not-a-virus:AdWare.Win32.OutBrowse.g (Kaspersky), Trojan.NSIS.StartPage.FD, Trojan.Win32.IEDummy.FD, Trojan.Win32.Swrort.3.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 77ee5a9a04d4d0df31ae7289b04011c2
SHA1: 4c1f70184ef2e113453d96a21ec4bebf5e4e19e7
SHA256: d9ebf0e4e3f20544586e9e438dab8428c4640d6b50e76414fe9e073f80d75593
SSDeep: 12288:1 UnYdbT2wW c1fFbftgCin2JI6J8bc1YT/AAUHnSco9Oo:1 UnY03lgd2J0bqAUyco
Size: 566960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
wmic.exe:288
%original file name%.exe:1356
LiveiStream.exe:2012
The Trojan injects its code into the following process(es):
rd.exe:1292
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process wmic.exe:288 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (238 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (0 bytes)
The process %original file name%.exe:1356 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\Convert.dll (4635 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\nsisunz.dll (211 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nslB2.tmp (0 bytes)
The process LiveiStream.exe:2012 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Program Files%\Liveistream\mplayer\fonts\conf.d\30-metric-aliases.conf (5 bytes)
%Program Files%\Liveistream\translations\smplayer_pt.qm (4516 bytes)
%Program Files%\Liveistream\translations\smplayer_en_US.qm (96 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\60-latin.conf (1 bytes)
%Program Files%\Liveistream\Copying.txt (18 bytes)
%Program Files%\Liveistream\translations\smplayer_lt.qm (5133 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\30-urw-aliases.conf (1 bytes)
%Program Files%\Liveistream\QtNetwork4.dll (26959 bytes)
%Program Files%\Liveistream\dvdmenus.txt (1 bytes)
%Program Files%\Liveistream\translations\smplayer_gl.qm (8119 bytes)
%Program Files%\Liveistream\Not_so_obvious_things.txt (3 bytes)
%Program Files%\Liveistream\translations\smplayer_nl.qm (6504 bytes)
%Program Files%\Liveistream\mingwm10.dll (11 bytes)
%Program Files%\Liveistream\QtCore4.dll (62107 bytes)
%Program Files%\Liveistream\Copying_libmaia.txt (1 bytes)
%Program Files%\Liveistream\translations\smplayer_hr.qm (7712 bytes)
%Program Files%\Liveistream\Copying_BSD.txt (1 bytes)
%Program Files%\Liveistream\mplayer\mplayer\config (43 bytes)
%Program Files%\Liveistream\translations\smplayer_ka.qm (1568 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\51-local.conf (189 bytes)
%Program Files%\Liveistream\mplayer\mplayer\subfont.ttf (11619 bytes)
%Program Files%\Liveistream\translations\smplayer_cs.qm (4502 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\45-latin.conf (3 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\65-nonlatin.conf (7 bytes)
%Program Files%\Liveistream\translations\smplayer_sl_SI.qm (1568 bytes)
%Program Files%\Liveistream\translations\smplayer_fr.qm (6509 bytes)
%Program Files%\Liveistream\Watching_TV.txt (4 bytes)
%Program Files%\Liveistream\Finding_subtitles.txt (863 bytes)
%Program Files%\Liveistream\translations\smplayer_zh_CN.qm (4181 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\10-scale-bitmap-fonts.conf (1 bytes)
%Program Files%\Liveistream\zlib1.dll (956 bytes)
%Program Files%\Liveistream\imageformats\qjpeg4.dll (7535 bytes)
%Program Files%\Liveistream\translations\smplayer_et.qm (4021 bytes)
%Program Files%\Liveistream\translations\smplayer_he_IL.qm (4495 bytes)
%Program Files%\Liveistream\translations\smplayer_da.qm (4794 bytes)
%Program Files%\Liveistream\translations\smplayer_fi.qm (5233 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\65-fonts-persian.conf (10 bytes)
%Program Files%\Liveistream\uninstall.exe (1328 bytes)
%Documents and Settings%\%current user%\Desktop\Liveistream.lnk (703 bytes)
%Program Files%\Liveistream\translations\smplayer_de.qm (4984 bytes)
%Program Files%\Liveistream\translations\smplayer_eu.qm (6184 bytes)
%Program Files%\Liveistream\translations\smplayer_pt_BR.qm (4251 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\20-unhint-small-vera.conf (1 bytes)
%Program Files%\Liveistream\Readme.txt (3 bytes)
%Program Files%\Liveistream\translations\smplayer_vi_VN.qm (2414 bytes)
%Program Files%\Liveistream\translations\smplayer_ro_RO.qm (5204 bytes)
%Program Files%\Liveistream\mplayer\README.txt (3 bytes)
%Program Files%\Liveistream\mplayer\mplayer\input.conf (4 bytes)
%Program Files%\Liveistream\Install.txt (3 bytes)
%Program Files%\Liveistream\mplayer\MPlayer.html (13585 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Uninstall Liveistream.lnk (720 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream Website.lnk (770 bytes)
%Program Files%\Liveistream\translations\smplayer_hu.qm (3128 bytes)
%Program Files%\Liveistream\mplayer\LICENSE.txt (18 bytes)
