df8 298 WinMain df8 298 lpCmdLine: '-Embedding' df8 298 Run df8 298 lpCmdLine: '-Embedding' df8

298 nCmdShow: 10 df8 298 ServerInit 0 df8 298 VerifyRegistry df8 298 GetRegistryString 'Software\Yahoo\YServer' 'HomeDir' df8 298 returning 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 298 GetRegistryString 'Software\Yahoo\YServer' 'HomeDir' df8 298 returning 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 298 GetRegistryDWORD 'Software\Yahoo\YServer' 'Use Logfile' df8 298 RegQueryValueExt failed 2 for 'Use Logfile' df8 298 GetRegistryDWORD 'Software\Yahoo\Pager' 'Use Logfile' df8 298 returning '1' df8 298 GetRegistryString 'Software\Yahoo\YServer' 'LogFileName' df8 298 returning 'C:\PROGRA~1\Yahoo!\MESSEN~1\YServer.log' df8 268 CountdownThread df8 298 leaving ServerInit df8 298 entering message loop df8 298 CYServerComponent::CreateInstance df8 298 Not aggregating; delegate to nondelegating IUnknown df8 298 CYServerComponent::CYServerComponent df8 298 the COM library asked for IMarshal df8 298 CYServerComponent::SetMaxConnections 3 df8 298 CYServerComponent::IsServerRunning df8 298 CYServerComponent::StartServer df8 298 set gwGlobalErrorNumber to 0 df8 298 server not running: starting server df8 298 StartWebServerThread df8 298 GetRegistryString 'Software\Yahoo\YServer' 'HomeDir' df8 298 returning 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 298 set gszHomeDir to C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 298 CleanupShortcutFiles df8 298 GetRegistryInt 'Software\Yahoo\YServer' 'KeepShortcuts' 0 df8 298 GetRegistryString 'Software\Yahoo\YServer' 'KeepShortcuts' df8 298 RegQueryValueExt failed 2 for 'KeepShortcuts' df8 298 ReadIniFileString df8 298 section: [Info] key: 'Timestamp' default: '' df8 298 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\. df8 298 no chars read df8 298 ReadIniFileString df8 298 section: [Info] key: 'Timestamp' default: '' df8 298 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\.. df8 298 no chars read df8 298 ReadIniFileString df8 298 section: [Info] key: 'Timestamp' default: '' df8 298 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12787629 34500P1140762.JPG df8 298 returning 'C13E4C12B99CBB3A8B44242B942905AD' df8 298 ReadIniFileString df8 298 section: [Info] key: 'Timestamp' default: '' df8 298 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12787630 43750P1140611.JPG df8 298 returning '8D0C9A48FC3543B4EC76AF7ABEB7597C' df8 298 ReadIniFileString df8 298 section: [Info] key: 'Timestamp' default: '' df8 298 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12787630 55656P1140761.JPG df8 298 returning '378DBD8B4B946B7DB2D632D22F0D401A'

df8 298 leaving CleanupShortcutFiles df8 184 ServerThread df8 184 GetRegistryInt 'Software\Yahoo\YServer' 'IPPort' 80 df8 184 GetRegistryString 'Software\Yahoo\YServer' 'IPPort' df8 184 RegQueryValueExt failed 2 for 'IPPort' df8 184 set gnPort to 80 df8 184 calling CreateThread for ListenerThread df8 184 ListenerThread ID: 0xb08 df8 b08 binding ip: 1771344047 df8 b08 lcl_ListenSocket: 0x18c df8 b08 local IP addr: 175.144.148.105 df8 b08 local port: 80 df8 b08 calling bind df8 b08 listen socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 calling listen df8 b08 back from listen df8 b08 listen socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 allocated a pool of 3 handles df8 b08 AcceptAndHandleRequests df8 b08 IsFreeEntryInThreadArray df8 184 ReportInitProgress df8 298 leaving StartWebServerThread df8 298 returned from StartWebServerThread, the return code is 1. df8 298 CYServerComponent::IsServerRunning df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Docume nts and Settings\User\My Documents\My Pictures\skolah\P1140490.JPG df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 2 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Documents and Settings\User\My Documents\My Pictu res\skolah\P1140490.JPG' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278857677593P1140490.JPG df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278857677593P1140490.JP G?AppID=Messenger&UserID=mira_famous&K=lc9lu9

df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Documents and Settings\User\My Documents\My Pictures\skolah\P1140490.JPG Version=MSG1.0 df8 298 wrote Name=C:\Documents and Settings\User\My Documents\My Pictures\sk olah\P1140490.JPG df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=0C1D2B7F3472E0D72FD63333214A0D7E df8 298 df8 298 df8 298 W=525030 M=2 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=2 writing to ini file: wrote Timestamp=0C1D2B7F3472E0D72FD63333214A0D7E writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278857677593P114 0490.JPG?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278857677593P1140490.JPG df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 51374 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread

df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8

b08 b08 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8

ReportInitProgress AddHandlerThreadToThreadArray HandlerThread 0x1ac HTTPLog::HTTPLog HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' about to m_HTTPLog.SetSocket(m_sock) HTTPLog::SetSocket starting... socket=428 HTTPLog::SetSocket exiting about to g_RQT.AddHTTPRQH(this), this = 3620568 after calling g_RQT.AddHTTPRQH(this). total count = 1. about to create Kill Comm Event leaving HTTPRequestHandler::HTTPRequestHandler HTTPRequestHandler::ReadRequest HTTPRequestHandler::ReadRequest received 1024 bytes Found '\r\n\r\n' allocating entity body buffer to store read overflow from header 798 bytes 15 ms elapsed header is: <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

POST /Messenger.mira_famous.1278857677593P1140490.JPG?AppID=Messenger&UserID=mir a_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 558122 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 fc8 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> m_pEntityBodyBuffer: 0x374548 m_dwEntityBodyBufferSize: 16384 m_dwNumBytesInEntityBody: 798 HTTPRequestHandler::ParseRequest m_cRequest: POST UnescapeName DecodeURL before: Messenger before: Messenger after: Messenger UnescapeName DecodeURL before: mira_famous before: mira_famous after: mira_famous UnescapeName DecodeURL before: lc9lu9 before: lc9lu9 after: lc9lu9 extracted the filename from the URL. saving to m_cFileName: '/Messenger.mira_famous.1278857677593P1140490.JPG' m_cFileName: /Messenger.mira_famous.1278857677593P1140490.JPG ProcessYahooRequestParams DecodeURL

df8 fc8 before: Messenger.mira_famous.1278857677593P1140490.JPG df8 fc8 ValidateRequest df8 fc8 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278857677593P 1140490.JPG df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'App' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 'Messenger' df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'User' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 'mira_famous' df8 fc8 ReadIniFileInt df8 fc8 section: [Info] key: 'Post' default: 0 df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 1 df8 fc8 ValidateRequest: true df8 fc8 request is a Yahoo request df8 fc8 leaving ParseRequest df8 fc8 HandleFileReceive df8 fc8 file name: /Messenger.mira_famous.1278857677593P1140490.JPG df8 fc8 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 fc8 UnescapeName df8 fc8 DecodeURL df8 fc8 before: /Messenger.mira_famous.1278857677593P1140490.JPG df8 fc8 before: /Messenger.mira_famous.1278857677593P1140490.JPG df8 fc8 after: /Messenger.mira_famous.1278857677593P1140490.JPG df8 fc8 unescaped file name: /Messenger.mira_famous.1278857677593P1140490.JPG df8 fc8 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278857677593P1140490.JPG df8 fc8 HTTPRequestHandler::ReceiveRedirectedFile df8 fc8 HTTPRedirectHandler::HTTPRedirectHandler df8 fc8 GetBaseURL df8 fc8 bAddrContainsPort: 0 df8 fc8 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 57677593P1140490.JPG?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 fc8 HTTPRedirectHandler::Process df8 fc8 ValidateKeys df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'Timestamp' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning '0C1D2B7F3472E0D72FD63333214A0D7E' df8 fc8 szTimeStamp: '0C1D2B7F3472E0D72FD63333214A0D7E' df8 fc8 CSecretKey::CSecretKey df8 fc8 szApp: Messenger df8 fc8 szUser: mira_famous df8 fc8 szTimeStamp: 0C1D2B7F3472E0D72FD63333214A0D7E df8 fc8 CSecretKey::Init(). df8 fc8 m_szAppID: Messenger df8 fc8 m_szUserID: mira_famous df8 fc8 KeyMatches 'lc9lu9' df8 fc8 key comparison test passed... continuing df8 fc8 HTTPRedirectHandler::CheckRedirectFile df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG

df8 fc8 ReadIniFileInt df8 fc8 section: [Info] key: 'Dir' default: 0 df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 0 df8 fc8 set m_RType to RedirectTypeSingleFile df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'App' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 'Messenger' df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'User' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 'mira_famous' df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'Version' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 'MSG1.0' df8 fc8 ReadIniFileInt df8 fc8 section: [Info] key: 'Post' default: 0 df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 1 df8 fc8 m_szINIApp: 'Messenger' df8 fc8 m_szINIUser: 'mira_famous' df8 fc8 m_szINIVersionString: 'MSG1.0' df8 fc8 m_iIsPost: 1 df8 fc8 ReadIniFileInt df8 fc8 section: [Info] key: 'W' default: 0 df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 525030 df8 fc8 m_hWnd: 0x802e6 df8 fc8 ReadIniFileInt df8 fc8 section: [Info] key: 'M' default: 0 df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 2 df8 fc8 m_nMsgNumber: 2 df8 fc8 exit HTTPRedirectHandler::CheckRedirectFile df8 fc8 HTTPRedirectHandler::HandleRedirectSingleFile df8 fc8 ReadIniFileString df8 fc8 section: [Info] key: 'Name' default: '' df8 fc8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788576 77593P1140490.JPG df8 fc8 returning 'C:\Documents and Settings\User\My Documents\My Pictures\sk olah\P1140490.JPG' df8 fc8 set m_szFileToTransfer to C:\Documents and Settings\User\My Documents \My Pictures\skolah\P1140490.JPG df8 fc8 m_bProcessed: 1 [success] df8 fc8 exit HTTPRedirectHandler::Process df8 fc8 GetRedirInfo(), OutputFileName is C:\Documents and Setti ngs\User\My Documents\My Pictures\skolah\P1140490.JPG. df8 fc8 szOutputFilename is C:\Documents and Settings\User\My Do cuments\My Pictures\skolah\P1140490.JPG. df8 fc8 HTTPRedirectHandler::~HTTPRedirectHandler df8 fc8 m_cFileName: C:\Documents and Settings\User\My Documents\My Pictures\

skolah\P1140490.JPG df8 fc8 m_hWndReporting: 0x802e6 df8 fc8 m_nMsgNumber: 2 df8 fc8 RedirectType: 1 RedirectTypeSingleFile df8 fc8 bIsPost: 1 df8 fc8 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 fc8 SendMessage 0x802e6 df8 fc8 IPCInfo: df8 fc8 cFileName: 'C:\Documents and Settings\User\My Documents\My Pictures\s kolah\P1140490.JPG' df8 fc8 cUserID: 'mira_famous' df8 fc8 nStatus: 0 df8 fc8 nType: YSERVER_IPC_BEGIN df8 fc8 lFileLen: 0 df8 fc8 lCurrBytes: 0 df8 fc8 nMessageNumber: 2 df8 fc8 SendMessage processed df8 fc8 calling ReceiveFile C:\Documents and Settings\User\My Documents\My Pi ctures\skolah\P1140490.JPG df8 fc8 ReceiveFile df8 fc8 iContentLength: 558122 df8 fc8 ReceiveEntityBody df8 fc8 temp: C:\Documents and Settings\User\My Documents\My Pictures\skolah\ P1140490.JPG df8 fc8 dwBufSize: 16384 df8 fc8 dwNumBufBytesUsed: 798 df8 fc8 creating file C:\Documents and Settings\User\My Documents\My Pictures\sk olah\P1140490.JPG df8 fc8 flushed 798 bytes df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 798 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 17182 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 33566 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 49950 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 66334 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 82718 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 99102 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 115486 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 131870 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 148254 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 164638 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 181022 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 197406 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 213790 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 230174 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 246558 0

df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 262942 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 279326 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 295710 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 312094 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 328478 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 344862 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 361246 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 377630 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 394014 0 df8 fc8 ReadEntityBodyChunk 16384 df8 fc8 PostInfoToApp YSERVER_IPC_RECEIVING 410398 0 df8 fc8 ReadEntityBodyChunk 16384 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Docume nts and Settings\User\My Documents\My Pictures\skolah\P1140508.JPG df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 3 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Documents and Settings\User\My Documents\My Pictu res\skolah\P1140508.JPG' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278857733359P1140508.JPG df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278857733359P1140508.JP G?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Documents and Settings\User\My Documents\My Pictures\skolah\P1140508.JPG Version=MSG1.0

df8 298 wrote Name=C:\Documents and Settings\User\My Documents\My Pictures\sk olah\P1140508.JPG df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=6BE1330C1E7C4FA84E7C249EB9E25613 df8 298 df8 298 df8 298 W=525030 M=3 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=3 writing to ini file: wrote Timestamp=6BE1330C1E7C4FA84E7C249EB9E25613 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278857733359P114 0508.JPG?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278857733359P1140508.JPG df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 51380 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 b08 AddHandlerThreadToThreadArray df8 b08 IsFreeEntryInThreadArray df8 a74 about to m_HTTPLog.SetSocket(m_sock) df8 a74 HTTPLog::SetSocket starting... socket=412 df8 a74 HTTPLog::SetSocket exiting df8 a74 about to g_RQT.AddHTTPRQH(this), this = 3639624

df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8

a74 after calling g_RQT.AddHTTPRQH(this). total count = 2. a74 about to create Kill Comm Event a74 leaving HTTPRequestHandler::HTTPRequestHandler a74 HTTPRequestHandler::ReadRequest a74 HTTPRequestHandler::ReadRequest a74 received 226 bytes a74 Found '\r\n\r\n' a74 0 ms elapsed a74 header is: a74 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< a74

