HEUR:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Barys.13489 (AdAware), Backdoor.Win32.Xtrat.FD, GenericAutorunWorm.YR, GenericInjector.YR, TrojanDropperVtimrun.YR (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan, Backdoor, Worm, WormAutorun
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 8af788142e8ca647cae800f18e5ed6b7
SHA1: 4ffc32830e33def0eec2885f75be284dfc79691b
SHA256: 24d046a32e1d8fc27932883f4dd12df3f60f98c4ff082f7be8567b303b6a1b7e
SSDeep: 12288:uQaOJtxzAcU/oBjT1rEh1ETMZinJaxR9 yRMshvXdYr1pk712 5rDpw13lHXPk:uQxJAcKoBfxEhDZinXyRMshvXd fxDpb
Size: 731648 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: www.GameModding.net
Created at: 2013-10-14 08:50:27
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.
Dynamic Analysis
Payload
Behaviour | Description |
---|---|
WormAutorun | A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer. |
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1908
157.exe:2504
.exe:2996
The Trojan injects its code into the following process(es):
CARDGE~1.EXE:2700
iexplore.exe:1204
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1908 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe (2931 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE (12346 bytes)
The process 157.exe:2504 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (812 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (0 bytes)
The process .exe:2996 makes changes in the file system.
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\x.html (0 bytes)
The process CARDGE~1.EXE:2700 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_important[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MEWP6U2.txt (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400i[1].eot (12626 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_menu[1].js (6412 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (1528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\gradient_tcat[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Big_banner[1].gif (108402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\pid[1] (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\leaksbannerov[1].gif (483124 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\cf.errors.ie[1].css (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (3400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\close[1].gif (428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\51[1].gif (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\larme[1].jpg (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\w3ccss[1].gif (177 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (942 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300[1].eot (5777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\username[1].png (728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HJEFLFIX.txt (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\nav_final[1].gif (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_md5[1].js (213 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\cron[1].htm (3879 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error_icons[1].png (6369 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (3318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav_bg_small[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\gdtmvRl[1].gif (9913 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\cf.errors[1].css (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400[1].eot (9416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\qoEf3sh[1].png (5656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-700[1].eot (4353 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (3346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sa1[1].jpg (5276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head4[1].gif (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (10712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head2[1].gif (2812 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navbits_start[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bg_tile[1].gif (427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\L3Zd0Sx[1].gif (10186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\gradient_thead[1].gif (846 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\cf.common[1].js (1161 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\w3cxhtml[1].gif (175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W2NA5IUV.txt (117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_global[1].js (11653 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\s[1].gif (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\GX1OvJc[1].gif (28385 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (2800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\twitter[1].png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL247F2Y.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jquery.min[1].js (60249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-600[1].eot (8385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\altenen_com[1].htm (4519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head1[1].gif (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\a[1].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\newofurmatn[1].gif (139152 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (1496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yahoo-dom-event[1].js (21224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\connection-min[1].js (7892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head3[1].gif (2338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300i[1].eot (15058 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (624 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P4VFDFXK.txt (246 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1F94CD5CA263ECFB1A4BAB1B832C909 (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navbits_finallink_ltr[1].gif (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\facebook[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\password[1].png (620 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1F94CD5CA263ECFB1A4BAB1B832C909 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F3TFJKIL.txt (279 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (50 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101020161017 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016102820161029 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (0 bytes)
Registry activity
The process %original file name%.exe:1908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"
The process 157.exe:2504 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
The process .exe:2996 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\XtremeRAT]
"Mutex" = "j0ahKrg"
The process CARDGE~1.EXE:2700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"EnableFileTracing" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "CARDGE~1.EXE"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"FileDirectory" = "%windir%\tracing"
[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"fdwSupport" = "1"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"EnableFileTracing" = "0"