%Program Files%\Liveistream\translations\smplayer_ru_RU.qm (6439 bytes)
%Program Files%\Liveistream\translations\smplayer_ar_SY.qm (2704 bytes)
%Program Files%\Liveistream\translations\smplayer_ko.qm (2808 bytes)
%Program Files%\Liveistream\translations\smplayer_th.qm (4402 bytes)
%Program Files%\Liveistream\sample.avi (29 bytes)
%Program Files%\Liveistream\translations\smplayer_sk.qm (3727 bytes)
%Program Files%\Liveistream\translations\smplayer_pl.qm (3799 bytes)
%Program Files%\Liveistream\translations\smplayer_sr.qm (6826 bytes)
%Program Files%\Liveistream\Liveistream website.url (51 bytes)
%Program Files%\Liveistream\mplayer\mplayer.exe (463001 bytes)
%Program Files%\Liveistream\translations\smplayer_ms_MY.qm (7328 bytes)
%Program Files%\Liveistream\translations\smplayer_it.qm (2763 bytes)
%Program Files%\Liveistream\QtXml4.dll (10675 bytes)
%Program Files%\Liveistream\Release_notes.txt (19 bytes)
%Program Files%\Liveistream\translations\smplayer_ja.qm (4666 bytes)
%Program Files%\Liveistream\translations\smplayer_ca.qm (4228 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\40-nonlatin.conf (5 bytes)
%Program Files%\Liveistream\smplayer.exe (58749 bytes)
%Program Files%\Liveistream\translations\smplayer_zh_TW.qm (2242 bytes)
%Program Files%\Liveistream\translations\smplayer_ku.qm (2679 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream.lnk (715 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\50-user.conf (673 bytes)
%Program Files%\Liveistream\translations\smplayer_es.qm (7068 bytes)
%Program Files%\Liveistream\translations\smplayer_el_GR.qm (6541 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\README (959 bytes)
%Program Files%\Liveistream\translations\smplayer_bg.qm (1568 bytes)
%Program Files%\Liveistream\Portable_Edition.txt (1 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\90-synthetic.conf (1 bytes)
%Program Files%\Liveistream\libgcc_s_dw2-1.dll (2752 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\69-unifont.conf (672 bytes)
%Program Files%\Liveistream\QtGui4.dll (257266 bytes)
%Program Files%\Liveistream\translations\qt_eu.qm (3054 bytes)
%Program Files%\Liveistream\mplayer\mplayer\config.sample (357 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\49-sansserif.conf (545 bytes)
%Program Files%\Liveistream\translations\smplayer_tr.qm (3134 bytes)
%Program Files%\Liveistream\mplayer\mplayer.man.html (16053 bytes)
%Program Files%\Liveistream\QtScript4.dll (48407 bytes)
%Program Files%\Liveistream\translations\smplayer_mk.qm (2507 bytes)
%Program Files%\Liveistream\translations\smplayer_sv.qm (1568 bytes)
%Program Files%\Liveistream\mplayer\fonts\fonts.conf (5 bytes)
%Program Files%\Liveistream\mplayer\fonts\conf.d\80-delicious.conf (422 bytes)
%Program Files%\Liveistream\shortcuts\default.keys (3 bytes)
%Program Files%\Liveistream\translations\smplayer_uk_UA.qm (5905 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nssB4.tmp (0 bytes)
The process rd.exe:1292 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (6590 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (5521 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914066800710\LiveiStream.exe (1881417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\LiveiStream[1].exe (2527563 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (948 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (2321 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (0 bytes)
Registry activity
The process wmic.exe:288 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 60 BB 4E 44 B8 2A 7F 97 65 CF 0E 8E 0D 11 33"
The process %original file name%.exe:1356 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "15 35 6B 93 D3 94 8A 84 73 7C 81 CE 09 BF 1C 5F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process LiveiStream.exe:2012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"DisplayIcon" = "%Program Files%\Liveistream\smplayer.exe"
"DisplayVersion" = "00.00.00.00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\App Paths\smplayer.exe]
"(Default)" = "%Program Files%\Liveistream\smplayer.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"URLInfoAbout" = "http://www.liveistream.tv"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"Publisher" = "Liveistream"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 B3 DB BB 77 C2 2B AB 4A 0E 40 68 E4 EE 95 7F"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"DisplayName" = "Liveistream"
"UninstallString" = "%Program Files%\Liveistream\uninstall.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Liveistream]
"Start Menu Folder" = "Liveistream"
The process rd.exe:1292 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rd.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 F0 AA C3 FD 4B 17 5F FD 29 45 FA C1 9B B7 4C"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