POST /Messenger.mira_famous.1278857733359P1140508.JPG?AppID=Messenger&UserID=mir a_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 465412 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 a74 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> df8 a74 m_pEntityBodyBuffer: 0x0 df8 a74 m_dwEntityBodyBufferSize: 0 df8 a74 m_dwNumBytesInEntityBody: 0 df8 a74 HTTPRequestHandler::ParseRequest df8 a74 m_cRequest: POST df8 a74 UnescapeName df8 a74 DecodeURL df8 a74 before: Messenger df8 a74 before: Messenger df8 a74 after: Messenger df8 a74 UnescapeName df8 a74 DecodeURL df8 a74 before: mira_famous df8 a74 before: mira_famous df8 a74 after: mira_famous df8 a74 UnescapeName df8 a74 DecodeURL df8 a74 before: lc9lu9 df8 a74 before: lc9lu9 df8 a74 after: lc9lu9 df8 a74 extracted the filename from the URL. saving to m_cFileName: df8 a74 '/Messenger.mira_famous.1278857733359P1140508.JPG' df8 a74 m_cFileName: /Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 ProcessYahooRequestParams df8 a74 DecodeURL df8 a74 before: Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 ValidateRequest df8 a74 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278857733359P 1140508.JPG df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'App' default: '' df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 'Messenger' df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'User' default: '' df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG

df8 a74 returning 'mira_famous' df8 a74 ReadIniFileInt df8 a74 section: [Info] key: 'Post' default: 0 df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 1 df8 a74 ValidateRequest: true df8 a74 request is a Yahoo request df8 a74 leaving ParseRequest df8 a74 HandleFileReceive df8 a74 file name: /Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 a74 UnescapeName df8 a74 DecodeURL df8 a74 before: /Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 before: /Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 after: /Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 unescaped file name: /Messenger.mira_famous.1278857733359P1140508.JPG df8 a74 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278857733359P1140508.JPG df8 a74 HTTPRequestHandler::ReceiveRedirectedFile df8 a74 HTTPRedirectHandler::HTTPRedirectHandler df8 a74 GetBaseURL df8 a74 bAddrContainsPort: 0 df8 a74 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 57733359P1140508.JPG?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 a74 HTTPRedirectHandler::Process df8 a74 ValidateKeys df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'Timestamp' default: '' df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning '6BE1330C1E7C4FA84E7C249EB9E25613' df8 a74 szTimeStamp: '6BE1330C1E7C4FA84E7C249EB9E25613' df8 a74 CSecretKey::CSecretKey df8 a74 szApp: Messenger df8 a74 szUser: mira_famous df8 a74 szTimeStamp: 6BE1330C1E7C4FA84E7C249EB9E25613 df8 a74 CSecretKey::Init(). df8 a74 m_szAppID: Messenger df8 a74 m_szUserID: mira_famous df8 a74 KeyMatches 'lc9lu9' df8 a74 key comparison test passed... continuing df8 a74 HTTPRedirectHandler::CheckRedirectFile df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 ReadIniFileInt df8 a74 section: [Info] key: 'Dir' default: 0 df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 0 df8 a74 set m_RType to RedirectTypeSingleFile df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'App' default: '' df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 'Messenger' df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'User' default: ''

df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 'mira_famous' df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'Version' default: '' df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 'MSG1.0' df8 a74 ReadIniFileInt df8 a74 section: [Info] key: 'Post' default: 0 df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 1 df8 a74 m_szINIApp: 'Messenger' df8 a74 m_szINIUser: 'mira_famous' df8 a74 m_szINIVersionString: 'MSG1.0' df8 a74 m_iIsPost: 1 df8 a74 ReadIniFileInt df8 a74 section: [Info] key: 'W' default: 0 df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 525030 df8 a74 m_hWnd: 0x802e6 df8 a74 ReadIniFileInt df8 a74 section: [Info] key: 'M' default: 0 df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 3 df8 a74 m_nMsgNumber: 3 df8 a74 exit HTTPRedirectHandler::CheckRedirectFile df8 a74 HTTPRedirectHandler::HandleRedirectSingleFile df8 a74 ReadIniFileString df8 a74 section: [Info] key: 'Name' default: '' df8 a74 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788577 33359P1140508.JPG df8 a74 returning 'C:\Documents and Settings\User\My Documents\My Pictures\sk olah\P1140508.JPG' df8 a74 set m_szFileToTransfer to C:\Documents and Settings\User\My Documents \My Pictures\skolah\P1140508.JPG df8 a74 m_bProcessed: 1 [success] df8 a74 exit HTTPRedirectHandler::Process df8 a74 GetRedirInfo(), OutputFileName is C:\Documents and Setti ngs\User\My Documents\My Pictures\skolah\P1140508.JPG. df8 a74 szOutputFilename is C:\Documents and Settings\User\My Do cuments\My Pictures\skolah\P1140508.JPG. df8 a74 HTTPRedirectHandler::~HTTPRedirectHandler df8 a74 m_cFileName: C:\Documents and Settings\User\My Documents\My Pictures\ skolah\P1140508.JPG df8 a74 m_hWndReporting: 0x802e6 df8 a74 m_nMsgNumber: 3 df8 a74 RedirectType: 1 RedirectTypeSingleFile df8 a74 bIsPost: 1 df8 a74 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 a74 SendMessage 0x802e6 df8 a74 IPCInfo: df8 a74 cFileName: 'C:\Documents and Settings\User\My Documents\My Pictures\s kolah\P1140508.JPG' df8 a74 cUserID: 'mira_famous' df8 a74 nStatus: 0 df8 a74 nType: YSERVER_IPC_BEGIN

df8 a74 lFileLen: 0 df8 a74 lCurrBytes: 0 df8 a74 nMessageNumber: 3 df8 a74 SendMessage processed df8 a74 calling ReceiveFile C:\Documents and Settings\User\My Documents\My Pi ctures\skolah\P1140508.JPG df8 a74 ReceiveFile df8 a74 iContentLength: 465412 df8 a74 ReceiveEntityBody df8 a74 temp: C:\Documents and Settings\User\My Documents\My Pictures\skolah\ P1140508.JPG df8 a74 dwBufSize: 16384 df8 a74 dwNumBufBytesUsed: 0 df8 a74 creating file C:\Documents and Settings\User\My Documents\My Pictures\sk olah\P1140508.JPG df8 a74 ReadEntityBodyChunk 16384 df8 fc8 recv failed SOCKET_ERROR 10054 df8 fc8 ReceiveBytes failed df8 fc8 ReadEntityBodyChunk failed df8 fc8 closing file C:\Documents and Settings\User\My Documents\My Pictures\sko lah\P1140490.JPG df8 fc8 ReceiveEntityBodyToFile failed df8 fc8 deleting C:\Documents and Settings\User\My Documents\My Pictures\skolah\ P1140490.JPG df8 fc8 ReceiveEntityBody failed df8 fc8 ReceiveFile failed for C:\Documents and Settings\User\My Documents\My Pi ctures\skolah\P1140490.JPG df8 fc8 PostInfoToApp YSERVER_IPC_FINISHED -1 0 df8 fc8 SendMessage 0x802e6 df8 fc8 IPCInfo: df8 fc8 cFileName: 'C:\Documents and Settings\User\My Documents\My Pictures\s kolah\P1140490.JPG' df8 fc8 cUserID: 'mira_famous' df8 fc8 nStatus: 0 df8 fc8 nType: YSERVER_IPC_FINISHED df8 fc8 lFileLen: 0 df8 fc8 lCurrBytes: -1 df8 fc8 nMessageNumber: 2 df8 fc8 SendMessage processed df8 fc8 exit HTTPRequestHandler::ReceiveRedirectedFile df8 fc8 ReceiveRedirectedFile failed for C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messen ger.mira_famous.1278857677593P1140490.JPG df8 fc8 SendString df8 fc8 <HTML> <HEAD> <title>File not received</title> </HEAD> <BODY> the file was not received </BODY> </HTML> df8 fc8 500 df8 fc8 Internal Server Error df8 fc8 sent: df8 fc8 <<<< df8 fc8 HTTP/1.0 500 Internal Server Error

Server: Y! Content-Type: text/html Content-Length: 114 <HTML> <HEAD> <title>File not received</title> </HEAD> <BODY> the file was not received </BODY> </HTML> df8 fc8 >>>> df8 fc8 send failed 183 df8 fc8 SendString failed df8 fc8 leaving HandleFileReceive df8 fc8 HandleFileReceive failed df8 fc8 error: 0 [RedirectErrorNoError] df8 fc8 SendString df8 fc8 Not Found df8 fc8 <h1>NO FILE</h1> df8 fc8 501 df8 fc8 Didn't find file df8 fc8 SendString df8 fc8 <HTML><Head><title>Not Found</title></head><body><h1><h1>NO FILE</h1></h1></body ></html> df8 df8 df8 df8 df8 fc8 501 fc8 Didn't find file fc8 sent: fc8 <<<< fc8

HTTP/1.0 501 Didn't find file Server: Y! Content-Type: text/html Content-Length: 94 <HTML><Head><title>Not Found</title></head><body><h1><h1>NO FILE</h1></h1></body ></html> df8 fc8 >>>> df8 fc8 send failed 183 df8 fc8 GetRegistryInt 'Software\Yahoo\YServer' 'LogFileMaxSizeK' 0 df8 fc8 GetRegistryString 'Software\Yahoo\YServer' 'LogFileMaxSizeK' df8 fc8 RegQueryValueExt failed 2 for 'LogFileMaxSizeK' df8 fc8 Handler failed df8 fc8 HTTPRequestHandler::~HTTPRequestHandler df8 fc8 calling g_RQT.RemoveHTTPRQH, this = 3620568. df8 fc8 after calling RemoveHTTPRQH, count = 1. df8 fc8 closesocket: 0x1ac df8 fc8 HTTPLog::~HTTPLog df8 fc8 leaving HandlerThread df8 298 CYServerComponent::CancelSending df8 298 Entering HTTPRQTotals::KillCommThreadByWindowHandle(). hwnd = 52 5030. df8 298 Finding the request handler, current handler has the window hand le = 525030, msg = 3

df8 298 HTTPRQTotals::KillCommThreadByWindowHandle - SetEvent !! df8 a74 recv failed SOCKET_ERROR 10054 df8 a74 ReceiveBytes failed df8 a74 ReadEntityBodyChunk failed df8 a74 closing file C:\Documents and Settings\User\My Documents\My Pictures\sko lah\P1140508.JPG df8 a74 ReceiveEntityBodyToFile failed df8 a74 deleting C:\Documents and Settings\User\My Documents\My Pictures\skolah\ P1140508.JPG df8 a74 ReceiveEntityBody failed df8 a74 ReceiveFile failed for C:\Documents and Settings\User\My Documents\My Pi ctures\skolah\P1140508.JPG df8 a74 PostInfoToApp YSERVER_IPC_FINISHED -1 0 df8 a74 SendMessage 0x802e6 df8 a74 IPCInfo: df8 a74 cFileName: 'C:\Documents and Settings\User\My Documents\My Pictures\s kolah\P1140508.JPG' df8 a74 cUserID: 'mira_famous' df8 a74 nStatus: 0 df8 a74 nType: YSERVER_IPC_FINISHED df8 a74 lFileLen: 0 df8 a74 lCurrBytes: -1 df8 a74 nMessageNumber: 3 df8 a74 SendMessage processed df8 a74 exit HTTPRequestHandler::ReceiveRedirectedFile df8 a74 ReceiveRedirectedFile failed for C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messen ger.mira_famous.1278857733359P1140508.JPG df8 a74 SendString df8 a74 <HTML> <HEAD> <title>File not received</title> </HEAD> <BODY> the file was not received </BODY> </HTML> df8 a74 500 df8 a74 Internal Server Error df8 a74 sent: df8 a74 <<<< df8 a74 HTTP/1.0 500 Internal Server Error Server: Y! Content-Type: text/html Content-Length: 114 <HTML> <HEAD> <title>File not received</title> </HEAD> <BODY> the file was not received </BODY> </HTML> df8 a74 >>>> df8 a74 send failed 183 df8 a74 SendString failed

df8 a74 leaving HandleFileReceive df8 a74 HandleFileReceive failed df8 a74 error: 0 [RedirectErrorNoError] df8 a74 SendString df8 a74 Not Found df8 a74 <h1>NO FILE</h1> df8 a74 501 df8 a74 Didn't find file df8 a74 SendString df8 a74 <HTML><Head><title>Not Found</title></head><body><h1><h1>NO FILE</h1></h1></body ></html> df8 df8 df8 df8 df8 a74 501 a74 Didn't find file a74 sent: a74 <<<< a74

HTTP/1.0 501 Didn't find file Server: Y! Content-Type: text/html Content-Length: 94 <HTML><Head><title>Not Found</title></head><body><h1><h1>NO FILE</h1></h1></body ></html> df8 a74 >>>> df8 a74 send failed 183 df8 a74 Handler failed df8 a74 HTTPRequestHandler::~HTTPRequestHandler df8 a74 calling g_RQT.RemoveHTTPRQH, this = 3639624. df8 a74 after calling RemoveHTTPRQH, count = 0. df8 a74 closesocket: 0x19c df8 a74 HTTPLog::~HTTPLog df8 a74 leaving HandlerThread df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 5 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init().

