqYKLMap 2YXPUHjdkH5hmtjNuofRx/vb0z6B2FRwX5ldMr9fLlbL4OOEmR
x-amz-request-id: AA4E0C233D529042
Last-Modified: Tue, 17 Jun 2014 11:49:49 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee9222d0600ee5-EWR
Content-Encoding: gzip
39a.............VQo.6.~N........T....G.b.{J..Y..AP..Yb,.*I......).v.l.0.X:~.......?..$UKY(..B.....=..V2.BI.....*....}...kRrm..I...@...I.4..O ...Gi.LY...W4..8..[VE.eOE....$h^.n..j..>.Uo.[.T..Y.....&..uL.r'.[j......-jxwt?...iP.Y.2.9.c2.7.5.b.=.....6!.4.9&..Qo...y;...l....m.H....E)...Z..`;.(..G.......i.......gQ..../\....b.l$..~.".d....,E.S..SyC....VrA(%g..Bc..7wT..sW.......*.T.o..a..RH.......TuY...A.Ss.u.....i....c.....Bs.Qm.SB.@....U.U..%V.esn.<..M.$D".......w.J=...#O...........A.U..\.Z.........vu.j&xW0f.\k....`..r.0W.QtM.-h....#.J.....D..{._"..O...._c...........{.......whd.Wq}...p.6.c....%j.=.....t.r;/.d<<......Q...........F..|..;...#J..)6....;=..>UI5w.Z.n....?4...O>.......k.z)y.."1.N..1n }..W$..0Cw.Pp...L.../..e..JZ.#..e................I.nx......@...m...c..0(.......P.R......]..Xj..F.|..U...J&.ju.M.E.....y`..k..r.J..J.o.50..)|.o..\.i.]..L...>o....H..n.%.>.v..@f...g.|....1N..1..k..........2.#.V.)...'..j....o. ..*.....0......
<<
<<< skipped >>>
GET /vid/42/img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: image/png
Content-Length: 8348
Connection: keep-alive
Set-Cookie: __cfduid=d4d6ab53f9e9ae39cd102d551ef8fe9be1403504334279; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: dTXZuD37f/c8Mvj2ex786FoSQ3Eok/O2UhAu YfQeMV67AtxK6iCS6EA60hObq r
x-amz-request-id: 688FCDD643C3E6ED
Last-Modified: Thu, 12 Jun 2014 06:14:16 GMT
ETag: "0316f69a4d3f81febbe17593082a979b"
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:54 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee9229312f0ee5-EWR
.PNG........IHDR.......8.....^.|... cIDATx...w.......yN.>...00.)CW.A........M^5....1M.^.....)F...M.....(h,t.0.6....i......30.0......l.s...^{..Z{...#H.......|.... ....b....$.$.I.... ..A..WA..X.a!.e..J..J.&............t..V.b5.2.....$.&)....]...;...f*9...I........ ..R<..........$........!.`-..6..9.}......@.z(...Z..;..a..-.....31....IR5...6h..y&...F.......7!.7..............t.T..@c......a......$uO..J.....-W.7.F._...`.......p..D....3!o$....{.b.......X....B......II.....I%.....e...@......`tl.[n.......N..WC.......P......$....nc....~..)Pt.....&\...............*..&...4_M....O.Z..*Bk...........]..w.V>...P[b8..ub.o%...4_...u....>...w............_A..0.>.Z==...!.. e....'.....A.Q.?.d.{ww..}....;..<....X..II.U..|..W.`.G..'..[.K.aC..v..Kf.7.a..{..IkYR.|.SF..8..P.=...4../A.......2.........H....4.%.t#e..A.....S..9..xx.t..o.."-J...%..g.b.S..Wh.,...\...J.uZ.....;.jv...K..5' .]....V..I....Q]..........~..!..em.:0M.3..{.....i...%!..4.74..%'!..V..4Zm......C2..u...]B..c.Q........M......j.Bd.....llX.....N/9.(.v...'..T....\.........L.U...[^.........@<H....0.<....9!-.8F...74.b.........$!.o....^S\.8........(...B..,...>........$...F$-{....M..x....o.7...~....fN....4.2.x;~.....8...L......C..0...........:vhI..............Y......n.7p..zfqI..S=...hL.......W....#..Fw...r.g....iE)....N.'.......}.>....;.]d.....%6]..W./b1.........X2.B.z([..UH.@.`.....C.a....<. ...xo.T.^.E.C...0....Sb._...........T.....G.!.....Q......)....^?Y.O..sa..x.U..^T..6..!9.._...&....3>.B...O.X....I.f.../A.V.......l...P..T....P..6....C....x.)