Dropped PE files
| MD5 | File path |
|---|---|
| 43beb25532046d8f45dccbe1cf7c86b2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\914066800710\LiveiStream.exe |
| 3222622219ab6139b3d433934ebf55a0 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsrB3.tmp\Convert.dll |
| 5f13dbc378792f23e598079fc1e4422b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsrB3.tmp\nsisunz.dll |
| b950b7d00028a589f3a6b9889de51782 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\rd.exe |
| 43beb25532046d8f45dccbe1cf7c86b2 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\LiveiStream[1].exe |
| e14e7a4e8d7fd466eff02351386f61fd | c:\Program Files\Liveistream\QtCore4.dll |
| 8bb9f50b08dabf0cf42d4b000620a4f5 | c:\Program Files\Liveistream\QtGui4.dll |
| a770b65450d4b140abdda1e05333f8b9 | c:\Program Files\Liveistream\QtNetwork4.dll |
| 1bedcb7dd8172d9e949354186944e397 | c:\Program Files\Liveistream\QtScript4.dll |
| 381024335f34c288aa9b69b7181f4619 | c:\Program Files\Liveistream\QtXml4.dll |
| afff4a16de65a9345133e40549c235ca | c:\Program Files\Liveistream\imageformats\qjpeg4.dll |
| c4b4409f186da70fcf2bcc60d5f05489 | c:\Program Files\Liveistream\libgcc_s_dw2-1.dll |
| dbda60d92e774b4acb3b1cd71f909426 | c:\Program Files\Liveistream\mingwm10.dll |
| 780daa4d6acfc6475f6910138ee44271 | c:\Program Files\Liveistream\mplayer\mplayer.exe |
| 6393a96d0339f42d847ad55ae4219f83 | c:\Program Files\Liveistream\smplayer.exe |
| 8882739b9b39d7385194d3986a09a889 | c:\Program Files\Liveistream\uninstall.exe |
| 6ee35683d4e88933caf9ef8c00ce5143 | c:\Program Files\Liveistream\zlib1.dll |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Static Analysis
VersionInfo
Company Name:
Product Name: setup
Product Version: 5.0
Legal Copyright: setup
Legal Trademarks: setup
Original Filename:
Internal Name:
File Version:
File Description: setup
Comments: setup Installer
Language: English (United States)
Company Name: Product Name: setup Product Version: 5.0Legal Copyright: setupLegal Trademarks: setupOriginal Filename: Internal Name: File Version: File Description: setup Comments: setup InstallerLanguage: English (United States)
PE Sections
| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
|---|---|---|---|---|---|
| .text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
| .rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
| .data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
| .ndata | 192512 | 36864 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
| .rsrc | 229376 | 3160 | 3584 | 2.74973 | 8a241582d1764567a3f709b91b89032d |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 1706
ad987a179c03370db0a1386816158695
0a1f004b62803f3fb9df5fa29bd4f4c4
4dc5e8a77f881d0fffcd0b1a004d4049
63d555e82324b625b5761aee238d0385
bc2b7b3ea4f5c551cca84e6304d1a66f
e689bfe629c4d6f5c6e0b800309bc2fe
a6d45df65e886d687d125bfb2284b7ca
5098f3e15c111b6441e3cbfbed6dc214
899eb46fff5e66f11e2707a3224ca2b3
0935ceeb276ca645e41af021a3ed76d3
11f6b8c5c261ea8677acd4de7bbd24f8
0cfa2bbaee1e7e889d508e8a63fced57
1070529ffc03e88aaaeaa1398d847e82
d6404f0ce456d406cbffae078ebd80ed
7a052f03cbe6e2f174a8e70e3d0869b5
523d8444192b25bb6a0d061cf3b88d7e
93eb403ac5e1522007c2c72e3d43a9ac
7661bed69040f18a074dae6ec9dc648c
d1161ea41d58b296fbb11381169903e7
8fdd47869084df3c1b3db69dcafdbbdf
ad4cb988d36fe21c1aae172eb18d603d
14f44ef4cc6ec691bfdd68643fecbd09
974f822a551a93de96dde5025475f466
10114a187289d6b48f2fa5d67b24d42b
7379c9605b7113e8fa306362f749a1d0
ec97367be06cbc2e42f5cdbfc7c0d61c
Network Activity
URLs
| URL | IP |
|---|---|
| hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/ProductS/LiveiStream.exe | |
| hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css | |
| hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css | |
| hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js | |
| hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg | |
| hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png | |
| hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png | |
| hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&reqid=127786953&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=1694&offerscreenid=&offerorder=22&downloadduration=10766&installduration=109&issecond=0 | |
| hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=127786953&x=y&clickid=1120202166 | |
| hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& | |
| hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2 | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png | |
| hxxp://cdn-ppdownload.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png | |
| hxxp://smartinstaller.elasticbeanstalk.com/installer/ThankYouInner?productid=1694&productname=FLV Player&d1=16438 | |
| hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js | |
| hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_45.js | |
| hxxp://pagead46.l.doubleclick.net/gampad/ads?gdfp_req=1&correlator=3337422373247795&output=json_html&callback=window.parent.googletag.impl.pubads.setAdContentsBySlotForAsync&impl=fifs&json_a=1&iu_parts=5612216,TYP&enc_prev_ius=/0/1&prev_iu_szs=1200x1400&cookie_enabled=1&cdm=data.getserverinfo.com&lmt=1406680098&dt=1406680098351&cc=42&ea=0&frm=23&biw=1004&bih=615&oid=3&adks=231420566&osd=1&oe=utf-8&gut=v2&ifi=1&ifk=809129705&u_tz=180&u_java=true&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&flash=11.6.602.168&url=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&ref=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&vrg=45&vrp=45&ga_vid=240277465.1406680098&ga_sid=1406680098&ga_hid=1570451532 | |
| hxxp://static.revenyou.com/offers/images/Theme8/button.png | 198.232.124.224 |
| hxxp://www.googletagservices.com/tag/js/gpt.js | 173.194.43.58 |
| hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& | 54.235.198.46 |
| hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png | 64.233.171.95 |
| hxxp://cdn.ppdownload.com/ProductS/LiveiStream.exe | 198.232.124.224 |
| hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css | 64.233.171.95 |
| hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css | 198.232.124.224 |
| hxxp://pubads.g.doubleclick.net/gampad/ads?gdfp_req=1&correlator=3337422373247795&output=json_html&callback=window.parent.googletag.impl.pubads.setAdContentsBySlotForAsync&impl=fifs&json_a=1&iu_parts=5612216,TYP&enc_prev_ius=/0/1&prev_iu_szs=1200x1400&cookie_enabled=1&cdm=data.getserverinfo.com&lmt=1406680098&dt=1406680098351&cc=42&ea=0&frm=23&biw=1004&bih=615&oid=3&adks=231420566&osd=1&oe=utf-8&gut=v2&ifi=1&ifk=809129705&u_tz=180&u_java=true&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&flash=11.6.602.168&url=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&ref=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&vrg=45&vrp=45&ga_vid=240277465.1406680098&ga_sid=1406680098&ga_hid=1570451532 | 173.194.43.57 |
| hxxp://static.revenyou.com/offers/images/Theme8/button_over.png | 198.232.124.224 |
| hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js | 64.233.171.95 |
| hxxp://data.getserverinfo.com/Installer/Flow?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 | 54.235.198.46 |
| hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js | 64.233.171.95 |
| hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg | 198.232.124.224 |
| hxxp://data.getserverinfo.com/Installer/Track?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&reqid=127786953&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=1694&offerscreenid=&offerorder=22&downloadduration=10766&installduration=109&issecond=0 | 54.235.198.46 |
| hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg | 198.232.124.224 |
| hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg | 198.232.124.224 |
| hxxp://data.getserverinfo.com/installer/ThankYouInner?productid=1694&productname=FLV Player&d1=16438 | 54.235.198.46 |
| hxxp://data.getserverinfo.com/Installer/TrackFinish?reqid=127786953&x=y&clickid=1120202166 | 54.235.198.46 |
| hxxp://partner.googleadservices.com/gpt/pubads_impl_45.js | 173.194.43.58 |
| hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& | 54.235.198.46 |
| hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png | 198.232.124.224 |
| hxxp://static.revenyou.com/offers/images/Theme8/topComp.png | 198.232.124.224 |
| hxxp://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2 | 54.235.198.46 |
| hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg | 198.232.124.224 |
| hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png | 64.233.171.95 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Jul 2014 05:25:49 GMT
Content-Type: text/css
Content-Length: 20706
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT
ETag: "ca38195cd123cd1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 06 Aug 2014 05:25:49 GMT
X-Cache: HIT
Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/UI/Theming/API. */../* Layout helpers.----------------------------------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helper-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.----------------------------------*/..ui-state-disabled { cursor: default !important; }.../* Icons.----------------------------------*/../* states and images */..ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }.../* Misc visuals.----------------------------------*/../* Overlays */..ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<
<<< skipped >>>
GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:25:50 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:25:50 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>....