df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859310484ur_x1_8qDxE jzT..1Gpa_Q--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ur_x1_8qDxEjzT.. 1Gpa_Q--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=6A1BEFD09EFE9DD765FC692D9517CDD0 df8 298 df8 298 df8 298 W=525030 M=5 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=5 writing to ini file: wrote Timestamp=6A1BEFD09EFE9DD765FC692D9517CDD0 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859310484ur_x 1_8qDxEjzT..1Gpa_Q--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9

df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT ..1Gpa_Q--_m.jpg df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52956 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 b08 AddHandlerThreadToThreadArray df8 944 HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 944 home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 b08 CloseHandle thread 0x1b8 df8 944 m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 944 about to m_HTTPLog.SetSocket(m_sock) df8 944 HTTPLog::SetSocket starting... socket=324 df8 944 HTTPLog::SetSocket exiting df8 944 about to g_RQT.AddHTTPRQH(this), this = 3639624 df8 944 after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 944 about to create Kill Comm Event df8 944 leaving HTTPRequestHandler::HTTPRequestHandler df8 944 HTTPRequestHandler::ReadRequest df8 944 HTTPRequestHandler::ReadRequest df8 944 received 243 bytes df8 944 Found '\r\n\r\n' df8 944 0 ms elapsed df8 944 header is: df8 944 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< df8 944 POST /Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 54219 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 944 944 944 944 944 944 944 944 944 944 944 944 944 944 944 944 944 944 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> m_pEntityBodyBuffer: 0x0 m_dwEntityBodyBufferSize: 0 m_dwNumBytesInEntityBody: 0 HTTPRequestHandler::ParseRequest m_cRequest: POST UnescapeName DecodeURL before: Messenger before: Messenger after: Messenger UnescapeName DecodeURL before: mira_famous before: mira_famous after: mira_famous UnescapeName DecodeURL

df8 944 before: lc9lu9 df8 944 before: lc9lu9 df8 944 after: lc9lu9 df8 944 extracted the filename from the URL. saving to m_cFileName: df8 944 '/Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_m.jp g' df8 944 m_cFileName: /Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa _Q--_m.jpg df8 944 ProcessYahooRequestParams df8 944 DecodeURL df8 944 before: Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_m .jpg df8 944 ValidateRequest df8 944 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859310484u r_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 ReadIniFileString df8 944 section: [Info] key: 'App' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 'Messenger' df8 944 ReadIniFileString df8 944 section: [Info] key: 'User' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 'mira_famous' df8 944 ReadIniFileInt df8 944 section: [Info] key: 'Post' default: 0 df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 1 df8 944 ValidateRequest: true df8 944 request is a Yahoo request df8 944 leaving ParseRequest df8 944 HandleFileReceive df8 944 file name: /Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q --_m.jpg df8 944 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 944 UnescapeName df8 944 DecodeURL df8 944 before: /Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_ m.jpg df8 944 before: /Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_ m.jpg df8 944 after: /Messenger.mira_famous.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_m .jpg df8 944 unescaped file name: /Messenger.mira_famous.1278859310484ur_x1_8qDxEj zT..1Gpa_Q--_m.jpg df8 944 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859310484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 HTTPRequestHandler::ReceiveRedirectedFile df8 944 HTTPRedirectHandler::HTTPRedirectHandler df8 944 GetBaseURL df8 944 bAddrContainsPort: 0 df8 944 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59310484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 944 HTTPRedirectHandler::Process df8 944 ValidateKeys df8 944 ReadIniFileString

df8 944 section: [Info] key: 'Timestamp' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning '6A1BEFD09EFE9DD765FC692D9517CDD0' df8 944 szTimeStamp: '6A1BEFD09EFE9DD765FC692D9517CDD0' df8 944 CSecretKey::CSecretKey df8 944 szApp: Messenger df8 944 szUser: mira_famous df8 944 szTimeStamp: 6A1BEFD09EFE9DD765FC692D9517CDD0 df8 944 CSecretKey::Init(). df8 944 m_szAppID: Messenger df8 944 m_szUserID: mira_famous df8 944 KeyMatches 'lc9lu9' df8 944 key comparison test passed... continuing df8 944 HTTPRedirectHandler::CheckRedirectFile df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 ReadIniFileInt df8 944 section: [Info] key: 'Dir' default: 0 df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 0 df8 944 set m_RType to RedirectTypeSingleFile df8 944 ReadIniFileString df8 944 section: [Info] key: 'App' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 'Messenger' df8 944 ReadIniFileString df8 944 section: [Info] key: 'User' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 'mira_famous' df8 944 ReadIniFileString df8 944 section: [Info] key: 'Version' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 'MSG1.0' df8 944 ReadIniFileInt df8 944 section: [Info] key: 'Post' default: 0 df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 1 df8 944 m_szINIApp: 'Messenger' df8 944 m_szINIUser: 'mira_famous' df8 944 m_szINIVersionString: 'MSG1.0' df8 944 m_iIsPost: 1 df8 944 ReadIniFileInt df8 944 section: [Info] key: 'W' default: 0 df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 525030 df8 944 m_hWnd: 0x802e6 df8 944 ReadIniFileInt df8 944 section: [Info] key: 'M' default: 0 df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 5 df8 944 m_nMsgNumber: 5 df8 944 exit HTTPRedirectHandler::CheckRedirectFile

df8 944 HTTPRedirectHandler::HandleRedirectSingleFile df8 944 ReadIniFileString df8 944 section: [Info] key: 'Name' default: '' df8 944 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 10484ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg' df8 944 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 m_bProcessed: 1 [success] df8 944 exit HTTPRedirectHandler::Process df8 944 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg. df8 944 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg. df8 944 HTTPRedirectHandler::~HTTPRedirectHandler df8 944 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 m_hWndReporting: 0x802e6 df8 944 m_nMsgNumber: 5 df8 944 RedirectType: 1 RedirectTypeSingleFile df8 944 bIsPost: 1 df8 944 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 944 SendMessage 0x802e6 df8 944 IPCInfo: df8 944 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg' df8 944 cUserID: 'mira_famous' df8 944 nStatus: 0 df8 944 nType: YSERVER_IPC_BEGIN df8 944 lFileLen: 0 df8 944 lCurrBytes: 0 df8 944 nMessageNumber: 5 df8 944 SendMessage processed df8 944 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 ReceiveFile df8 944 iContentLength: 54219 df8 944 ReceiveEntityBody df8 944 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ur_x 1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 dwBufSize: 16384 df8 944 dwNumBufBytesUsed: 0 df8 944 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 ReadEntityBodyChunk 16384 df8 b08 IsFreeEntryInThreadArray df8 b08 CloseHandle thread 0x1d4 df8 944 PostInfoToApp YSERVER_IPC_RECEIVING 16384 0 df8 944 ReadEntityBodyChunk 16384 df8 944 PostInfoToApp YSERVER_IPC_RECEIVING 32768 0 df8 944 ReadEntityBodyChunk 16384 df8 944 PostInfoToApp YSERVER_IPC_RECEIVING 49152 0 df8 944 ReadEntityBodyChunk 5067 df8 944 PostInfoToApp YSERVER_IPC_RECEIVING 54219 0 df8 944 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg df8 944 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 944 SendMessage 0x802e6 df8 944 IPCInfo:

df8 944 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\ur_x1_8qDxEjzT..1Gpa_Q--_m.jpg' df8 944 cUserID: 'mira_famous' df8 944 nStatus: 0 df8 944 nType: YSERVER_IPC_FINISHED df8 944 lFileLen: 0 df8 944 lCurrBytes: 0 df8 944 nMessageNumber: 5 df8 944 SendMessage processed df8 944 exit HTTPRequestHandler::ReceiveRedirectedFile df8 944 SendString df8 944 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 944 200 df8 944 OK df8 944 sent: df8 944 <<<< df8 944 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 944 >>>> df8 944 leaving HandleFileReceive df8 944 HTTPRequestHandler::~HTTPRequestHandler df8 944 calling g_RQT.RemoveHTTPRQH, this = 3639624. df8 944 after calling RemoveHTTPRQH, count = 0. df8 944 closesocket: 0x144 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 6 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\DFstRlbSa_GGsbPuKxKq.w--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous'

df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859316500DFstRlbSa_G GsbPuKxKq.w--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\DFstRlbSa_GGsbPu KxKq.w--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=90DEB0F0707736D005F929F8147FC30C df8 298 df8 298 df8 298 W=525030 M=6 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=6 writing to ini file: wrote Timestamp=90DEB0F0707736D005F929F8147FC30C writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded.

df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859316500DFst RlbSa_GGsbPuKxKq.w--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859316500DFstRlbSa_GGsb PuKxKq.w--_m.jpg df8 298 leaving PostFile df8 944 HTTPLog::~HTTPLog df8 944 leaving HandlerThread df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52957 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 e78 HandlerThread 0x1e0 df8 e78 HTTPLog::HTTPLog df8 e78 HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 e78 home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 e78 m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 e78 about to m_HTTPLog.SetSocket(m_sock) df8 e78 HTTPLog::SetSocket starting... socket=480 df8 e78 HTTPLog::SetSocket exiting df8 e78 about to g_RQT.AddHTTPRQH(this), this = 3639624 df8 e78 after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 e78 about to create Kill Comm Event df8 e78 leaving HTTPRequestHandler::HTTPRequestHandler df8 e78 HTTPRequestHandler::ReadRequest df8 e78 HTTPRequestHandler::ReadRequest df8 e78 received 1024 bytes df8 e78 Found '\r\n\r\n' df8 e78 allocating entity body buffer to store read overflow from header df8 e78 781 bytes df8 e78 0 ms elapsed df8 e78 header is: df8 e78 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< df8 e78 POST /Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 67401 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 df8 df8 df8 df8 e78 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> e78 m_pEntityBodyBuffer: 0x374548 e78 m_dwEntityBodyBufferSize: 16384 e78 m_dwNumBytesInEntityBody: 781 e78 HTTPRequestHandler::ParseRequest

df8 e78 m_cRequest: POST df8 e78 UnescapeName df8 e78 DecodeURL df8 e78 before: Messenger df8 e78 before: Messenger df8 e78 after: Messenger df8 e78 UnescapeName df8 e78 DecodeURL df8 e78 before: mira_famous df8 e78 before: mira_famous df8 e78 after: mira_famous df8 e78 UnescapeName df8 e78 DecodeURL df8 e78 before: lc9lu9 df8 e78 before: lc9lu9 df8 e78 after: lc9lu9 df8 e78 extracted the filename from the URL. saving to m_cFileName: df8 e78 '/Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_m.jp g' df8 e78 m_cFileName: /Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq .w--_m.jpg df8 e78 ProcessYahooRequestParams df8 e78 DecodeURL df8 e78 before: Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_m .jpg df8 e78 ValidateRequest df8 e78 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859316500D FstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'App' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 'Messenger' df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'User' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 'mira_famous' df8 e78 ReadIniFileInt df8 e78 section: [Info] key: 'Post' default: 0 df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 1 df8 e78 ValidateRequest: true df8 e78 request is a Yahoo request df8 e78 leaving ParseRequest df8 e78 HandleFileReceive df8 e78 file name: /Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w --_m.jpg df8 e78 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 e78 UnescapeName df8 e78 DecodeURL df8 e78 before: /Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_ m.jpg df8 e78 before: /Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_ m.jpg df8 e78 after: /Messenger.mira_famous.1278859316500DFstRlbSa_GGsbPuKxKq.w--_m .jpg df8 e78 unescaped file name: /Messenger.mira_famous.1278859316500DFstRlbSa_GG

sbPuKxKq.w--_m.jpg df8 e78 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859316500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 HTTPRequestHandler::ReceiveRedirectedFile df8 e78 HTTPRedirectHandler::HTTPRedirectHandler df8 e78 GetBaseURL df8 e78 bAddrContainsPort: 0 df8 e78 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59316500DFstRlbSa_GGsbPuKxKq.w--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 e78 HTTPRedirectHandler::Process df8 e78 ValidateKeys df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'Timestamp' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning '90DEB0F0707736D005F929F8147FC30C' df8 e78 szTimeStamp: '90DEB0F0707736D005F929F8147FC30C' df8 e78 CSecretKey::CSecretKey df8 e78 szApp: Messenger df8 e78 szUser: mira_famous df8 e78 szTimeStamp: 90DEB0F0707736D005F929F8147FC30C df8 e78 CSecretKey::Init(). df8 e78 m_szAppID: Messenger df8 e78 m_szUserID: mira_famous df8 e78 KeyMatches 'lc9lu9' df8 e78 key comparison test passed... continuing df8 e78 HTTPRedirectHandler::CheckRedirectFile df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 ReadIniFileInt df8 e78 section: [Info] key: 'Dir' default: 0 df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 0 df8 e78 set m_RType to RedirectTypeSingleFile df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'App' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 'Messenger' df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'User' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 'mira_famous' df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'Version' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 'MSG1.0' df8 e78 ReadIniFileInt df8 e78 section: [Info] key: 'Post' default: 0 df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 1 df8 e78 m_szINIApp: 'Messenger' df8 e78 m_szINIUser: 'mira_famous' df8 e78 m_szINIVersionString: 'MSG1.0' df8 e78 m_iIsPost: 1