<<
<<< skipped >>>
GET /cdn-cgi/pe/bag2?r[]=http://VVV.downloadmovieshd.com/cdn-cgi/nexp/dokv=abba2f56bd/cloudflare/json.js HTTP/1.1
Accept: */*
Accept-Language: en-us
pe-token: b54f430f339eed8ac07f15bcf30d14e033c82fd1-1403504332-1800
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:55 GMT
Content-Type: multipart/mixed; boundary="8LQ45hu4T,)oij"
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d3ca12cb11cf3ce41a00a8402af5093201403504335980; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
CF-RAY: 13ee9233e2670ee5-EWR
Content-Encoding: gzip
5f...............u..K-*....R0.3..r.. I. ...,H.R.-.).,H,*....HM.VH./.KI,..U...41.(5......R............c....E...........5e....A.. ...{......u.:.....jj.F...f6.X..q...\.@.U...Y.....H"......... >...V..FM.._.Q..B.$Cn........14.....\.XRZl.`d.t:.......22...;.(1.8-.H.5/9?%3/.J!)3..h^.........18...k.M..uL..................14....;'&g................1a..B.................^.........16...ks-*./.RHK.)N..........443..|V[o.6.~.... .....o...[.`..v@...2.]hK.,...&...{H..6Y.Y..xn<7..t.F:k.b...D?.....G....u).S..z$.u....Jw&.O{.X.p. J..J.X<!....Q...^..].....D|R...0R.'A.{$?e.A...SS..}?......_.m3!1G.CP........x.{.;...q.....k.1..?{....y..;"pU..b7..F*M>.........U.....<\W.s.Z(...I.at.\|.}<.BQ.8Ah....<.{s..U...W..1.&.*7l.$......k....(Z.z...:f....^..MH...Y..'HF......H.....(....a .r..U....Z.:..,..a..Z...t..........J..r>...J..Y..sjQ.b.O...,YE..............3-..9.r,..9.j..c{..B.a.DA.%.g.)...."..m.......r.....S.,.Wj....`.B.3.j.|.g....! .V.t.3.C;.3....0.W.l7.>.Z.9p...7hr.r...6.k .]2..'.......t.5.C.Ho"..()^7...........0....b.pT..".....EY...]...y...Mv.a..urm^.3..Ew.!..Z.U........V]\7....l...y....O.b...pIi$ '*k.b.sf.......w.o....AiB.eF;..L.D...T.%F....T.%......T.....VDE. tA...Y....6.......T.uy~.h..<.i..E$.P.# ......|.t..V...e.<..8@..E&.i.....J....)....CP%.. .........G<J....#l...9....Y...S...-..........F..;..5..y...JS-...L}......M..nPv..w...s.L.i.f$. .........(.g......T..1....fl..?.EU..s5=/.....kH..&.... .y...A.n^.{D[.Fi>...ub........ .....STA._..._p..!........".4S.p.Hz.l..".....(.";..L.&.n...k...A y]............