<<
<<< skipped >>>
GET /Installer/Flow?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 30 Jul 2014 05:25:49 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 23800
Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"83$.Fmkcsez_oajgRvjdo"8.)-&4* 6., M]bDcv.9."*.J``Ibs50"8..'.PbjnntL\e`.8.Phnts\d.&.T_`phcm9g^pq.*.Rcb;g^_k,.' Dj[pl@^md."*.Hmhbr]sED 5,3% >fv]yqJ^a^p.4/("GnO\brCiqEnqoYge 7 .Ev`MME 7.!("Cs]PKJ/.9."*.;jfk^hcHil`.5. ).NbfcmMME 7.gptn5'*]go_bp.rc](Znmm,pr_^c)\mj).kfd`jn(Bvh`iiaJ^a^pP]qael:ga_cocc9274._bqqcc9152-!ec^^o9144,!\mrhsnyg_52*$psr^ir8 -.bc\<,&f]5-.*.L`pe 5%,% >^cetgjf\eB^n`.: .)22 /.64-//,11 ).@jtgqamnqbmQagI`qn.8.. .P_tgpm 7'0("Ca^`\rfpd.: ,$.IplgnpimiJ\mc.4,-, ?an\pbj`jcwMYo^ 7'0("Qg]`i?cndnIlnl\ej.4/y,y.HjlrBrd.: .$.Ipb?wa"8..'.AlgokncilOrnb.9,, Hgibrft`pimiLticp.9.2 ..'.PbaJay 5.CDCVYBQRP@FOXSP?Q.SmalrZpbV[Oe_m[cIplnd_tUN.'.PbaJay4/.5.FH?X[CSMJ@GR\ORAR.Ngamu^ldX\Q`Ym\fMlnpeaoON.*.LdlopoF\fc.4!Oe_m[cIplnd_t.RK-.*.Jqkds^lD= 7 6440'.<eu^srKfd`j.3.).HoW_dlAhpFhrpajg.5**.?waUPG.5.fqno6/-_d,'blqmoepq]m ,`il Ilnl\ejbl.Oe_m[cIplnd_tE`f`kg`)Raap^`Kkmq_bpGci]mba/(dte '.@qcRLK."8.`omn7).`l/)\jplp_qrep-&^hk,Cmot_gd`k-P_`ncfKjjmc`nFancma^(Qb[q_hNmgo^aqAdjepd[-'cu_!("AjehZlaFhje 5..(PBA<SS...*<RF><?T1.*1 12. .Oda]mNPI.9.hroh5(-acqacr)lc^ ^joo-rmY^d,`il /ma^`kq,>xjakd[J_dblR_rc`f:hdc_qed;,)2.noicqcrd\8*55.1"dgnld];.161&j`Y_i;.080&ajmimpvcc97/!ktl`fn</2$_^]6.#ba92 '.MZrb.9)1*.9_]gqcnjaj?YoZ 7.!("?ildogoorasP`_F^wp.9."*.H\rmrn!6-/'.@_db]sevc.2(**.JqkmmoajgP^nd.: ,$.=gp]qap_i[tK_q_!6-/
<<
<<< skipped >>>
GET /Installer/Track?pubid=7302&distid=1775&productid=1694&subpubid=0&campaignid=0&networkid=0&reqid=127786953&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:68:17:BB&netv=&d1=16438&d2=-1&d3=-1&d4=-1&d5=-1&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=1694&offerscreenid=&offerorder=22&downloadduration=10766&installduration=109&issecond=0 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 30 Jul 2014 05:26:00 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK......
GET /Installer/TrackFinish?reqid=127786953&x=y&clickid=1120202166 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 30 Jul 2014 05:25:57 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK....
GET /gampad/ads?gdfp_req=1&correlator=3337422373247795&output=json_html&callback=window.parent.googletag.impl.pubads.setAdContentsBySlotForAsync&impl=fifs&json_a=1&iu_parts=5612216,TYP&enc_prev_ius=/0/1&prev_iu_szs=1200x1400&cookie_enabled=1&cdm=data.getserverinfo.com&lmt=1406680098&dt=1406680098351&cc=42&ea=0&frm=23&biw=1004&bih=615&oid=3&adks=231420566&osd=1&oe=utf-8&gut=v2&ifi=1&ifk=809129705&u_tz=180&u_java=true&u_h=768&u_w=1024&u_ah=740&u_aw=1024&u_cd=32&flash=11.6.602.168&url=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&ref=http://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2&vrg=45&vrp=45&ga_vid=240277465.1406680098&ga_sid=1406680098&ga_hid=1570451532 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pubads.g.doubleclick.net
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Google-LineItem-Id: -2
Google-Creative-Id: -2
Content-Type: text/javascript; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Date: Wed, 30 Jul 2014 05:26:10 GMT
Server: cafe
Cache-Control: private
Content-Length: 345
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 30-Jul-2014 05:41:10 GMT; path=/; domain=.doubleclick.net
Expires: Wed, 30 Jul 2014 05:26:10 GMT
..........U.AO.@.....4.RJ)P..P#F..1!.4Cw....uw[h.....C=.o.L... )?8.$..I9Os..:...#..P.(.3...6.5oV9..\.TS.W.'...}........'..F`DB.."'7$.......4.\..vhM..J&....Y.Y.....Fuf..UX....ee.LE......=Ce.I...Wm.....a.....a<.c...}7.&....W....2z.ZVl..=>=|..~._.c..>o~Tz..d{....`b....f$=....VZ..V(k..L......6.D.....6.e@S. .u.i'.t..0...}/vB.#.?)...........J.......HTTP/1.1 200 OK..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Google-LineItem-Id: -2..Google-Creative-Id: -2..Content-Type: text/javascript; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Disposition: attachment; filename="f.txt"..Content-Encoding: gzip..Date: Wed, 30 Jul 2014 05:26:10 GMT..Server: cafe..Cache-Control: private..Content-Length: 345..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..Set-Cookie: test_cookie=CheckForPermission; expires=Wed, 30-Jul-2014 05:41:10 GMT; path=/; domain=.doubleclick.net..Expires: Wed, 30 Jul 2014 05:26:10 GMT............U.AO.@.....4.RJ)P..P#F..1!.4Cw....uw[h.....C=.o.L... )?8.$..I9Os..:...#..P.(.3...6.5oV9..\.TS.W.'...}........'..F`DB.."'7$.......4.\..vhM..J&....Y.Y.....Fuf..UX....ee.LE......=Ce.I...Wm.....a.....a<.c...}7.&....W....2z.ZVl..=>=|..~._.c..>o~Tz..d{....`b....f$=....VZ..V(k..L......6.D.....6.e@S. .u.i'.t..0...}/vB.#.?)...........J.........