df8 e78 ReadIniFileInt df8 e78 section: [Info] key: 'W' default: 0 df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 525030 df8 e78 m_hWnd: 0x802e6 df8 e78 ReadIniFileInt df8 e78 section: [Info] key: 'M' default: 0 df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 6 df8 e78 m_nMsgNumber: 6 df8 e78 exit HTTPRedirectHandler::CheckRedirectFile df8 e78 HTTPRedirectHandler::HandleRedirectSingleFile df8 e78 ReadIniFileString df8 e78 section: [Info] key: 'Name' default: '' df8 e78 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 16500DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \DFstRlbSa_GGsbPuKxKq.w--_m.jpg' df8 e78 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 m_bProcessed: 1 [success] df8 e78 exit HTTPRedirectHandler::Process df8 e78 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\DFstRlbSa_GGsbPuKxKq.w--_m.jpg. df8 e78 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\DFstRlbSa_GGsbPuKxKq.w--_m.jpg. df8 e78 HTTPRedirectHandler::~HTTPRedirectHandler df8 e78 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 m_hWndReporting: 0x802e6 df8 e78 m_nMsgNumber: 6 df8 e78 RedirectType: 1 RedirectTypeSingleFile df8 e78 bIsPost: 1 df8 e78 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 e78 SendMessage 0x802e6 df8 e78 IPCInfo: df8 e78 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\DFstRlbSa_GGsbPuKxKq.w--_m.jpg' df8 e78 cUserID: 'mira_famous' df8 e78 nStatus: 0 df8 e78 nType: YSERVER_IPC_BEGIN df8 e78 lFileLen: 0 df8 e78 lCurrBytes: 0 df8 e78 nMessageNumber: 6 df8 e78 SendMessage processed df8 e78 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 ReceiveFile df8 e78 iContentLength: 67401 df8 e78 ReceiveEntityBody df8 e78 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\DFst RlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 dwBufSize: 16384 df8 e78 dwNumBufBytesUsed: 781 df8 e78 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 flushed 781 bytes df8 e78 PostInfoToApp YSERVER_IPC_RECEIVING 781 0

df8 e78 ReadEntityBodyChunk 16384 df8 b08 IsFreeEntryInThreadArray df8 e78 PostInfoToApp YSERVER_IPC_RECEIVING 17165 0 df8 e78 ReadEntityBodyChunk 16384 df8 e78 PostInfoToApp YSERVER_IPC_RECEIVING 33549 0 df8 e78 ReadEntityBodyChunk 16384 df8 e78 PostInfoToApp YSERVER_IPC_RECEIVING 49933 0 df8 e78 ReadEntityBodyChunk 16384 df8 e78 PostInfoToApp YSERVER_IPC_RECEIVING 66317 0 df8 e78 ReadEntityBodyChunk 1084 df8 e78 PostInfoToApp YSERVER_IPC_RECEIVING 67401 0 df8 e78 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ DFstRlbSa_GGsbPuKxKq.w--_m.jpg df8 e78 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 e78 SendMessage 0x802e6 df8 e78 IPCInfo: df8 e78 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\DFstRlbSa_GGsbPuKxKq.w--_m.jpg' df8 e78 cUserID: 'mira_famous' df8 e78 nStatus: 0 df8 e78 nType: YSERVER_IPC_FINISHED df8 e78 lFileLen: 0 df8 e78 lCurrBytes: 0 df8 e78 nMessageNumber: 6 df8 e78 SendMessage processed df8 e78 exit HTTPRequestHandler::ReceiveRedirectedFile df8 e78 SendString df8 e78 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 e78 200 df8 e78 OK df8 e78 sent: df8 e78 <<<< df8 e78 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 e78 >>>> df8 e78 leaving HandleFileReceive df8 e78 HTTPRequestHandler::~HTTPRequestHandler df8 e78 calling g_RQT.RemoveHTTPRQH, this = 3639624.

df8 e78 after calling RemoveHTTPRQH, count = 0. df8 e78 closesocket: 0x1e0 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 7 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\q5McrNHjXiaZKMdzDKQHdg--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859326437q5McrNHjXia ZKMdzDKQHdg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\q5McrNHjXiaZKMdz DKQHdg--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=762D38F28A4BAD54F3184C652257A8EC df8 298 wrote Timestamp=762D38F28A4BAD54F3184C652257A8EC

df8 298 df8 298 W=525030 M=7 df8 df8 df8 df8 298 298 298 298

writing to ini file:

wrote W=525030 wrote M=7 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859326437q5Mc rNHjXiaZKMdzDKQHdg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859326437q5McrNHjXiaZKM dzDKQHdg--_m.jpg df8 298 leaving PostFile df8 e78 HTTPLog::~HTTPLog df8 e78 leaving HandlerThread df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52958 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 b08 AddHandlerThreadToThreadArray df8 b08 CloseHandle thread 0x1d8 df8 6c8 about to m_HTTPLog.SetSocket(m_sock) df8 6c8 HTTPLog::SetSocket starting... socket=484 df8 6c8 HTTPLog::SetSocket exiting df8 6c8 about to g_RQT.AddHTTPRQH(this), this = 3639624 df8 6c8 after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 6c8 about to create Kill Comm Event df8 6c8 leaving HTTPRequestHandler::HTTPRequestHandler df8 6c8 HTTPRequestHandler::ReadRequest df8 6c8 HTTPRequestHandler::ReadRequest df8 6c8 received 243 bytes df8 6c8 Found '\r\n\r\n' df8 6c8 0 ms elapsed df8 6c8 header is: df8 6c8 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< df8 6c8 POST /Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close

Host: 175.144.148.105 Content-Length: 71453 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 6c8 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> df8 6c8 m_pEntityBodyBuffer: 0x0 df8 6c8 m_dwEntityBodyBufferSize: 0 df8 6c8 m_dwNumBytesInEntityBody: 0 df8 6c8 HTTPRequestHandler::ParseRequest df8 6c8 m_cRequest: POST df8 6c8 UnescapeName df8 6c8 DecodeURL df8 6c8 before: Messenger df8 6c8 before: Messenger df8 6c8 after: Messenger df8 6c8 UnescapeName df8 6c8 DecodeURL df8 6c8 before: mira_famous df8 6c8 before: mira_famous df8 6c8 after: mira_famous df8 6c8 UnescapeName df8 6c8 DecodeURL df8 6c8 before: lc9lu9 df8 6c8 before: lc9lu9 df8 6c8 after: lc9lu9 df8 6c8 extracted the filename from the URL. saving to m_cFileName: df8 6c8 '/Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_m.jp g' df8 6c8 m_cFileName: /Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQH dg--_m.jpg df8 6c8 ProcessYahooRequestParams df8 6c8 DecodeURL df8 6c8 before: Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_m .jpg df8 6c8 ValidateRequest df8 6c8 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859326437q 5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'App' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 'Messenger' df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'User' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 'mira_famous' df8 6c8 ReadIniFileInt df8 6c8 section: [Info] key: 'Post' default: 0 df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 1 df8 6c8 ValidateRequest: true df8 6c8 request is a Yahoo request df8 6c8 leaving ParseRequest df8 6c8 HandleFileReceive df8 6c8 file name: /Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg --_m.jpg

df8 6c8 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 6c8 UnescapeName df8 6c8 DecodeURL df8 6c8 before: /Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_ m.jpg df8 6c8 before: /Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_ m.jpg df8 6c8 after: /Messenger.mira_famous.1278859326437q5McrNHjXiaZKMdzDKQHdg--_m .jpg df8 6c8 unescaped file name: /Messenger.mira_famous.1278859326437q5McrNHjXiaZ KMdzDKQHdg--_m.jpg df8 6c8 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859326437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 HTTPRequestHandler::ReceiveRedirectedFile df8 6c8 HTTPRedirectHandler::HTTPRedirectHandler df8 6c8 GetBaseURL df8 6c8 bAddrContainsPort: 0 df8 6c8 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59326437q5McrNHjXiaZKMdzDKQHdg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 6c8 HTTPRedirectHandler::Process df8 6c8 ValidateKeys df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'Timestamp' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning '762D38F28A4BAD54F3184C652257A8EC' df8 6c8 szTimeStamp: '762D38F28A4BAD54F3184C652257A8EC' df8 6c8 CSecretKey::CSecretKey df8 6c8 szApp: Messenger df8 6c8 szUser: mira_famous df8 6c8 szTimeStamp: 762D38F28A4BAD54F3184C652257A8EC df8 6c8 CSecretKey::Init(). df8 6c8 m_szAppID: Messenger df8 6c8 m_szUserID: mira_famous df8 6c8 KeyMatches 'lc9lu9' df8 6c8 key comparison test passed... continuing df8 6c8 HTTPRedirectHandler::CheckRedirectFile df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 ReadIniFileInt df8 6c8 section: [Info] key: 'Dir' default: 0 df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 0 df8 6c8 set m_RType to RedirectTypeSingleFile df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'App' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 'Messenger' df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'User' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 'mira_famous' df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'Version' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593

26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 'MSG1.0' df8 6c8 ReadIniFileInt df8 6c8 section: [Info] key: 'Post' default: 0 df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 1 df8 6c8 m_szINIApp: 'Messenger' df8 6c8 m_szINIUser: 'mira_famous' df8 6c8 m_szINIVersionString: 'MSG1.0' df8 6c8 m_iIsPost: 1 df8 6c8 ReadIniFileInt df8 6c8 section: [Info] key: 'W' default: 0 df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 525030 df8 6c8 m_hWnd: 0x802e6 df8 6c8 ReadIniFileInt df8 6c8 section: [Info] key: 'M' default: 0 df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 7 df8 6c8 m_nMsgNumber: 7 df8 6c8 exit HTTPRedirectHandler::CheckRedirectFile df8 6c8 HTTPRedirectHandler::HandleRedirectSingleFile df8 6c8 ReadIniFileString df8 6c8 section: [Info] key: 'Name' default: '' df8 6c8 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 26437q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \q5McrNHjXiaZKMdzDKQHdg--_m.jpg' df8 6c8 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 m_bProcessed: 1 [success] df8 6c8 exit HTTPRedirectHandler::Process df8 6c8 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\q5McrNHjXiaZKMdzDKQHdg--_m.jpg. df8 6c8 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\q5McrNHjXiaZKMdzDKQHdg--_m.jpg. df8 6c8 HTTPRedirectHandler::~HTTPRedirectHandler df8 6c8 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 m_hWndReporting: 0x802e6 df8 6c8 m_nMsgNumber: 7 df8 6c8 RedirectType: 1 RedirectTypeSingleFile df8 6c8 bIsPost: 1 df8 6c8 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 6c8 SendMessage 0x802e6 df8 6c8 IPCInfo: df8 6c8 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\q5McrNHjXiaZKMdzDKQHdg--_m.jpg' df8 6c8 cUserID: 'mira_famous' df8 6c8 nStatus: 0 df8 6c8 nType: YSERVER_IPC_BEGIN df8 6c8 lFileLen: 0 df8 6c8 lCurrBytes: 0 df8 6c8 nMessageNumber: 7 df8 6c8 SendMessage processed df8 6c8 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\q5McrNHjXiaZKMdzDKQHdg--_m.jpg

df8 6c8 ReceiveFile df8 6c8 iContentLength: 71453 df8 6c8 ReceiveEntityBody df8 6c8 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\q5Mc rNHjXiaZKMdzDKQHdg--_m.jpg df8 b08 IsFreeEntryInThreadArray df8 6c8 dwBufSize: 16384 df8 6c8 dwNumBufBytesUsed: 0 df8 6c8 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 ReadEntityBodyChunk 16384 df8 6c8 PostInfoToApp YSERVER_IPC_RECEIVING 16384 0 df8 6c8 ReadEntityBodyChunk 16384 df8 6c8 PostInfoToApp YSERVER_IPC_RECEIVING 32768 0 df8 6c8 ReadEntityBodyChunk 16384 df8 6c8 PostInfoToApp YSERVER_IPC_RECEIVING 49152 0 df8 6c8 ReadEntityBodyChunk 16384 df8 6c8 PostInfoToApp YSERVER_IPC_RECEIVING 65536 0 df8 6c8 ReadEntityBodyChunk 5917 df8 6c8 PostInfoToApp YSERVER_IPC_RECEIVING 71453 0 df8 6c8 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ q5McrNHjXiaZKMdzDKQHdg--_m.jpg df8 6c8 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 6c8 SendMessage 0x802e6 df8 6c8 IPCInfo: df8 6c8 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\q5McrNHjXiaZKMdzDKQHdg--_m.jpg' df8 6c8 cUserID: 'mira_famous' df8 6c8 nStatus: 0 df8 6c8 nType: YSERVER_IPC_FINISHED df8 6c8 lFileLen: 0 df8 6c8 lCurrBytes: 0 df8 6c8 nMessageNumber: 7 df8 6c8 SendMessage processed df8 6c8 exit HTTPRequestHandler::ReceiveRedirectedFile df8 6c8 SendString df8 6c8 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 6c8 200 df8 6c8 OK df8 6c8 sent: df8 6c8 <<<< df8 6c8 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title>

</HEAD> <BODY> the file was received </BODY> </HTML> df8 6c8 >>>> df8 6c8 leaving HandleFileReceive df8 6c8 HTTPRequestHandler::~HTTPRequestHandler df8 6c8 calling g_RQT.RemoveHTTPRQH, this = 3639624. df8 6c8 after calling RemoveHTTPRQH, count = 0. df8 6c8 closesocket: 0x1e4 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 8 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859332156gZ5Ctg7X9eo JJGVYs2_9Dw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\gZ5Ctg7X9eoJJGVY s2_9Dw--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous

df8 df8 df8 df8

298 298 298 298

wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=DA97A1BD19931E1800EAC95AB772504F df8 298 df8 298 df8 298 W=525030 M=8 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=8 writing to ini file: wrote Timestamp=DA97A1BD19931E1800EAC95AB772504F writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859332156gZ5C tg7X9eoJJGVYs2_9Dw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJG VYs2_9Dw--_m.jpg df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52969 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 b08 AddHandlerThreadToThreadArray df8 b08 IsFreeEntryInThreadArray df8 c10 HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 c10 home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 c10 m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 c10 about to m_HTTPLog.SetSocket(m_sock) df8 c10 HTTPLog::SetSocket starting... socket=468 df8 c10 HTTPLog::SetSocket exiting df8 c10 about to g_RQT.AddHTTPRQH(this), this = 3620568 df8 c10 after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 c10 about to create Kill Comm Event df8 c10 leaving HTTPRequestHandler::HTTPRequestHandler df8 c10 HTTPRequestHandler::ReadRequest df8 c10 HTTPRequestHandler::ReadRequest

df8 df8 df8 df8 df8 df8

c10 c10 c10 c10 c10 c10

received 243 bytes Found '\r\n\r\n' 0 ms elapsed header is: <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