<<
<<< skipped >>>
GET /vid/xternal/jquery.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:53 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d73eef6d424f489f9b4656b26fa35d68f1403504333191; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: 3oQnrHW03yckPafAeHUYqHbo6lUwFeB4TubtFT7b35MC/6BHZNsdQ2j42KqIPKxe
x-amz-request-id: 152D9CBDFA0AA821
Last-Modified: Sat, 15 Mar 2014 17:31:09 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:53 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee922279430ee5-EWR
Content-Encoding: gzip
60e7..............i..6.0....?....i.$..~.4Y.^....q.r.Q.yH....*-.X.......PT9.....%.................M..o.#.....|.n|.....n.[...R..z.....5.m..Y.....bq....u.i..#..(F..O.*.....h....t.J..f....z.6....(.....]..t...y....j.4Z,.m.]..n>.n.t...?......,....J......#..q.x[@..5.....N.........hD......Y.k.N..e.n.M.........g.7.N.5.:..t0#t..6........V.5f..m..=....Oi..{...~.j%.`3K..7........N]g.fk.....`.F.v..?......Y$..`..7..~.Zb......~..H..6n........;w.YN}J...~>..h.J.LP..~.......{..5..q4}s.M...N......*.k.(...y......v;.........."IOO.7....I_..i..^....."..H....D.F.F.i:..G.L..:Vd.8.C......d..K....|..=...q..S=...F.....0...O.....)..[.J.. .NP\.A.lz..aM...Ik..J.{!......l..|....a....o.A...........k.y5]c2~....2...,......<..........#..A .A...h..E......e."B...............r%."..O.\,.<...Z..(_..j_..#`..j.M.6_..,....Nr.G.v...o..b~z.qGaI.......fi,.`.6!.m..B..^..,..b..d.k...Mo..r '.... n1.......Mq......Fn.Z.-.....oZ...?9;.......f.S....`Z.1X...Z...!.#.......2|.h..3.X.s...z........=4..-B.... .....K...2.(.nVlV).&]:.....t7..e4.e:..K>V.d...C...v. L.%<Q[.._........@h..'..o.a.}.*...y4.A....)..u...&.....-.-%@s.".E&.....A..q.W....q!.#.r......l...'N7j:-...i....W..P8.......<~..:.V].Vq.'..@d.BD..2...\....... .A........f/.M.Q.....V..'.....N...L..|l6.......!q..}..j.......F*.?H..p.....#..<...ko..........L..}.K..,...[izF.F...a.......Z.-0...k...4...Wl.g..T2.$.....2.......3^...)...W..'k.yD........j.X..uk0J..W.b.kw.1......H..PaN.e4$....}........{.0.Eqk...N.8..R....=.hN..!..B.wPq8.f..$.[......$..i.......N.~......b.".D& ..$.-.:a@\......^3..l...z.
<<
<<< skipped >>>
GET /vid/xternal/img.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dcb03e76ae95be7028f3f3b9ff54ae5ae1403504334255; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: dZo70BZCYRG17BgVaTVYsLaveIpM3eEOiUbEU9x 5vGl5lsdPcCF1jcU CeauJQ0
x-amz-request-id: 2DD2ED33147B004F
Last-Modified: Sat, 15 Mar 2014 18:04:23 GMT
CF-Cache-Status: HIT
Expires: Mon, 23 Jun 2014 10:18:54 GMT
Cache-Control: public, max-age=14400
CF-RAY: 13ee92291a3b0ee5-EWR
Content-Encoding: gzip
18c............u.An.0.E...;XQ..%%.U]...{.(..&.[c,l...w..B@H...=...5.ZgN....3.(.,.yz$X.^.. gIJT.q..Z.U&...vFwtEi.Z..ctA.db...k.Fz.s.).I.>N./hV...Ne..*......8}..j.{y....hh..}W....p#O..C....IS...}....f..ea...6..`T.j.$...?K.{...w...-=.....Z.......O.]......Y....7Y..u..t.-s'..sM...p...V.....-U. Qpr..8.....U...sf.^ .Z. P.....6..*4..lce..D..n..(Y..Z..@....Q...{.,sF.e.....t.<.O.?.0gy...h.....a.......dwM......0......