<<
<<< skipped >>>
GET //offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 30 Jul 2014 05:25:49 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 7542
Connection: keep-alive
.<html>. <head>. . <style type="text/css">. .ui-progressbar-value { background-image: url(images/pbar-ani.gif); }. </style>. . <link type="text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css" rel="stylesheet" />. <link href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css" rel="stylesheet" type="text/css" />. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js"></script>. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>.. <title>2 - NonProduct (FLV Player)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-l
<<
<<< skipped >>>
GET //offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Wed, 30 Jul 2014 05:26:04 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 6258
Connection: keep-alive
<html>. <head>. <title>4 - NonProduct (FLV Player)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-left:1px; right: 1%; background:url("hXXp://static.revenyou.com/offers/images/Theme8/button.png");} .divAccept { text-align:center; font-family:Arial halvetica; width:89px; position:absolute; font-size:12px; bottom: 7px; margin-left:1px; right: 2%;} .divDecline { text-align:center;height:26px; bottom: 8px; cursor:pointer; font-family:Arial helvetica; font-size:12px; position:absolute; left:1%; padding-top: 4px;} .divAgreementLeadP{ position:absolute; bottom:46px; left:3px;font-size:10px; } #divAgreementLeadPWelcome {bottom:46px;position:absolute;left:187px;font-size:10px;} a:visited { color:Blue;
<<
<<< skipped >>>
GET /ProductS/LiveiStream.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.ppdownload.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Jul 2014 05:25:49 GMT
Content-Type: application/octet-stream
Content-Length: 18882288
Connection: keep-alive
x-amz-id-2: YatrtHRdLsK26eekxasXh6ysSlaIRORnzt3iJfwPLig8vdX1Xa UrtLEgI0ijzE0
x-amz-request-id: C9D9649E72638C50
Last-Modified: Tue, 15 Jul 2014 12:41:43 GMT
ETag: "43beb25532046d8f45dccbe1cf7c86b2"
Server: NetDNA-cache/2.2
Content-Disposition: attachment
X-Cache: HIT
Accept-Ranges: bytes
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@.................................E- ......................................t.......... B...........................................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc... B.......D...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<
<<< skipped >>>
GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/button_over.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: image/png
Content-Length: 921
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT
ETag: "f072da2a092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 06 Aug 2014 05:26:07 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."%=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[........sL..?@.o....y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K........YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N........*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..tsvP!.U0.q.......9z.e ..0.ALt..@l..2iR.2............. .>=...{WVim....f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o6......@..........n.^......IEND.B`...
GET /gpt/pubads_impl_45.js HTTP/1.1
Accept: */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=1694&pubid=7302&distid=1775&countryid=71&reqid=127786953&sysbit=32&d1=16438&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partner.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Wed, 16 Jul 2014 15:23:21 GMT
Date: Thu, 24 Jul 2014 19:41:20 GMT
Expires: Fri, 24 Jul 2015 19:41:20 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 31222
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 467087
Alternate-Protocol: 80:quic
......n.....ww.F.8..>..'W...E.%1 ...\...F1:.`AB.&@.[....l....?...K......Nq..,......]....}..Q..ehR..m)..r.{1....^..5.<...Y. %..(,..b... K]g....p.0. .y..n6..>.1...._{.-.c...y.R%*.n.`;q(c.....c..b..Xf.a;....E............z...T.*..;........XB@..=..a1..wV.D..L$.^../&Y,..BG.bY\..O.b......5'.....6..t...{...fq2j]......*{...Y.I.vU.l.y.....L..*...]./.^.5.y..T...r.\..i'RZP/..U.J...U^........}.Dc....N..=......\...zlW.fC.:.d....l.%gN...<........F......;.....2.].....n9.m.XL.]....0........|^)J%aU..W.......r.t.....rj.......uNs.....".H/.n.:.?T....V.|....Z....Wq8..z...l.......\.. Z..L...t..%.p.zm....pZf....n<O...2...}.{...{..Dc.>..h...77..h........e..zz%.*\..x,...q.3.f....^..W"../.Eqsc.\.K;-...).... 60..a..5p=/......y../.a..O/....?.7...ZWuh7..'..2........e>....i.s.b..../C.).V.z.R...:..@......v.]Y..&....uxI..%L.p.... .i.........<...x...).;........1[...r. \.k.c."..P.j;r.pp.N9...`jO..OE.<Y..|J...a..g.........W.3...a..yA..0....V.l.T...R,&8........p...J_mL.........8.g..Gn..`"xX.......E.W]=..F..sO....72..y....s..y......u.............W..F.K*...zv.l...}...~........._.~/....^./V..;_..........!{......s..p..|.].=...........Z..*P3....y.a....0..?.q....j.K...d"0.:Iv.X7.....Y.@...0...^v..N)!d..k..../..n.......,\....8.".6n.&;...7....qSu...r>}..<...I.:...fk&./>.~.......`j.-...(.$....;....q;..[.&.6L.p4.....w.......r.@..._fE<r. ...90...p.}'.....D.;....q.u...........I..Y.......Wf..........L....8..q..pO..}.r.......S.;....C..}F...g..3.....>..Y.g..W...._.C.o..:. ....g..bk.(|..'.v....G.....F...Y.g..KMm.._....)W.
<<
<<< skipped >>>
GET /offers/images/Theme8/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:25:50 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:25:50 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>....