POST /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 62312 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 c10 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> df8 c10 m_pEntityBodyBuffer: 0x0 df8 c10 m_dwEntityBodyBufferSize: 0 df8 c10 m_dwNumBytesInEntityBody: 0 df8 c10 HTTPRequestHandler::ParseRequest df8 c10 m_cRequest: POST df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: Messenger df8 c10 before: Messenger df8 c10 after: Messenger df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: mira_famous df8 c10 before: mira_famous df8 c10 after: mira_famous df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: lc9lu9 df8 c10 before: lc9lu9 df8 c10 after: lc9lu9 df8 c10 extracted the filename from the URL. saving to m_cFileName: df8 c10 '/Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jp g' df8 c10 m_cFileName: /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9 Dw--_m.jpg df8 c10 ProcessYahooRequestParams df8 c10 DecodeURL df8 c10 before: Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m .jpg df8 c10 ValidateRequest df8 c10 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859332156g Z5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'App' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'Messenger' df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'User' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'mira_famous' df8 c10 ReadIniFileInt

df8 c10 section: [Info] key: 'Post' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 1 df8 c10 ValidateRequest: true df8 c10 request is a Yahoo request df8 c10 leaving ParseRequest df8 c10 HandleFileReceive df8 c10 file name: /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw --_m.jpg df8 c10 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_ m.jpg df8 c10 before: /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_ m.jpg df8 c10 after: /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m .jpg df8 c10 unescaped file name: /Messenger.mira_famous.1278859332156gZ5Ctg7X9eoJ JGVYs2_9Dw--_m.jpg df8 c10 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 HTTPRequestHandler::ReceiveRedirectedFile df8 c10 HTTPRedirectHandler::HTTPRedirectHandler df8 c10 GetBaseURL df8 c10 bAddrContainsPort: 0 df8 c10 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59332156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 c10 HTTPRedirectHandler::Process df8 c10 ValidateKeys df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'Timestamp' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'DA97A1BD19931E1800EAC95AB772504F' df8 c10 szTimeStamp: 'DA97A1BD19931E1800EAC95AB772504F' df8 c10 CSecretKey::CSecretKey df8 c10 szApp: Messenger df8 c10 szUser: mira_famous df8 c10 szTimeStamp: DA97A1BD19931E1800EAC95AB772504F df8 c10 CSecretKey::Init(). df8 c10 m_szAppID: Messenger df8 c10 m_szUserID: mira_famous df8 c10 KeyMatches 'lc9lu9' df8 c10 key comparison test passed... continuing df8 c10 HTTPRedirectHandler::CheckRedirectFile df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'Dir' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 0 df8 c10 set m_RType to RedirectTypeSingleFile df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'App' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593

32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'Messenger' df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'User' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'mira_famous' df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'Version' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'MSG1.0' df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'Post' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 1 df8 c10 m_szINIApp: 'Messenger' df8 6c8 HTTPLog::~HTTPLog df8 6c8 leaving HandlerThread df8 c10 m_szINIUser: 'mira_famous' df8 c10 m_szINIVersionString: 'MSG1.0' df8 c10 m_iIsPost: 1 df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'W' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 525030 df8 c10 m_hWnd: 0x802e6 df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'M' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 8 df8 c10 m_nMsgNumber: 8 df8 c10 exit HTTPRedirectHandler::CheckRedirectFile df8 c10 HTTPRedirectHandler::HandleRedirectSingleFile df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'Name' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 32156gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg' df8 c10 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 m_bProcessed: 1 [success] df8 c10 exit HTTPRedirectHandler::Process df8 c10 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg. df8 c10 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg. df8 c10 HTTPRedirectHandler::~HTTPRedirectHandler df8 c10 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 m_hWndReporting: 0x802e6 df8 c10 m_nMsgNumber: 8 df8 c10 RedirectType: 1 RedirectTypeSingleFile df8 c10 bIsPost: 1 df8 c10 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 c10 SendMessage 0x802e6

df8 c10 IPCInfo: df8 c10 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg' df8 c10 cUserID: 'mira_famous' df8 c10 nStatus: 0 df8 c10 nType: YSERVER_IPC_BEGIN df8 c10 lFileLen: 0 df8 c10 lCurrBytes: 0 df8 c10 nMessageNumber: 8 df8 c10 SendMessage processed df8 c10 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 ReceiveFile df8 c10 iContentLength: 62312 df8 c10 ReceiveEntityBody df8 c10 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\gZ5C tg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 dwBufSize: 16384 df8 c10 dwNumBufBytesUsed: 0 df8 c10 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 ReadEntityBodyChunk 16384 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 16384 0 df8 c10 ReadEntityBodyChunk 16384 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 32768 0 df8 c10 ReadEntityBodyChunk 16384 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 49152 0 df8 c10 ReadEntityBodyChunk 13160 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 62312 0 df8 c10 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg df8 c10 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 c10 SendMessage 0x802e6 df8 c10 IPCInfo: df8 c10 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\gZ5Ctg7X9eoJJGVYs2_9Dw--_m.jpg' df8 c10 cUserID: 'mira_famous' df8 c10 nStatus: 0 df8 c10 nType: YSERVER_IPC_FINISHED df8 c10 lFileLen: 0 df8 c10 lCurrBytes: 0 df8 c10 nMessageNumber: 8 df8 c10 SendMessage processed df8 c10 exit HTTPRequestHandler::ReceiveRedirectedFile df8 c10 SendString df8 c10 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 c10 200 df8 c10 OK df8 c10 sent: df8 c10 <<<< df8 c10

HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 c10 >>>> df8 c10 leaving HandleFileReceive df8 c10 HTTPRequestHandler::~HTTPRequestHandler df8 c10 calling g_RQT.RemoveHTTPRQH, this = 3620568. df8 c10 after calling RemoveHTTPRQH, count = 0. df8 c10 closesocket: 0x1d4 df8 298 nMsgNumber: 9 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859339546ZABdVA3ajNE yRMlcBZ9imw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ZABdVA3ajNEyRMlc BZ9imw--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 c10 HTTPLog::~HTTPLog df8 c10 leaving HandlerThread

df8 298 df8 298

writing to ini file:

Timestamp=B4C86CF3A30A7A3B49665691A380F7D3 df8 298 df8 298 df8 298 W=525030 M=9 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=9 writing to ini file: wrote Timestamp=B4C86CF3A30A7A3B49665691A380F7D3 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859339546ZABd VA3ajNEyRMlcBZ9imw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859339546ZABdVA3ajNEyRM lcBZ9imw--_m.jpg df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52971 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 7ec HandlerThread 0x1e0 df8 7ec HTTPLog::HTTPLog df8 7ec HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 7ec home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 7ec m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 7ec about to m_HTTPLog.SetSocket(m_sock) df8 7ec HTTPLog::SetSocket starting... socket=480 df8 7ec HTTPLog::SetSocket exiting df8 7ec about to g_RQT.AddHTTPRQH(this), this = 3620568 df8 7ec after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 7ec about to create Kill Comm Event df8 7ec leaving HTTPRequestHandler::HTTPRequestHandler df8 7ec HTTPRequestHandler::ReadRequest df8 7ec HTTPRequestHandler::ReadRequest df8 7ec received 243 bytes df8 7ec Found '\r\n\r\n' df8 7ec 0 ms elapsed df8 7ec header is:

df8 7ec df8 7ec

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

POST /Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 80550 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 7ec >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> df8 7ec m_pEntityBodyBuffer: 0x0 df8 7ec m_dwEntityBodyBufferSize: 0 df8 7ec m_dwNumBytesInEntityBody: 0 df8 7ec HTTPRequestHandler::ParseRequest df8 7ec m_cRequest: POST df8 7ec UnescapeName df8 7ec DecodeURL df8 7ec before: Messenger df8 7ec before: Messenger df8 7ec after: Messenger df8 7ec UnescapeName df8 7ec DecodeURL df8 7ec before: mira_famous df8 7ec before: mira_famous df8 7ec after: mira_famous df8 7ec UnescapeName df8 7ec DecodeURL df8 7ec before: lc9lu9 df8 7ec before: lc9lu9 df8 7ec after: lc9lu9 df8 7ec extracted the filename from the URL. saving to m_cFileName: df8 7ec '/Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_m.jp g' df8 7ec m_cFileName: /Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9i mw--_m.jpg df8 7ec ProcessYahooRequestParams df8 7ec DecodeURL df8 7ec before: Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_m .jpg df8 7ec ValidateRequest df8 7ec C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859339546Z ABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'App' default: '' df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'Messenger' df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'User' default: '' df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'mira_famous' df8 7ec ReadIniFileInt df8 7ec section: [Info] key: 'Post' default: 0 df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 1

df8 7ec ValidateRequest: true df8 7ec request is a Yahoo request df8 7ec leaving ParseRequest df8 7ec HandleFileReceive df8 7ec file name: /Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw --_m.jpg df8 7ec Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 7ec UnescapeName df8 7ec DecodeURL df8 7ec before: /Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_ m.jpg df8 7ec before: /Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_ m.jpg df8 7ec after: /Messenger.mira_famous.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_m .jpg df8 7ec unescaped file name: /Messenger.mira_famous.1278859339546ZABdVA3ajNEy RMlcBZ9imw--_m.jpg df8 7ec full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859339546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec HTTPRequestHandler::ReceiveRedirectedFile df8 7ec HTTPRedirectHandler::HTTPRedirectHandler df8 7ec GetBaseURL df8 7ec bAddrContainsPort: 0 df8 7ec set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59339546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 7ec HTTPRedirectHandler::Process df8 7ec ValidateKeys df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'Timestamp' default: '' df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'B4C86CF3A30A7A3B49665691A380F7D3' df8 7ec szTimeStamp: 'B4C86CF3A30A7A3B49665691A380F7D3' df8 7ec CSecretKey::CSecretKey df8 7ec szApp: Messenger df8 7ec szUser: mira_famous df8 7ec szTimeStamp: B4C86CF3A30A7A3B49665691A380F7D3 df8 7ec CSecretKey::Init(). df8 7ec m_szAppID: Messenger df8 7ec m_szUserID: mira_famous df8 7ec KeyMatches 'lc9lu9' df8 7ec key comparison test passed... continuing df8 7ec HTTPRedirectHandler::CheckRedirectFile df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec ReadIniFileInt df8 7ec section: [Info] key: 'Dir' default: 0 df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 0 df8 7ec set m_RType to RedirectTypeSingleFile df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'App' default: '' df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'Messenger' df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'User' default: ''

df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'mira_famous' df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'Version' default: '' df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'MSG1.0' df8 7ec ReadIniFileInt df8 7ec section: [Info] key: 'Post' default: 0 df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 1 df8 7ec m_szINIApp: 'Messenger' df8 7ec m_szINIUser: 'mira_famous' df8 7ec m_szINIVersionString: 'MSG1.0' df8 7ec m_iIsPost: 1 df8 7ec ReadIniFileInt df8 7ec section: [Info] key: 'W' default: 0 df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 525030 df8 7ec m_hWnd: 0x802e6 df8 7ec ReadIniFileInt df8 7ec section: [Info] key: 'M' default: 0 df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 9 df8 7ec m_nMsgNumber: 9 df8 7ec exit HTTPRedirectHandler::CheckRedirectFile df8 7ec HTTPRedirectHandler::HandleRedirectSingleFile df8 7ec ReadIniFileString df8 7ec section: [Info] key: 'Name' default: '' df8 7ec file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 39546ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \ZABdVA3ajNEyRMlcBZ9imw--_m.jpg' df8 7ec set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec m_bProcessed: 1 [success] df8 7ec exit HTTPRedirectHandler::Process df8 7ec GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg. df8 7ec szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg. df8 7ec HTTPRedirectHandler::~HTTPRedirectHandler df8 7ec m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec m_hWndReporting: 0x802e6 df8 7ec m_nMsgNumber: 9 df8 7ec RedirectType: 1 RedirectTypeSingleFile df8 7ec bIsPost: 1 df8 7ec PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 7ec SendMessage 0x802e6 df8 7ec IPCInfo: df8 7ec cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg' df8 7ec cUserID: 'mira_famous' df8 7ec nStatus: 0 df8 7ec nType: YSERVER_IPC_BEGIN

df8 7ec lFileLen: 0 df8 7ec lCurrBytes: 0 df8 7ec nMessageNumber: 9 df8 7ec SendMessage processed df8 7ec calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec ReceiveFile df8 7ec iContentLength: 80550 df8 7ec ReceiveEntityBody df8 7ec temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ZABd VA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec dwBufSize: 16384 df8 7ec dwNumBufBytesUsed: 0 df8 7ec creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec ReadEntityBodyChunk 16384 df8 b08 IsFreeEntryInThreadArray df8 b08 CloseHandle thread 0x1e8 df8 7ec PostInfoToApp YSERVER_IPC_RECEIVING 16384 0 df8 7ec ReadEntityBodyChunk 16384 df8 7ec PostInfoToApp YSERVER_IPC_RECEIVING 32768 0 df8 7ec ReadEntityBodyChunk 16384 df8 7ec PostInfoToApp YSERVER_IPC_RECEIVING 49152 0 df8 7ec ReadEntityBodyChunk 16384 df8 7ec PostInfoToApp YSERVER_IPC_RECEIVING 65536 0 df8 7ec ReadEntityBodyChunk 15014 df8 7ec PostInfoToApp YSERVER_IPC_RECEIVING 80550 0 df8 7ec closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ ZABdVA3ajNEyRMlcBZ9imw--_m.jpg df8 7ec PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 7ec SendMessage 0x802e6 df8 7ec IPCInfo: df8 7ec cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\ZABdVA3ajNEyRMlcBZ9imw--_m.jpg' df8 7ec cUserID: 'mira_famous' df8 7ec nStatus: 0 df8 7ec nType: YSERVER_IPC_FINISHED df8 7ec lFileLen: 0 df8 7ec lCurrBytes: 0 df8 7ec nMessageNumber: 9 df8 7ec SendMessage processed df8 7ec exit HTTPRequestHandler::ReceiveRedirectedFile df8 7ec SendString df8 7ec <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 7ec 200 df8 7ec OK df8 7ec sent: df8 7ec <<<< df8 7ec HTTP/1.0 200 OK

Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 7ec >>>> df8 7ec leaving HandleFileReceive df8 7ec HTTPRequestHandler::~HTTPRequestHandler df8 7ec calling g_RQT.RemoveHTTPRQH, this = 3620568. df8 7ec after calling RemoveHTTPRQH, count = 0. df8 7ec closesocket: 0x1e0 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 10 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859348281uoZfYtL.bXL OE3gY9dnSwg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\uoZfYtL.bXLOE3gY 9dnSwg--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554

\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=FBC6F50F0B0EA7CBB9BE2D909F1EEEC6 df8 298 df8 298 df8 298 W=525030 M=10 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=10 writing to ini file: wrote Timestamp=FBC6F50F0B0EA7CBB9BE2D909F1EEEC6 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859348281uoZf YtL.bXLOE3gY9dnSwg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3 gY9dnSwg--_m.jpg df8 298 leaving PostFile df8 7ec HTTPLog::~HTTPLog df8 7ec leaving HandlerThread df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52974 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 f50 HandlerThread 0x198 df8 f50 HTTPLog::HTTPLog df8 f50 HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 f50 home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 f50 m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data'

df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8

f50 f50 f50 f50 f50 f50 f50 f50 f50 f50 f50 f50 f50 f50 f50

about to m_HTTPLog.SetSocket(m_sock) HTTPLog::SetSocket starting... socket=408 HTTPLog::SetSocket exiting about to g_RQT.AddHTTPRQH(this), this = 3620568 after calling g_RQT.AddHTTPRQH(this). total count = 1. about to create Kill Comm Event leaving HTTPRequestHandler::HTTPRequestHandler HTTPRequestHandler::ReadRequest HTTPRequestHandler::ReadRequest received 243 bytes Found '\r\n\r\n' 0 ms elapsed header is: <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

POST /Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 68125 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 f50 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> df8 f50 m_pEntityBodyBuffer: 0x0 df8 f50 m_dwEntityBodyBufferSize: 0 df8 f50 m_dwNumBytesInEntityBody: 0 df8 f50 HTTPRequestHandler::ParseRequest df8 f50 m_cRequest: POST df8 f50 UnescapeName df8 f50 DecodeURL df8 f50 before: Messenger df8 f50 before: Messenger df8 f50 after: Messenger df8 f50 UnescapeName df8 f50 DecodeURL df8 f50 before: mira_famous df8 f50 before: mira_famous df8 f50 after: mira_famous df8 f50 UnescapeName df8 f50 DecodeURL df8 f50 before: lc9lu9 df8 f50 before: lc9lu9 df8 f50 after: lc9lu9 df8 f50 extracted the filename from the URL. saving to m_cFileName: df8 f50 '/Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_m.jp g' df8 f50 m_cFileName: /Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnS wg--_m.jpg df8 f50 ProcessYahooRequestParams df8 f50 DecodeURL df8 f50 before: Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_m .jpg df8 f50 ValidateRequest df8 f50 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859348281u oZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'App' default: ''

df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'Messenger' df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'User' default: '' df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'mira_famous' df8 f50 ReadIniFileInt df8 f50 section: [Info] key: 'Post' default: 0 df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 1 df8 f50 ValidateRequest: true df8 f50 request is a Yahoo request df8 f50 leaving ParseRequest df8 f50 HandleFileReceive df8 f50 file name: /Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg --_m.jpg df8 f50 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 f50 UnescapeName df8 f50 DecodeURL df8 f50 before: /Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_ m.jpg df8 f50 before: /Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_ m.jpg df8 f50 after: /Messenger.mira_famous.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_m .jpg df8 f50 unescaped file name: /Messenger.mira_famous.1278859348281uoZfYtL.bXLO E3gY9dnSwg--_m.jpg df8 f50 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859348281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 HTTPRequestHandler::ReceiveRedirectedFile df8 f50 HTTPRedirectHandler::HTTPRedirectHandler df8 f50 GetBaseURL df8 f50 bAddrContainsPort: 0 df8 f50 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59348281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 f50 HTTPRedirectHandler::Process df8 f50 ValidateKeys df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'Timestamp' default: '' df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'FBC6F50F0B0EA7CBB9BE2D909F1EEEC6' df8 f50 szTimeStamp: 'FBC6F50F0B0EA7CBB9BE2D909F1EEEC6' df8 f50 CSecretKey::CSecretKey df8 f50 szApp: Messenger df8 f50 szUser: mira_famous df8 f50 szTimeStamp: FBC6F50F0B0EA7CBB9BE2D909F1EEEC6 df8 f50 CSecretKey::Init(). df8 f50 m_szAppID: Messenger df8 f50 m_szUserID: mira_famous df8 f50 KeyMatches 'lc9lu9' df8 f50 key comparison test passed... continuing df8 f50 HTTPRedirectHandler::CheckRedirectFile df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg

df8 f50 ReadIniFileInt df8 f50 section: [Info] key: 'Dir' default: 0 df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 0 df8 f50 set m_RType to RedirectTypeSingleFile df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'App' default: '' df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'Messenger' df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'User' default: '' df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'mira_famous' df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'Version' default: '' df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'MSG1.0' df8 f50 ReadIniFileInt df8 f50 section: [Info] key: 'Post' default: 0 df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 1 df8 f50 m_szINIApp: 'Messenger' df8 f50 m_szINIUser: 'mira_famous' df8 f50 m_szINIVersionString: 'MSG1.0' df8 f50 m_iIsPost: 1 df8 f50 ReadIniFileInt df8 f50 section: [Info] key: 'W' default: 0 df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 525030 df8 f50 m_hWnd: 0x802e6 df8 f50 ReadIniFileInt df8 f50 section: [Info] key: 'M' default: 0 df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 10 df8 f50 m_nMsgNumber: 10 df8 f50 exit HTTPRedirectHandler::CheckRedirectFile df8 f50 HTTPRedirectHandler::HandleRedirectSingleFile df8 f50 ReadIniFileString df8 f50 section: [Info] key: 'Name' default: '' df8 f50 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 48281uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \uoZfYtL.bXLOE3gY9dnSwg--_m.jpg' df8 f50 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 m_bProcessed: 1 [success] df8 f50 exit HTTPRedirectHandler::Process df8 f50 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg. df8 f50 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg. df8 f50 HTTPRedirectHandler::~HTTPRedirectHandler df8 f50 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5

54\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 m_hWndReporting: 0x802e6 df8 f50 m_nMsgNumber: 10 df8 f50 RedirectType: 1 RedirectTypeSingleFile df8 f50 bIsPost: 1 df8 f50 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 f50 SendMessage 0x802e6 df8 f50 IPCInfo: df8 f50 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg' df8 f50 cUserID: 'mira_famous' df8 f50 nStatus: 0 df8 f50 nType: YSERVER_IPC_BEGIN df8 f50 lFileLen: 0 df8 f50 lCurrBytes: 0 df8 f50 nMessageNumber: 10 df8 f50 SendMessage processed df8 f50 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 ReceiveFile df8 f50 iContentLength: 68125 df8 f50 ReceiveEntityBody df8 f50 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\uoZf YtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 dwBufSize: 16384 df8 f50 dwNumBufBytesUsed: 0 df8 f50 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 ReadEntityBodyChunk 16384 df8 b08 IsFreeEntryInThreadArray df8 f50 PostInfoToApp YSERVER_IPC_RECEIVING 16384 0 df8 f50 ReadEntityBodyChunk 16384 df8 f50 PostInfoToApp YSERVER_IPC_RECEIVING 32768 0 df8 f50 ReadEntityBodyChunk 16384 df8 f50 PostInfoToApp YSERVER_IPC_RECEIVING 49152 0 df8 f50 ReadEntityBodyChunk 16384 df8 f50 PostInfoToApp YSERVER_IPC_RECEIVING 65536 0 df8 f50 ReadEntityBodyChunk 2589 df8 f50 PostInfoToApp YSERVER_IPC_RECEIVING 68125 0 df8 f50 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ uoZfYtL.bXLOE3gY9dnSwg--_m.jpg df8 f50 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 f50 SendMessage 0x802e6 df8 f50 IPCInfo: df8 f50 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\uoZfYtL.bXLOE3gY9dnSwg--_m.jpg' df8 f50 cUserID: 'mira_famous' df8 f50 nStatus: 0 df8 f50 nType: YSERVER_IPC_FINISHED df8 f50 lFileLen: 0 df8 f50 lCurrBytes: 0 df8 f50 nMessageNumber: 10 df8 f50 SendMessage processed df8 f50 exit HTTPRequestHandler::ReceiveRedirectedFile df8 f50 SendString df8 f50 <HTML> <HEAD> <title>File received</title>

</HEAD> <BODY> the file was received </BODY> </HTML> df8 f50 200 df8 f50 OK df8 f50 sent: df8 f50 <<<< df8 f50 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 f50 >>>> df8 f50 leaving HandleFileReceive df8 f50 HTTPRequestHandler::~HTTPRequestHandler df8 f50 calling g_RQT.RemoveHTTPRQH, this = 3620568. df8 f50 after calling RemoveHTTPRQH, count = 0. df8 f50 closesocket: 0x198 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 11 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\xVDg0_ug0_m5mfS4U_gotg--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned:

df8 298 http://175.144.148.105/Messenger.mira_famous.1278859356546xVDg0_ug0_m 5mfS4U_gotg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\xVDg0_ug0_m5mfS4 U_gotg--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=268B1517C18756BFFAE66DE5F4F3C424 df8 298 df8 298 df8 298 W=525030 M=11 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=11 writing to ini file: wrote Timestamp=268B1517C18756BFFAE66DE5F4F3C424 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859356546xVDg 0_ug0_m5mfS4U_gotg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859356546xVDg0_ug0_m5mf S4U_gotg--_m.jpg df8 298 leaving PostFile df8 f50 HTTPLog::~HTTPLog df8 f50 leaving HandlerThread df8 b08 accept connection from:

df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8

b08 b08 b08 b08 b08 b08 b08 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890

IP addr: 180.73.101.44 port: 52975 accept socket: IP addr: 175.144.148.105 port: 80 spawning new Handler thread ReportInitProgress HandlerThread 0x1dc HTTPLog::HTTPLog HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' about to m_HTTPLog.SetSocket(m_sock) HTTPLog::SetSocket starting... socket=476 HTTPLog::SetSocket exiting about to g_RQT.AddHTTPRQH(this), this = 3620568 after calling g_RQT.AddHTTPRQH(this). total count = 1. about to create Kill Comm Event leaving HTTPRequestHandler::HTTPRequestHandler HTTPRequestHandler::ReadRequest HTTPRequestHandler::ReadRequest received 1024 bytes Found '\r\n\r\n' allocating entity body buffer to store read overflow from header 781 bytes 391 ms elapsed header is: <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

POST /Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 57004 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 890 890 890 890 890 b08 890 890 890 890 890 890 890 890 890 890 890 890 890 890 890 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> m_pEntityBodyBuffer: 0x374548 m_dwEntityBodyBufferSize: 16384 m_dwNumBytesInEntityBody: 781 HTTPRequestHandler::ParseRequest IsFreeEntryInThreadArray m_cRequest: POST UnescapeName DecodeURL before: Messenger before: Messenger after: Messenger UnescapeName DecodeURL before: mira_famous before: mira_famous after: mira_famous UnescapeName DecodeURL before: lc9lu9 before: lc9lu9

df8 890 after: lc9lu9 df8 890 extracted the filename from the URL. saving to m_cFileName: df8 890 '/Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_m.jp g' df8 890 m_cFileName: /Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_go tg--_m.jpg df8 890 ProcessYahooRequestParams df8 890 DecodeURL df8 890 before: Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_m .jpg df8 890 ValidateRequest df8 890 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859356546x VDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 ReadIniFileString df8 890 section: [Info] key: 'App' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 'Messenger' df8 890 ReadIniFileString df8 890 section: [Info] key: 'User' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 'mira_famous' df8 890 ReadIniFileInt df8 890 section: [Info] key: 'Post' default: 0 df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 1 df8 890 ValidateRequest: true df8 890 request is a Yahoo request df8 890 leaving ParseRequest df8 890 HandleFileReceive df8 890 file name: /Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg --_m.jpg df8 890 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 890 UnescapeName df8 890 DecodeURL df8 890 before: /Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_ m.jpg df8 890 before: /Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_ m.jpg df8 890 after: /Messenger.mira_famous.1278859356546xVDg0_ug0_m5mfS4U_gotg--_m .jpg df8 890 unescaped file name: /Messenger.mira_famous.1278859356546xVDg0_ug0_m5 mfS4U_gotg--_m.jpg df8 890 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859356546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 HTTPRequestHandler::ReceiveRedirectedFile df8 890 HTTPRedirectHandler::HTTPRedirectHandler df8 890 GetBaseURL df8 890 bAddrContainsPort: 0 df8 890 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59356546xVDg0_ug0_m5mfS4U_gotg--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 890 HTTPRedirectHandler::Process df8 890 ValidateKeys df8 890 ReadIniFileString df8 890 section: [Info] key: 'Timestamp' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593