GET /vid/xternal/footer.txt HTTP/1.1
Accept: */*
Referer: hXXp://VVV.downloadmovieshd.com/vid/42/?did=267
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: VVV.downloadmovieshd.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: cloudflare-nginx
Date: Mon, 23 Jun 2014 06:18:54 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d0d6c78b94020c3ccc1dd54690b1737a51403504334283; expires=Mon, 23-Dec-2019 23:50:00 GMT; path=/; domain=.downloadmovieshd.com; HttpOnly
x-amz-id-2: 9dKMLe9TVbHJHJA MXlBDSZMlBwYKVi9TNHxsF/42PFFZM7CYvJS91xFMO5pg 7g
x-amz-request-id: BF696D694A6D3BA8
Last-Modified: Sat, 15 Mar 2014 17:31:07 GMT
CF-RAY: 13ee92294a460ee5-EWR
Content-Encoding: gzip
12c..............AN.0.E.bu3 .t.:...... O.N.I..u["q!...h...........8.....f.V..U.'`./........h.....*..G9_..<@...O..EX...9.H......ro.,..n.....|...z.p$.. IL$.!..Q..W....DVy".s ..<...O......ybg.v.<y..g.#.....:.v_t...,.y6..2.Ohs..g.M.}..r"....c8.o.e..e..kx..k....y..V^P.....6.^o.......$........x]........./.......a........C.....0..
GET /static/css/adfly_2.css HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:43 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "97f-51dd3f45-1ed891dab493e028"
Last-Modified: Wed, 10 Jul 2013 11:02:29 GMT
Content-Type: text/css
Content-Length: 2431
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:43 GMT
html{height:100%}..body..{.. height:100%;.. min-width:980px;.. overflow:hidden; .. font-family: verdana, arial ,helvetica;.. font-size: 12px;.. margin: 0;.. padding: 0; ..}..#overly {.. display: block;.. background-color: #317EC5;.. z-index:999;.. position:absolute;.. top:0;.. left: 0;.. width:100%;.. height:100%; ..}..div#overly p {.. font-family:arial; .. font-size:12px;.. color: #000000; .. margin:20px auto; .. border:1px solid #000000; .. width: 200px; .. padding: 5px; .. background-color: silver;..}...black_overlay{.. display: none;.. position: absolute;.. top: 0%;.. left: 0%;.. width: 100%;.. height: 100%;.. background-color: black;.. z-index:10001;.. -moz-opacity: 0.8;.. opacity:.30;.. filter: alpha(opacity=30);..}...white_content {.. display: none;.. position: absolute;.. top: 2%;.. left: 25%;.. width: 50%;.. height: 50%;.. padding: 16px;.. border: 16px solid orange;.. background-color: white;.. z-index:10002;.. overflow: auto;..}...sm_content {.. display: none;.. position: absolute;.. top: 5%;.. left: 50%;.. width: 320px;.. width: 400px\9;.. height: 360px;.. height: 440px\9;.. padding: 24px;.. border: 4px solid rgb(221, 184, 66);.. background-color: white;.. z-index:10002;.. overflow: auto;.. margin-left: -185px;.. overflow-x:hidden;..}..#sm_lo {.. padding-left: 0px;.. width: 120%;.. height: 66px;.. backgrou
<<
<<< skipped >>>
GET /static/js/view40.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:43 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "112ea-5372285f-283eef96a4a92c18"
Last-Modified: Tue, 13 May 2014 14:12:47 GMT
Content-Type: application/x-javascript
Content-Length: 70378
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:43 GMT