<<
<<< skipped >>>
GET /offers/images/Theme8/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/bodyImg.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: image/png
Content-Length: 1914
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT
ETag: "36dd864c691ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 06 Aug 2014 05:26:07 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...0PLTE................................................{.......IDATx......:..`..p..J.4.ty.:......)v..\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..]..8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._..d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..>).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8........KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y..)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y...... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S.....W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>.@.Bi....HS)eM.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J...,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<
<<< skipped >>>
GET /offers/images/Theme8/nextCase.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<
<<< skipped >>>
GET /offers/images/Theme8/button.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Jul 2014 05:26:07 GMT
Content-Type: image/png
Content-Length: 458
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT
ETag: "1b5642f092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Wed, 06 Aug 2014 05:26:07 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...
GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/css; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 30 Jul 2014 04:26:25 GMT
Expires: Wed, 30 Jul 2014 05:26:25 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 6091
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 3564
Alternate-Protocol: 80:quic
...........=k.....3...E...yl.=.=.....7@..6..~...e.#K.$.#A..=.!%J|iz...;@Z.:...y..}..........X.H~{G...O~......-.M^M....@o..c.....Og.s............!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.WO8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ........... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}...t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>......|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}g@G..m^...S2.gn.h......;V.yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or..%X...78.I.>..Y.99@.........U......4....5.......2.......UY.<.W EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M... ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<._.. J.YK.:9.H}3....U.B..$..W..f$l]^m....@..c..........0.h...l.q.,(."......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v..~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4...1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t...M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 30 Jul 2014 04:35:08 GMT
Expires: Wed, 30 Jul 2014 05:35:08 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 51558
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 3042
Alternate-Protocol: 80:quic
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...AP...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3..................E1.-.uz..........ZXI..rZm....../X...4.......@..Z......yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,......j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,....J.@.b.....l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xvrR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9..S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvIo^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../...._.........4..s........x..z|...^|.../.._..?.z..............?.......?=......N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y....c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3........Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T.....D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\..m...@.0......\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!Vo........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=1775&leadp=1694&countryid=71&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Wed, 30 Jul 2014 04:42:37 GMT
Expires: Wed, 30 Jul 2014 05:42:37 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 3457
X-XSS-Protection: 1; mode=block
Age: 2593
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Alternate-Protocol: 80:quic
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B....6...._.d.c.......*...V......|U.......w-...p..>Z..........`............`............`............`............`............`............`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."...-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C.....y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._<....p.p....`............`..b.......:............:.............Xj)...w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7.....;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O.....m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD..M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x.....].?/..9r......h...]^}M....<....;..........p.p....`........}.....n..~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M......j..4.%..x......!ij....bXcT..^ file.
%Documents and Settings%\%current user%\Local Settings\Temp\91406680071.txt (238 bytes)%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)%Documents and Settings%\%current user%\Local Settings\Temp\rd.zip (57028 bytes)%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\Convert.dll (4635 bytes)%Documents and Settings%\%current user%\Local Settings\Temp\nsrB3.tmp\nsisunz.dll (211 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\30-metric-aliases.conf (5 bytes)%Program Files%\Liveistream\translations\smplayer_pt.qm (4516 bytes)%Program Files%\Liveistream\translations\smplayer_en_US.qm (96 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\60-latin.conf (1 bytes)%Program Files%\Liveistream\Copying.txt (18 bytes)%Program Files%\Liveistream\translations\smplayer_lt.qm (5133 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\30-urw-aliases.conf (1 bytes)%Program Files%\Liveistream\QtNetwork4.dll (26959 bytes)%Program Files%\Liveistream\dvdmenus.txt (1 bytes)%Program Files%\Liveistream\translations\smplayer_gl.qm (8119 bytes)%Program Files%\Liveistream\Not_so_obvious_things.txt (3 bytes)%Program