56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning '268B1517C18756BFFAE66DE5F4F3C424' df8 890 szTimeStamp: '268B1517C18756BFFAE66DE5F4F3C424' df8 890 CSecretKey::CSecretKey df8 890 szApp: Messenger df8 890 szUser: mira_famous df8 890 szTimeStamp: 268B1517C18756BFFAE66DE5F4F3C424 df8 890 CSecretKey::Init(). df8 890 m_szAppID: Messenger df8 890 m_szUserID: mira_famous df8 890 KeyMatches 'lc9lu9' df8 890 key comparison test passed... continuing df8 890 HTTPRedirectHandler::CheckRedirectFile df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 ReadIniFileInt df8 890 section: [Info] key: 'Dir' default: 0 df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 0 df8 890 set m_RType to RedirectTypeSingleFile df8 890 ReadIniFileString df8 890 section: [Info] key: 'App' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 'Messenger' df8 890 ReadIniFileString df8 890 section: [Info] key: 'User' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 'mira_famous' df8 890 ReadIniFileString df8 890 section: [Info] key: 'Version' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 'MSG1.0' df8 890 ReadIniFileInt df8 890 section: [Info] key: 'Post' default: 0 df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 1 df8 890 m_szINIApp: 'Messenger' df8 890 m_szINIUser: 'mira_famous' df8 890 m_szINIVersionString: 'MSG1.0' df8 890 m_iIsPost: 1 df8 890 ReadIniFileInt df8 890 section: [Info] key: 'W' default: 0 df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 525030 df8 890 m_hWnd: 0x802e6 df8 890 ReadIniFileInt df8 890 section: [Info] key: 'M' default: 0 df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 11 df8 890 m_nMsgNumber: 11 df8 890 exit HTTPRedirectHandler::CheckRedirectFile df8 890 HTTPRedirectHandler::HandleRedirectSingleFile df8 890 ReadIniFileString

df8 890 section: [Info] key: 'Name' default: '' df8 890 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 56546xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \xVDg0_ug0_m5mfS4U_gotg--_m.jpg' df8 890 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 m_bProcessed: 1 [success] df8 890 exit HTTPRedirectHandler::Process df8 890 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\xVDg0_ug0_m5mfS4U_gotg--_m.jpg. df8 890 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\xVDg0_ug0_m5mfS4U_gotg--_m.jpg. df8 890 HTTPRedirectHandler::~HTTPRedirectHandler df8 890 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 m_hWndReporting: 0x802e6 df8 890 m_nMsgNumber: 11 df8 890 RedirectType: 1 RedirectTypeSingleFile df8 890 bIsPost: 1 df8 890 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 890 SendMessage 0x802e6 df8 890 IPCInfo: df8 890 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\xVDg0_ug0_m5mfS4U_gotg--_m.jpg' df8 890 cUserID: 'mira_famous' df8 890 nStatus: 0 df8 890 nType: YSERVER_IPC_BEGIN df8 890 lFileLen: 0 df8 890 lCurrBytes: 0 df8 890 nMessageNumber: 11 df8 890 SendMessage processed df8 890 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 ReceiveFile df8 890 iContentLength: 57004 df8 890 ReceiveEntityBody df8 890 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\xVDg 0_ug0_m5mfS4U_gotg--_m.jpg df8 890 dwBufSize: 16384 df8 890 dwNumBufBytesUsed: 781 df8 890 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 flushed 781 bytes df8 890 PostInfoToApp YSERVER_IPC_RECEIVING 781 0 df8 890 ReadEntityBodyChunk 16384 df8 890 PostInfoToApp YSERVER_IPC_RECEIVING 17165 0 df8 890 ReadEntityBodyChunk 16384 df8 890 PostInfoToApp YSERVER_IPC_RECEIVING 33549 0 df8 890 ReadEntityBodyChunk 16384 df8 890 PostInfoToApp YSERVER_IPC_RECEIVING 49933 0 df8 890 ReadEntityBodyChunk 7071 df8 890 PostInfoToApp YSERVER_IPC_RECEIVING 57004 0 df8 890 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ xVDg0_ug0_m5mfS4U_gotg--_m.jpg df8 890 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 890 SendMessage 0x802e6 df8 890 IPCInfo: df8 890 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\xVDg0_ug0_m5mfS4U_gotg--_m.jpg'

df8 df8 df8 df8 df8 df8 df8 df8 df8 df8

890 cUserID: 'mira_famous' 890 nStatus: 0 890 nType: YSERVER_IPC_FINISHED 890 lFileLen: 0 890 lCurrBytes: 0 890 nMessageNumber: 11 890 SendMessage processed 890 exit HTTPRequestHandler::ReceiveRedirectedFile 890 SendString 890

<HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 890 200 df8 890 OK df8 890 sent: df8 890 <<<< df8 890 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 890 >>>> df8 890 leaving HandleFileReceive df8 890 HTTPRequestHandler::~HTTPRequestHandler df8 890 calling g_RQT.RemoveHTTPRQH, this = 3620568. df8 890 after calling RemoveHTTPRQH, count = 0. df8 890 closesocket: 0x1dc df8 890 HTTPLog::~HTTPLog df8 890 leaving HandlerThread df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\knTfStCas_wG7UgX8cXKTw--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 12 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\knTfStCas_wG7UgX8cXKTw--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous'

df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859366765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859366765knTfStCas_w G7UgX8cXKTw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\knTfStCas_wG7UgX 8cXKTw--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \knTfStCas_wG7UgX8cXKTw--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=248B0DB0FBE8CD0989A1FB1B74451E98 df8 298 df8 298 df8 298 W=525030 M=12 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=12 writing to ini file: wrote Timestamp=248B0DB0FBE8CD0989A1FB1B74451E98 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded.

df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859366765knTf StCas_wG7UgX8cXKTw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859366765knTfStCas_wG7U gX8cXKTw--_m.jpg df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52976 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 b08 AddHandlerThreadToThreadArray df8 b08 CloseHandle thread 0x1b4 df8 424 HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 424 home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 424 m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 424 about to m_HTTPLog.SetSocket(m_sock) df8 424 HTTPLog::SetSocket starting... socket=432 df8 424 HTTPLog::SetSocket exiting df8 424 about to g_RQT.AddHTTPRQH(this), this = 3620568 df8 424 after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 424 about to create Kill Comm Event df8 424 leaving HTTPRequestHandler::HTTPRequestHandler df8 424 HTTPRequestHandler::ReadRequest df8 424 HTTPRequestHandler::ReadRequest df8 424 received 1024 bytes df8 424 Found '\r\n\r\n' df8 424 allocating entity body buffer to store read overflow from header df8 424 781 bytes df8 424 0 ms elapsed df8 424 header is: df8 424 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< df8 424 POST /Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 63928 User-Agent: Mozilla/5.0 Cache-Control: no-cache df8 df8 df8 df8 df8 df8 df8 424 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> 424 m_pEntityBodyBuffer: 0x374548 424 m_dwEntityBodyBufferSize: 16384 424 m_dwNumBytesInEntityBody: 781 424 HTTPRequestHandler::ParseRequest 424 m_cRequest: POST 424 UnescapeName

df8 424 DecodeURL df8 424 before: Messenger df8 424 before: Messenger df8 424 after: Messenger df8 424 UnescapeName df8 424 DecodeURL df8 424 before: mira_famous df8 424 before: mira_famous df8 424 after: mira_famous df8 424 UnescapeName df8 424 DecodeURL df8 424 before: lc9lu9 df8 424 before: lc9lu9 df8 424 after: lc9lu9 df8 424 extracted the filename from the URL. saving to m_cFileName: df8 424 '/Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw--_m.jp g' df8 424 m_cFileName: /Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXK Tw--_m.jpg df8 424 ProcessYahooRequestParams df8 424 DecodeURL df8 424 before: Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw--_m .jpg df8 424 ValidateRequest df8 424 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859366765k nTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 ReadIniFileString df8 424 section: [Info] key: 'App' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 'Messenger' df8 424 ReadIniFileString df8 424 section: [Info] key: 'User' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 'mira_famous' df8 424 ReadIniFileInt df8 424 section: [Info] key: 'Post' default: 0 df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 1 df8 424 ValidateRequest: true df8 424 request is a Yahoo request df8 424 leaving ParseRequest df8 424 HandleFileReceive df8 424 file name: /Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw --_m.jpg df8 424 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 424 UnescapeName df8 424 DecodeURL df8 424 before: /Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw--_ m.jpg df8 424 before: /Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw--_ m.jpg df8 424 after: /Messenger.mira_famous.1278859366765knTfStCas_wG7UgX8cXKTw--_m .jpg df8 424 unescaped file name: /Messenger.mira_famous.1278859366765knTfStCas_wG 7UgX8cXKTw--_m.jpg df8 424 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou

s.1278859366765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 HTTPRequestHandler::ReceiveRedirectedFile df8 424 HTTPRedirectHandler::HTTPRedirectHandler df8 424 GetBaseURL df8 424 bAddrContainsPort: 0 df8 424 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59366765knTfStCas_wG7UgX8cXKTw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 424 HTTPRedirectHandler::Process df8 424 ValidateKeys df8 424 ReadIniFileString df8 424 section: [Info] key: 'Timestamp' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning '248B0DB0FBE8CD0989A1FB1B74451E98' df8 424 szTimeStamp: '248B0DB0FBE8CD0989A1FB1B74451E98' df8 424 CSecretKey::CSecretKey df8 424 szApp: Messenger df8 424 szUser: mira_famous df8 424 szTimeStamp: 248B0DB0FBE8CD0989A1FB1B74451E98 df8 424 CSecretKey::Init(). df8 424 m_szAppID: Messenger df8 424 m_szUserID: mira_famous df8 424 KeyMatches 'lc9lu9' df8 424 key comparison test passed... continuing df8 424 HTTPRedirectHandler::CheckRedirectFile df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 ReadIniFileInt df8 424 section: [Info] key: 'Dir' default: 0 df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 0 df8 424 set m_RType to RedirectTypeSingleFile df8 424 ReadIniFileString df8 424 section: [Info] key: 'App' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 'Messenger' df8 424 ReadIniFileString df8 424 section: [Info] key: 'User' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 'mira_famous' df8 424 ReadIniFileString df8 424 section: [Info] key: 'Version' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 'MSG1.0' df8 424 ReadIniFileInt df8 424 section: [Info] key: 'Post' default: 0 df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 1 df8 424 m_szINIApp: 'Messenger' df8 424 m_szINIUser: 'mira_famous' df8 424 m_szINIVersionString: 'MSG1.0' df8 424 m_iIsPost: 1 df8 424 ReadIniFileInt df8 424 section: [Info] key: 'W' default: 0

df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 525030 df8 424 m_hWnd: 0x802e6 df8 424 ReadIniFileInt df8 424 section: [Info] key: 'M' default: 0 df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 12 df8 424 m_nMsgNumber: 12 df8 424 exit HTTPRedirectHandler::CheckRedirectFile df8 424 HTTPRedirectHandler::HandleRedirectSingleFile df8 424 ReadIniFileString df8 424 section: [Info] key: 'Name' default: '' df8 424 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 66765knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \knTfStCas_wG7UgX8cXKTw--_m.jpg' df8 424 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 m_bProcessed: 1 [success] df8 424 exit HTTPRedirectHandler::Process df8 424 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\knTfStCas_wG7UgX8cXKTw--_m.jpg. df8 424 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\knTfStCas_wG7UgX8cXKTw--_m.jpg. df8 424 HTTPRedirectHandler::~HTTPRedirectHandler df8 424 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 m_hWndReporting: 0x802e6 df8 424 m_nMsgNumber: 12 df8 424 RedirectType: 1 RedirectTypeSingleFile df8 424 bIsPost: 1 df8 424 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 424 SendMessage 0x802e6 df8 424 IPCInfo: df8 424 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\knTfStCas_wG7UgX8cXKTw--_m.jpg' df8 424 cUserID: 'mira_famous' df8 424 nStatus: 0 df8 424 nType: YSERVER_IPC_BEGIN df8 424 lFileLen: 0 df8 424 lCurrBytes: 0 df8 424 nMessageNumber: 12 df8 424 SendMessage processed df8 424 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 ReceiveFile df8 424 iContentLength: 63928 df8 424 ReceiveEntityBody df8 424 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\knTf StCas_wG7UgX8cXKTw--_m.jpg df8 424 dwBufSize: 16384 df8 424 dwNumBufBytesUsed: 781 df8 424 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 flushed 781 bytes df8 424 PostInfoToApp YSERVER_IPC_RECEIVING 781 0 df8 424 ReadEntityBodyChunk 16384 df8 b08 IsFreeEntryInThreadArray

df8 424 PostInfoToApp YSERVER_IPC_RECEIVING 17165 0 df8 424 ReadEntityBodyChunk 16384 df8 424 PostInfoToApp YSERVER_IPC_RECEIVING 33549 0 df8 424 ReadEntityBodyChunk 16384 df8 424 PostInfoToApp YSERVER_IPC_RECEIVING 49933 0 df8 424 ReadEntityBodyChunk 13995 df8 424 PostInfoToApp YSERVER_IPC_RECEIVING 63928 0 df8 424 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ knTfStCas_wG7UgX8cXKTw--_m.jpg df8 424 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 424 SendMessage 0x802e6 df8 424 IPCInfo: df8 424 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\knTfStCas_wG7UgX8cXKTw--_m.jpg' df8 424 cUserID: 'mira_famous' df8 424 nStatus: 0 df8 424 nType: YSERVER_IPC_FINISHED df8 424 lFileLen: 0 df8 424 lCurrBytes: 0 df8 424 nMessageNumber: 12 df8 424 SendMessage processed df8 424 exit HTTPRequestHandler::ReceiveRedirectedFile df8 424 SendString df8 424 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 424 200 df8 424 OK df8 424 sent: df8 424 <<<< df8 424 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 424 >>>> df8 424 leaving HandleFileReceive df8 424 HTTPRequestHandler::~HTTPRequestHandler df8 424 calling g_RQT.RemoveHTTPRQH, this = 3620568. df8 424 after calling RemoveHTTPRQH, count = 0. df8 424 closesocket: 0x1b0 df8 298 CYServerComponent::PostFile df8 298 CreateShortcutFileForRequestdf8 298 szFullPathName: C:\Progra

m Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 298 szAppID: Messenger df8 298 szUserID: mira_famous df8 298 szVersion: MSG1.0 df8 298 nhWnd: 525030 df8 298 nMsgNumber: 13 df8 298 CreateShortcutFile df8 298 szVersion: 'MSG1.0' df8 298 szOriginalFile: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing \Sc554\.F.fHNz_79xi8VNBmAaGBw--_m.jpg' df8 298 szAppID: 'Messenger' df8 298 szUserID: 'mira_famous' df8 298 bIsDir: 0 df8 298 bIsPost: 1 df8 298 CreateShortcutFileName df8 298 shortcut file name: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_f amous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 298 CSecretKey::CSecretKey df8 298 szApp: Messenger df8 298 szUser: mira_famous df8 298 CSecretKey::Init(). df8 298 m_szAppID: Messenger df8 298 m_szUserID: mira_famous df8 298 CreateURL df8 298 GetBaseURL df8 298 bAddrContainsPort: 0 df8 298 base URL: http://175.144.148.105 df8 298 CreateURL returned: df8 298 http://175.144.148.105/Messenger.mira_famous.1278859373593.F.fHNz_79x i8VNBmAaGBw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 WriteShortcutFile df8 298 writing to ini file: df8 298 [Info] Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\.F.fHNz_79xi8VNB mAaGBw--_m.jpg Version=MSG1.0 df8 298 wrote Name=C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 298 wrote Version=MSG1.0 df8 298 writing to ini file: df8 298 App=Messenger User=mira_famous df8 df8 df8 df8 298 298 298 298 wrote App=Messenger wrote User=mira_famous writing to ini file:

Timestamp=74D7D6D5707015853CB6882E1A311A63 df8 298 df8 298 df8 298 W=525030 wrote Timestamp=74D7D6D5707015853CB6882E1A311A63 writing to ini file:

M=13 df8 df8 df8 df8 298 298 298 298 wrote W=525030 wrote M=13 writing to ini file:

Post=1 df8 298 wrote Post=1 df8 298 exit CreateShortcutFile df8 298 CreateShortcutFile succeeded. df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 Entering AllocateAndCopyToWideString df8 298 Leaving AllocateAndCopyToWideStrign df8 298 output: df8 298 szURL: http://175.144.148.105/Messenger.mira_famous.1278859373593.F.f HNz_79xi8VNBmAaGBw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9lu9 df8 298 szKey: lc9lu9 df8 298 szShortcutFileName: Messenger.mira_famous.1278859373593.F.fHNz_79xi8V NBmAaGBw--_m.jpg df8 298 leaving PostFile df8 b08 accept connection from: df8 b08 IP addr: 180.73.101.44 df8 b08 port: 52977 df8 b08 accept socket: df8 b08 IP addr: 175.144.148.105 df8 b08 port: 80 df8 b08 spawning new Handler thread df8 b08 ReportInitProgress df8 c10 HandlerThread 0x1d0 df8 c10 HTTPLog::HTTPLog df8 c10 HTTPRequestHandler::HTTPRequestHandler (max incoming = 1024) df8 c10 home directory is C:\PROGRA~1\Yahoo!\MESSEN~1\data df8 c10 m_szHomeDir: 'C:\PROGRA~1\Yahoo!\MESSEN~1\data' df8 c10 about to m_HTTPLog.SetSocket(m_sock) df8 c10 HTTPLog::SetSocket starting... socket=464 df8 c10 HTTPLog::SetSocket exiting df8 c10 about to g_RQT.AddHTTPRQH(this), this = 3639624 df8 c10 after calling g_RQT.AddHTTPRQH(this). total count = 1. df8 c10 about to create Kill Comm Event df8 c10 leaving HTTPRequestHandler::HTTPRequestHandler df8 c10 HTTPRequestHandler::ReadRequest df8 c10 HTTPRequestHandler::ReadRequest df8 c10 received 243 bytes df8 c10 Found '\r\n\r\n' df8 c10 0 ms elapsed df8 c10 header is: df8 c10 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< df8 c10 POST /Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_m.jpg?AppID=Me ssenger&UserID=mira_famous&K=lc9lu9 HTTP/1.1 Connection: Close Host: 175.144.148.105 Content-Length: 42186 User-Agent: Mozilla/5.0

Cache-Control: no-cache df8 c10 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> df8 c10 m_pEntityBodyBuffer: 0x0 df8 c10 m_dwEntityBodyBufferSize: 0 df8 c10 m_dwNumBytesInEntityBody: 0 df8 c10 HTTPRequestHandler::ParseRequest df8 c10 m_cRequest: POST df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: Messenger df8 c10 before: Messenger df8 c10 after: Messenger df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: mira_famous df8 c10 before: mira_famous df8 c10 after: mira_famous df8 c10 UnescapeName df8 c10 DecodeURL df8 c10 before: lc9lu9 df8 c10 before: lc9lu9 df8 c10 after: lc9lu9 df8 c10 extracted the filename from the URL. saving to m_cFileName: df8 c10 '/Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_m.jp g' df8 c10 m_cFileName: /Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaG Bw--_m.jpg df8 c10 ProcessYahooRequestParams df8 c10 DecodeURL df8 c10 before: Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_m .jpg df8 c10 ValidateRequest df8 c10 C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.1278859373593. F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'App' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 'Messenger' df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'User' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 'mira_famous' df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'Post' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 1 df8 c10 ValidateRequest: true df8 c10 request is a Yahoo request df8 c10 leaving ParseRequest df8 c10 HandleFileReceive df8 c10 file name: /Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw --_m.jpg df8 c10 Entering GetUnescapedFullPathFileName, base path is C:\PROGRA~1\ Yahoo!\MESSEN~1\data df8 c10 UnescapeName

df8 c10 DecodeURL df8 c10 before: /Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_ m.jpg df8 c10 before: /Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_ m.jpg df8 c10 after: /Messenger.mira_famous.1278859373593.F.fHNz_79xi8VNBmAaGBw--_m .jpg df8 c10 unescaped file name: /Messenger.mira_famous.1278859373593.F.fHNz_79xi 8VNBmAaGBw--_m.jpg df8 c10 full file path: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famou s.1278859373593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 HTTPRequestHandler::ReceiveRedirectedFile df8 c10 HTTPRedirectHandler::HTTPRedirectHandler df8 c10 GetBaseURL df8 c10 bAddrContainsPort: 0 df8 c10 set m_szRawURL to http://175.144.148.105//Messenger.mira_famous.12788 59373593.F.fHNz_79xi8VNBmAaGBw--_m.jpg?AppID=Messenger&UserID=mira_famous&K=lc9l u9 df8 c10 HTTPRedirectHandler::Process df8 c10 ValidateKeys df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'Timestamp' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning '74D7D6D5707015853CB6882E1A311A63' df8 c10 szTimeStamp: '74D7D6D5707015853CB6882E1A311A63' df8 c10 CSecretKey::CSecretKey df8 c10 szApp: Messenger df8 c10 szUser: mira_famous df8 c10 szTimeStamp: 74D7D6D5707015853CB6882E1A311A63 df8 c10 CSecretKey::Init(). df8 c10 m_szAppID: Messenger df8 c10 m_szUserID: mira_famous df8 c10 KeyMatches 'lc9lu9' df8 c10 key comparison test passed... continuing df8 c10 HTTPRedirectHandler::CheckRedirectFile df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'Dir' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 0 df8 c10 set m_RType to RedirectTypeSingleFile df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'App' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 'Messenger' df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'User' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 'mira_famous' df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'Version' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 'MSG1.0' df8 c10 ReadIniFileInt

df8 c10 section: [Info] key: 'Post' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 1 df8 c10 m_szINIApp: 'Messenger' df8 c10 m_szINIUser: 'mira_famous' df8 c10 m_szINIVersionString: 'MSG1.0' df8 c10 m_iIsPost: 1 df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'W' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 525030 df8 c10 m_hWnd: 0x802e6 df8 c10 ReadIniFileInt df8 c10 section: [Info] key: 'M' default: 0 df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 13 df8 c10 m_nMsgNumber: 13 df8 c10 exit HTTPRedirectHandler::CheckRedirectFile df8 c10 HTTPRedirectHandler::HandleRedirectSingleFile df8 c10 ReadIniFileString df8 c10 section: [Info] key: 'Name' default: '' df8 c10 file: C:\PROGRA~1\Yahoo!\MESSEN~1\data\Messenger.mira_famous.12788593 73593.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 returning 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \.F.fHNz_79xi8VNBmAaGBw--_m.jpg' df8 c10 set m_szFileToTransfer to C:\Program Files\Yahoo!\Messenger\Cache\Pho toSharing\Sc554\.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 m_bProcessed: 1 [success] df8 c10 exit HTTPRedirectHandler::Process df8 c10 GetRedirInfo(), OutputFileName is C:\Program Files\Yahoo !\Messenger\Cache\PhotoSharing\Sc554\.F.fHNz_79xi8VNBmAaGBw--_m.jpg. df8 c10 szOutputFilename is C:\Program Files\Yahoo!\Messenger\Ca che\PhotoSharing\Sc554\.F.fHNz_79xi8VNBmAaGBw--_m.jpg. df8 c10 HTTPRedirectHandler::~HTTPRedirectHandler df8 c10 m_cFileName: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc5 54\.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 m_hWndReporting: 0x802e6 df8 c10 m_nMsgNumber: 13 df8 c10 RedirectType: 1 RedirectTypeSingleFile df8 c10 bIsPost: 1 df8 c10 PostInfoToApp YSERVER_IPC_BEGIN 0 0 df8 c10 SendMessage 0x802e6 df8 c10 IPCInfo: df8 c10 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\.F.fHNz_79xi8VNBmAaGBw--_m.jpg' df8 c10 cUserID: 'mira_famous' df8 c10 nStatus: 0 df8 c10 nType: YSERVER_IPC_BEGIN df8 c10 lFileLen: 0 df8 c10 lCurrBytes: 0 df8 c10 nMessageNumber: 13 df8 c10 SendMessage processed df8 c10 calling ReceiveFile C:\Program Files\Yahoo!\Messenger\Cache\PhotoShar ing\Sc554\.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 ReceiveFile df8 c10 iContentLength: 42186 df8 c10 ReceiveEntityBody

df8 c10 temp: C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\.F.f HNz_79xi8VNBmAaGBw--_m.jpg df8 c10 dwBufSize: 16384 df8 c10 dwNumBufBytesUsed: 0 df8 c10 creating file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554 \.F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 ReadEntityBodyChunk 16384 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 16384 0 df8 c10 ReadEntityBodyChunk 16384 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 32768 0 df8 c10 ReadEntityBodyChunk 9418 df8 c10 PostInfoToApp YSERVER_IPC_RECEIVING 42186 0 df8 c10 closing file C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc554\ .F.fHNz_79xi8VNBmAaGBw--_m.jpg df8 c10 PostInfoToApp YSERVER_IPC_FINISHED 0 0 df8 c10 SendMessage 0x802e6 df8 c10 IPCInfo: df8 c10 cFileName: 'C:\Program Files\Yahoo!\Messenger\Cache\PhotoSharing\Sc55 4\.F.fHNz_79xi8VNBmAaGBw--_m.jpg' df8 c10 cUserID: 'mira_famous' df8 c10 nStatus: 0 df8 c10 nType: YSERVER_IPC_FINISHED df8 c10 lFileLen: 0 df8 c10 lCurrBytes: 0 df8 c10 nMessageNumber: 13 df8 c10 SendMessage processed df8 c10 exit HTTPRequestHandler::ReceiveRedirectedFile df8 c10 SendString df8 c10 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 c10 200 df8 c10 OK df8 c10 sent: df8 c10 <<<< df8 c10 HTTP/1.0 200 OK Server: Y! Content-Type: text/html Content-Length: 106 <HTML> <HEAD> <title>File received</title> </HEAD> <BODY> the file was received </BODY> </HTML> df8 c10 >>>> df8 c10 leaving HandleFileReceive df8 c10 HTTPRequestHandler::~HTTPRequestHandler

df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8 df8

c10 c10 c10 424 424 c10 c10 298 298 298 298 298 298 298 298 184 184 184 184 b08 b08 b08 184 184 184 184 184 298 298 298 298 268 298 298

calling g_RQT.RemoveHTTPRQH, this = 3639624. after calling RemoveHTTPRQH, count = 0. closesocket: 0x1d0 HTTPLog::~HTTPLog leaving HandlerThread HTTPLog::~HTTPLog leaving HandlerThread CYServerComponent::GetDownloadStatus HTTPRQTotals::GetTotals Entering AllocateAndCopyToWideString Leaving AllocateAndCopyToWideStrign Entering AllocateAndCopyToWideString Leaving AllocateAndCopyToWideStrign CYServerComponent::IsServerRunning CYServerComponent::StopServer WaitForMultipleObjects returned 0 GetExitCodeThread for ListenerThread 0x178: 0x103 hKillEvent was signalled: need to kill listener thread calling closesocket on listener socket 0x18c accept failed 10004 IsFreeEntryInThreadArray CloseHandle thread 0x168 waiting for ListenerThread to complete WaitForSingleObject 0x178 returned 0 ListenerThread completed ReportInitProgress leaving ServerThread stopping server leaving CYServerComponent::StopServer Increment reference count for final release CYServerComponent::~CYServerComponent leaving CountdownThread back from message loop leaving WinMain