eval((function(p56){for(var Z56="",T56=0,L56=function(p56,C56){for(var B56=0,o56=0;o56<C56;o56 ){B56*=96;var x56=p56.charCodeAt(o56);if(x56>=32&&x56<=127){B56 =x56-32;}}return B56;};T56<p56.length;){if(p56.charAt(T56)!="`")Z56 =p56.charAt(T56 );else{if(p56.charAt(T56 1)!="`"){var d56=L56(p56.charAt(T56 3),1) 5;Z56 =Z56.substr(Z56.length-L56(p56.substr(T56 1,2),2)-d56,d56);T56 =4;}else{Z56 ="`";T56 =2;}}}return Z56;})("var b7H76=window;for(var F76 in` 6!){if(F76.length===((83.0E1,1.52E2)>=(125.,9.)?(94.2E1,6):(93,137)<=(0x24E,108)?7.29E2:(124.80E1,131.)>=(83.5E1,9.31E2)?\"N\":(44.,0x1EE))&&F76.charCodeAt(((65,0x24B)<(0x145,0xE7)?(124,1.130E2):8.07E2>(16.3E1,0x31)?(134,3):0x194<=(93,0x193)?(85.,\'d\'):(7.28E2,0x18C)))===(142.>=(91.9E1,0xDE)?(0x89,7.270E2):(0x20C,100)<2.15E2?(3.7E2,101):101.<(10.72E2,21)?80.:(0x171,70))&&F76.charCodeAt(((51.80E1,98)<=8.09E2?(1.463E3,5):(88.,64.)<=3E0` 6 9E2,27.8E1):(8.65E2,0x8D)))===((44.,9.6E2)>=(0xEA,7.770E2)?(57.,110):(43,0x6F))&&F76.charCodeAt(((82,140.3E1)>=(0x166,49.6E1)?(0x14,1):(0x1B9,118.)<110?4.0E1:0x176>=(142.8E1,7.19E2)?60.90E1:(8.5E2,0xE)))===((0x4D,0x1C8)<=108.?(0x15,\"R\"):(144,60.)>5.2E2?(1.213E3,192):71.<(0x104,0x13E)?(120,99):(0x67,0x154))&&F76.charCodeAt((57.40E1>=(140,2.)?(3.0E1,0):(116,36.4E1)>(0x4,0x189)?142.20E1:(14.,128)>=(9.96E2,146)?(5.47E2,1.429E3):(7.67E2,52)))===((107` : 6E3)>0x163?(0x95,115):(6.99E2,74)<=(57,72)?(7.05E2,64):(86.,90)))break};for(var A76 in b7H76){if(A76.
<<
<<< skipped >>>
GET /static/image/ahl6532.gif HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "c9d-51b1c54e-616cf7bbbb5ed14c"
Last-Modified: Fri, 07 Jun 2013 11:34:38 GMT
Content-Type: image/gif
Content-Length: 3229
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
GIF89a..:....GPL......rp3..$...{...1U2JJ-Qp.;a...........,..1...7h..y4.....-..qOQ7..3.......5Z.................4....=Q...p..Hg..Eh.*M......[..'%'..BUr...G............fm>.....F.....E..n......779...M]C..X...[e=>@Fq.....ijm.6[a}._x...Q........p.3O..8Pl......\.3W.>a.....Z......m.... ..6.#.......Fy...U......#.!..>=6) .8l`;.....!;/.B`|J@..,A0- .6W...7\{..R.0T./S.8^.7].;b.:a.... M.,O..Q.-P.*L.9`.)K...!.......,......:.....u..uR...2./...2*.....**..............o..W....W]/............*./...(..........&.]....../............2....................v.....W...TG..%~..*\......#J.....C(....Q....(..I..I.......eG..L..I..M~}r..i.b.!.\...1...H.*].....P.JmZ..P..........`...A.G...L8..`..#...8.b`...^....2...WCx.@!...&.*n:...;g.&......9&.......r..}..C..(.{.2...0k........;...|..e7..w^p.Fh.9.(_..y..U..8r...2g.....I....../..............M..l......la.`...$..ZK....v....~.6..y.5..{J(...v.'_qR8.!xE....:...[U<...(.`..."...4..!z...Ao...F.-.`ao.h8....(...L6.$.Z.0..V.....0.@..x...1n...m<i..h....76.....P..NJ....q.....G.......g.....@`..Vh...e....c8....f.)..A..........yY.|.i...>.F.l,.@...`F.#8Z..."... .A..".j..m.!.g.}@..i.P\.O......Y...rKh..4.........P..v.R......D...k....[...F{..R.K..?@.........3.....p...L.C..me........."1..#P...(.|/.E...e.0,..R(........k$...>,A...o.%......jP0.._\6.... ..@ ...38pu..J........Z..).E.q..;..a.i.pb.-.k..wcpD....x......P....8pY.....F.....a.g...m..E.0...........N..@$.F...@..@..................f&.....[f.....D............*...M..D..a.|...$...w..z.........;...`........7...s.@o..;).....^..e8..`z....|../.a...
<<
<<< skipped >>>
GET /static/image/d_top_bg.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "9c-51d450e3-8ab0ff4e53d010b5"
Last-Modified: Wed, 03 Jul 2013 16:27:15 GMT
Content-Type: image/png
Content-Length: 156
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......;.....5.w.....tEXtSoftware.Adobe ImageReadyq.e<...>IDATx.b..Ifb.........4..a......j...!.E.......z.......O...u.....k/.........IEND.B`.....