Files%\Liveistream\translations\smplayer_nl.qm (6504 bytes)%Program Files%\Liveistream\mingwm10.dll (11 bytes)%Program Files%\Liveistream\QtCore4.dll (62107 bytes)%Program Files%\Liveistream\Copying_libmaia.txt (1 bytes)%Program Files%\Liveistream\translations\smplayer_hr.qm (7712 bytes)%Program Files%\Liveistream\Copying_BSD.txt (1 bytes)%Program Files%\Liveistream\mplayer\mplayer\config (43 bytes)%Program Files%\Liveistream\translations\smplayer_ka.qm (1568 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\51-local.conf (189 bytes)%Program Files%\Liveistream\mplayer\mplayer\subfont.ttf (11619 bytes)%Program Files%\Liveistream\translations\smplayer_cs.qm (4502 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\45-latin.conf (3 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\65-nonlatin.conf (7 bytes)%Program Files%\Liveistream\translations\smplayer_sl_SI.qm (1568 bytes)%Program Files%\Liveistream\translations\smplayer_fr.qm (6509 bytes)%Program Files%\Liveistream\Watching_TV.txt (4 bytes)%Program Files%\Liveistream\Finding_subtitles.txt (863 bytes)%Program Files%\Liveistream\translations\smplayer_zh_CN.qm (4181 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\10-scale-bitmap-fonts.conf (1 bytes)%Program Files%\Liveistream\zlib1.dll (956 bytes)%Program Files%\Liveistream\imageformats\qjpeg4.dll (7535 bytes)%Program Files%\Liveistream\translations\smplayer_et.qm (4021 bytes)%Program Files%\Liveistream\translations\smplayer_he_IL.qm (4495 bytes)%Program Files%\Liveistream\translations\smplayer_da.qm (4794 bytes)%Program Files%\Liveistream\translations\smplayer_fi.qm (5233 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\65-fonts-persian.conf (10 bytes)%Program Files%\Liveistream\uninstall.exe (1328 bytes)%Documents and Settings%\%current user%\Desktop\Liveistream.lnk (703 bytes)%Program Files%\Liveistream\translations\smplayer_de.qm (4984 bytes)%Program Files%\Liveistream\translations\smplayer_eu.qm (6184 bytes)%Program Files%\Liveistream\translations\smplayer_pt_BR.qm (4251 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\20-unhint-small-vera.conf (1 bytes)%Program Files%\Liveistream\Readme.txt (3 bytes)%Program Files%\Liveistream\translations\smplayer_vi_VN.qm (2414 bytes)%Program Files%\Liveistream\translations\smplayer_ro_RO.qm (5204 bytes)%Program Files%\Liveistream\mplayer\README.txt (3 bytes)%Program Files%\Liveistream\mplayer\mplayer\input.conf (4 bytes)%Program Files%\Liveistream\Install.txt (3 bytes)%Program Files%\Liveistream\mplayer\MPlayer.html (13585 bytes)%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Uninstall Liveistream.lnk (720 bytes)%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream Website.lnk (770 bytes)%Program Files%\Liveistream\translations\smplayer_hu.qm (3128 bytes)%Program Files%\Liveistream\mplayer\LICENSE.txt (18 bytes)%Program Files%\Liveistream\translations\smplayer_ru_RU.qm (6439 bytes)%Program Files%\Liveistream\translations\smplayer_ar_SY.qm (2704 bytes)%Program Files%\Liveistream\translations\smplayer_ko.qm (2808 bytes)%Program Files%\Liveistream\translations\smplayer_th.qm (4402 bytes)%Program Files%\Liveistream\sample.avi (29 bytes)%Program Files%\Liveistream\translations\smplayer_sk.qm (3727 bytes)%Program Files%\Liveistream\translations\smplayer_pl.qm (3799 bytes)%Program Files%\Liveistream\translations\smplayer_sr.qm (6826 bytes)%Program Files%\Liveistream\Liveistream website.url (51 bytes)%Program Files%\Liveistream\mplayer\mplayer.exe (463001 bytes)%Program Files%\Liveistream\translations\smplayer_ms_MY.qm (7328 bytes)%Program Files%\Liveistream\translations\smplayer_it.qm (2763 bytes)%Program Files%\Liveistream\QtXml4.dll (10675 bytes)%Program Files%\Liveistream\Release_notes.txt (19 bytes)%Program Files%\Liveistream\translations\smplayer_ja.qm (4666 bytes)%Program Files%\Liveistream\translations\smplayer_ca.qm (4228 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\40-nonlatin.conf (5 bytes)%Program Files%\Liveistream\smplayer.exe (58749 bytes)%Program Files%\Liveistream\translations\smplayer_zh_TW.qm (2242 bytes)%Program Files%\Liveistream\translations\smplayer_ku.qm (2679 bytes)%Documents and Settings%\%current user%\Start Menu\Programs\Liveistream\Liveistream.lnk (715 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\50-user.conf (673 bytes)%Program Files%\Liveistream\translations\smplayer_es.qm (7068 bytes)%Program Files%\Liveistream\translations\smplayer_el_GR.qm (6541 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\README (959 bytes)%Program Files%\Liveistream\translations\smplayer_bg.qm (1568 bytes)%Program Files%\Liveistream\Portable_Edition.txt (1 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\90-synthetic.conf (1 bytes)%Program Files%\Liveistream\libgcc_s_dw2-1.dll (2752 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\69-unifont.conf (672 bytes)%Program Files%\Liveistream\QtGui4.dll (257266 bytes)%Program Files%\Liveistream\translations\qt_eu.qm (3054 bytes)%Program Files%\Liveistream\mplayer\mplayer\config.sample (357 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\49-sansserif.conf (545 bytes)%Program Files%\Liveistream\translations\smplayer_tr.qm (3134 bytes)%Program Files%\Liveistream\mplayer\mplayer.man.html (16053 bytes)%Program Files%\Liveistream\QtScript4.dll (48407 bytes)%Program Files%\Liveistream\translations\smplayer_mk.qm (2507 bytes)%Program Files%\Liveistream\translations\smplayer_sv.qm (1568 bytes)%Program Files%\Liveistream\mplayer\fonts\fonts.conf (5 bytes)%Program Files%\Liveistream\mplayer\fonts\conf.d\80-delicious.conf (422 bytes)%Program Files%\Liveistream\shortcuts\default.keys (3 bytes)%Program Files%\Liveistream\translations\smplayer_uk_UA.qm (5905 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (850 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button[1].png (458 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (6590 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\button_over[1].png (921 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\bodyImg[1].png (1 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (5521 bytes)%Documents and Settings%\%current user%\Local Settings\Temp\914066800710\LiveiStream.exe (1881417 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\LiveiStream[1].exe (2527563 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (948 bytes)%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (2321 bytes)