GET /static/image/d_bottom_bg.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:47 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "a7-51d450e3-500e6ae194574ff5"
Last-Modified: Wed, 03 Jul 2013 16:27:15 GMT
Content-Type: image/png
Content-Length: 167
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:47 GMT
.PNG........IHDR..............i.N....tEXtSoftware.Adobe ImageReadyq.e<...IIDATx.bx....................3<|.......w^.f...?....L...1......,.......@...or-y.y.y....IEND.B`...
GET /1/92a411bc23?a=2344945,2334836&ap=58&fe=4593&dc=4593&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZc0xHFVZcSxYLXERBU15cRiJWXxAXDF9aUEQfTFoyUV4WEQZd&f=["err"]&jsonp=NREUM.setToken HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: beacon-3.newrelic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Set-Cookie: JSESSIONID=10a67ac5efe2a91c;Path=/
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/javascript;charset=ISO-8859-1
Content-Length: 21
NREUM.setToken(null).....
GET /1/92a411bc23?a=2344945,2334836&ap=22&fe=3328&dc=3328&v=411.b2946c1&to=YlNSbUYAV0IFBhdaWVsZZUtdTghcBRcIVkIbRlhJ&f=["err"] HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/1market.php?p=ZwCiII65NgTTMZxxNUDGQOz1LgCjJYukIVjjoM13NUjmkMw3MMDzIYsyIQm2ZMsiYJXzNNowIAjzoNwiLVCzJNthbF2mJIp6bIGCUdiiOwjiAIsxIImi1OviYMm2lcsiZwVi9IvtcNyjII66IIki5YvjIJny0ei=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: beacon-3.newrelic.com
Connection: Keep-Alive
HTTP/1.1 204 No Content
Content-Type: image/gif
Set-Cookie: JSESSIONID=9ec585c9314f1e46;Path=/
Expires: Thu, 01 Jan 1970 00:00:00 GMT
GET /static/js/b64.js HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:43 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "dc0-533ef451-73228b2e988dd6e8"
Last-Modified: Fri, 04 Apr 2014 18:05:05 GMT
Content-Type: application/x-javascript
Content-Length: 3520
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:43 GMT
function base64_encode(data) {. // discuss at: hXXp://phpjs.org/functions/base64_encode/. // original by: Tyler Akins (hXXp://rumkin.com). // improved by: Bayron Guevara. // improved by: Thunder.m. // improved by: Kevin van Zonneveld (hXXp://kevin.vanzonneveld.net). // improved by: Kevin van Zonneveld (hXXp://kevin.vanzonneveld.net). // improved by: Rafa.. Kukawski (hXXp://kukawski.pl). // bugfixed by: Pellentesque Malesuada. // example 1: base64_encode('Kevin van Zonneveld');. // returns 1: 'S2V2aW4gdmFuIFpvbm5ldmVsZA=='. // example 2: base64_encode('a');. // returns 2: 'YQ=='. // example 3: base64_encode('... .. la mode');. // returns 3: '4pyTIMOgIGxhIG1vZGU='.. var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /=';. var o1, o2, o3, h1, h2, h3, h4, bits, i = 0,. ac = 0,. enc = '',. tmp_arr = [];.. if (!data) {. return data;. }.. data = unescape(encodeURIComponent(data)).. do {. // pack three octets into four hexets. o1 = data.charCodeAt(i );. o2 = data.charCodeAt(i );. o3 = data.charCodeAt(i );.. bits = o1 << 16 | o2 << 8 | o3;.. h1 = bits >> 18 & 0x3f;. h2 = bits >> 12 & 0x3f;. h3 = bits >> 6 & 0x3f;. h4 = bits & 0x3f;.. // use hexets to index into b64, and append result to encoded string. tmp_arr[ac ] = b64.charAt(h1) b64.charAt(h2) b64.charAt(h3) b64.charAt(h4);. }
<<
<<< skipped >>>
GET /static/image/logo_fb2.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "188b-5116a59d-2f8f7edb8dce95ec"
Last-Modified: Sat, 09 Feb 2013 19:38:05 GMT
Content-Type: image/png
Content-Length: 6283
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......b.......G.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE.V.s.o*p.-**.........*r.....R.l....,........;,v.-x..h."\......Rw..'Ns.....C%d.GIO...aT2..0}.....T..#r..c...(...$`..Y.(j.Jy..........b....h..6..th..#^......."s.#j.!l.......E|.-z.'n.:v.%b. t...%.y?..3......m..&f.,w.8{.].......K......'h.K..R..F.......I...(l.........C$b......p Z.............(k.6:B*i....$_.4j.........X......t.."\... -z.Rv~.[.z..#u......9..@.........'f.-y.... n.rto&i....#^...;)o.%`....uf;..W s...7.n.'t...X T.^....A...;r.-f...:...%p.'i...9...Q...g.-x....,c.:j.!..*w...1^.......B e.&e...^# !'v.>....T!`..V.B:,&g....$a..b.!a...!......l....Y.....T.....M#\.w...n."c....&w...1"d....._.%f..O.#)44p.,p.1b..X.)m....#]..].)x.VWZ.x.'r. o..y. q.#h.'_..[.!X."Z."[."Z."Z.!Y.)n.#^.'h.-{...y#_....D.....e_T(\./j.`..&b....%\.a.y.."......$[.,|.-|.!Z. y..z.0t. s.3z........v.d...!IDATx....\T...7.8.... B....QS..AA..d.x......0..a..<>....&......D.@M3Q,<.I...z.q...[..oz....^k?...s.....0{.~.........\s7vK.Z[[o.v.[..h. .?......~..xk...e.Hh.{...w.]A...f....:..]~ .]]6...#.!.s...m.....g. .j.j.,. .......of.K.S..I~.[..D.....g........e.%..$.....$ 2.....?..~o.wK"_A.D8...X..1...H@....S...q...O7.....W....w..;......!..y.S.....=....?.......tW.m,K.O".H(......m..c....qj...*....&.d..*,....!Rp..Ax.r.>|........B..QC.KT'U)J.6i..u.D.`.1.0....F..~..........t..........cH......H ..:.* .w....FGG/z...|......$k.Km5.Y5..!.....:......U..zc.........K.l...1...R.VT..h,M.....(x.N..[...9!.@/.]...h..<|U....xE..6.".H.b...B..... ..g.......=.^C`.....S....X.R.......F_..H
<<
<<< skipped >>>
GET /static/image/skip_ad/en_tran.png HTTP/1.1
Accept: */*
Referer: hXXp://adf.ly/kjuwM
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E)
Host: cdn.adf.ly
Connection: Keep-Alive
Cookie: FLYSESSID=73dd338fcdba0e4c661906dede4136a7a78e3401; adf1=668e57544f6910e95c22591759704a2f; adf2=e8b8e1b450a222f8d1c56b9a088a166b
HTTP/1.1 200 OK
Date: Mon, 23 Jun 2014 06:18:46 GMT
Server: LiteSpeed
Accept-Ranges: bytes
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
ETag: "13d4-51e829a4-3949693a3ed59e6e"
Last-Modified: Thu, 18 Jul 2013 17:45:08 GMT
Content-Type: image/png
Content-Length: 5076
Cache-Control: public, max-age=604800
Expires: Mon, 30 Jun 2014 06:18:46 GMT
.PNG........IHDR.......)....."c[.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<
<<< skipped >>>
GET /gb.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: gb.symcb.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Server: Apache
ETag: "21f5457deceff1b72981318a556e49f6:1403471739"
Last-Modified: Sun, 22 Jun 2014 21:15:39 GMT
Accept-Ranges: bytes
Content-Length: 50182
Date: Mon, 23 Jun 2014 06:18:52 GMT
Connection: keep-alive
Content-Type: application/pkix-crl
0...0......0...*.H........0D1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust SSL CA - G2..140622210100Z..140702210100Z0..>0!....).i}w..@...w.8..140519041846Z0!...H.y...)h....<....140213114347Z0!...M."..Z.......q...140502102942Z0!...V...&}5.2..."....140422235329Z0!...mc6.2..~..TU..}..140312185839Z0!...r.R.. .'......u..130703123510Z0!.....]...j2..b..B...140520095600Z0!....0.,=..4..k......140203223109Z0!....P...~.I....X ...140225061225Z0!...........R:.h.#...140616105236Z0!........4..V..-l....140505080224Z0!.....D2..;oe.#o.....130807074235Z0!.......P.]56........140422152703Z0!........b.....R.....140115154059Z0!...Y]7_t7..W./......130718095956Z0!...j:..YY.....J3....140418175733Z0!.....~....z...h]."..140220162440Z0!....".X......=sA....140423203230Z0!....Yy..]..n;.B6)(..140424141615Z0!.....L..P.8......J..140421145404Z0!...5.a..W*>.........140113154837Z0!....s....kd.....=...140212144128Z0!....i#....z@........140613220808Z0!....?.'..=?x.=9.$...140622064002Z0!......:5..=.|r...@..130918080101Z0!...0.Hg./..J........140116173320Z0!...O...!.L|.P..6....140527182251Z0!...RB./aH.R2x..!.C..140109024350Z0!...o(.!e..y.)8......140108231615Z0!...o..}A;h.\u.......140219232221Z0!...yi..Bk....gZ.Y...140106053314Z0!...}b..y...[.U.t....140519222137Z0!......h...m%....y...140109165914Z0!.....%.N..A"...Uc...140318050429Z0!......2..7......'%..130529144825Z0!...>........`E_.....140527182251Z0!...QV,z.F_..c..UK...140515172826Z0!...a4.Z....%.WGG....140417131312Z0!...n]{.......%:.Qy..140204195753Z0!........K....U...z..1404260
<<
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
HFM.exe_2624:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
udPh
udPh
PSSSSSSh
PSSSSSSh
PSSSSSSh!
PSSSSSSh!
vSSSh
vSSSh
FTPjK
FTPjK
FtPj;
FtPj;
C.PjRV
C.PjRV
tGHt.Ht&
tGHt.Ht&
.EKSWU
.EKSWU
FTPG
FTPG
FTPj
FTPj
FtPS
FtPS
H%x\U
H%x\U
H%x]U
H%x]U
=KNILw.tT=RCNEw
=KNILw.tT=RCNEw
_0 _8 _4;_,
_0 _8 _4;_,
SHA1 block transform for x86, CRYPTOGAMS by <appro></appro>
SHA1 block transform for x86, CRYPTOGAMS by <appro></appro>
SHA256 block transform for x86, CRYPTOGAMS by <appro></appro>
SHA256 block transform for x86, CRYPTOGAMS by <appro></appro>
DlSHA512 block transform for x86, CRYPTOGAMS by <appro></appro>
DlSHA512 block transform for x86, CRYPTOGAMS by <appro></appro>
Montgomery Multiplication for x86, CRYPTOGAMS by <appro></appro>
Montgomery Multiplication for x86, CRYPTOGAMS by <appro></appro>
6-9'6-9'
6-9'6-9'
$6.:$6.:
$6.:$6.:
*?#1*?#1
*?#1*?#1
>8$4,8$4,
>8$4,8$4,
AES for x86, CRYPTOGAMS by <appro></appro>
AES for x86, CRYPTOGAMS by <appro></appro>
Camellia for x86 by <appro></appro>
Camellia for x86 by <appro></appro>
RC4 for x86, CRYPTOGAMS by <appro></appro>
RC4 for x86, CRYPTOGAMS by <appro></appro>
FRegDeleteKeyExW
FRegDeleteKeyExW
MARGIN-BOTTOM: 11px; BORDER-STYLE: solid; BORDER-COLOR: #DFDFE5; BORDER-WIDTH: 2px; BACKGROUND-COLOR: #DFDFE5; }H2 { COLOR: black; BACKGROUND-COLOR: #FFFFF; FONT-SIZE: 12pt; FONT-WEIGHT: normal; MARGIN-BOTTOM: 0px; MARGIN-TOP: 10px;}