[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1481593403"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"FileTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CachePrefix" = ":2017021020170211:"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"ConsoleTracingMask" = "4294901760"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheLimit" = "8192"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"FileTracingMask" = "4294901760"
[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"ConsoleTracingMask" = "4294901760"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101020161017]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016102820161029]
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
Dropped PE files
MD5 | File path |
---|---|
54a47f6b5e09a77e61649109c6a08866 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe |
9fdbd7c06b0dbf891f391ae2898f8fe2 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe |
ef87d6b587f71d7c2b865fbb27e97fcd | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE |
9fdbd7c06b0dbf891f391ae2898f8fe2 | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe |
54a47f6b5e09a77e61649109c6a08866 | c:\Windows\System32\InstallDir\svchost.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1908
157.exe:2504
.exe:2996 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe (2931 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE (12346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (812 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_important[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MEWP6U2.txt (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400i[1].eot (12626 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_menu[1].js (6412 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (1528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\gradient_tcat[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Big_banner[1].gif (108402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\pid[1] (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\leaksbannerov[1].gif (483124 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\cf.errors.ie[1].css (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (3400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\close[1].gif (428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\51[1].gif (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\larme[1].jpg (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\w3ccss[1].gif (177 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (942 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300[1].eot (5777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\username[1].png (728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HJEFLFIX.txt (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\nav_final[1].gif (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_md5[1].js (213 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\cron[1].htm (3879 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error_icons[1].png (6369 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (3318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav_bg_small[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\gdtmvRl[1].gif (9913 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\cf.errors[1].css (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400[1].eot (9416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\qoEf3sh[1].png (5656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-700[1].eot (4353 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (3346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sa1[1].jpg (5276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head4[1].gif (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (10712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head2[1].gif (2812 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navbits_start[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bg_tile[1].gif (427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\L3Zd0Sx[1].gif (10186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\gradient_thead[1].gif (846 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\cf.common[1].js (1161 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\w3cxhtml[1].gif (175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W2NA5IUV.txt (117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_global[1].js (11653 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\s[1].gif (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\GX1OvJc[1].gif (28385 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (2800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\twitter[1].png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL247F2Y.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jquery.min[1].js (60249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-600[1].eot (8385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\altenen_com[1].htm (4519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head1[1].gif (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\a[1].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\newofurmatn[1].gif (139152 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (1496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yahoo-dom-event[1].js (21224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\connection-min[1].js (7892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head3[1].gif (2338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300i[1].eot (15058 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (624 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P4VFDFXK.txt (246 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1F94CD5CA263ECFB1A4BAB1B832C909 (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navbits_finallink_ltr[1].gif (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\facebook[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\password[1].png (620 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1F94CD5CA263ECFB1A4BAB1B832C909 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F3TFJKIL.txt (279 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (50 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
- Reboot the computer.
Static Analysis
VersionInfo
Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.16428
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Chinese (Simplified, PRC)
Company Name: Microsoft CorporationProduct Name: Internet ExplorerProduct Version: 11.00.9600.16428Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)File Description: Win32 Cabinet Self-Extractor Comments: Language: Chinese (Simplified, PRC)
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 26060 | 26112 | 4.42567 | e9bf1a1e456a9a811b1b86e6602e3636 |
.data | 32768 | 6796 | 1024 | 2.20139 | 317f8a934ee443eee01c2a315bde9ca1 |
.idata | 40960 | 4216 | 4608 | 3.49941 | d8675ba112ef922c6057a02546757a1a |
.rsrc | 49152 | 693755 | 693760 | 5.50206 | 38ee6b084cb16031ef7341ab6530e645 |
.reloc | 745472 | 5038 | 5120 | 2.58043 | 83de2f9b2c95be6fea06bced7e8a058e |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://www.altenen.com/ | 5.254.123.33 |
hxxp://www.altenen.com/banhammer/pid | 5.254.123.33 |
hxxp://www.altenen.com/clientscript/vbulletin_important.css?v=389 | 5.254.123.33 |
hxxp://www.altenen.com/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389 | 5.254.123.33 |
hxxp://www.altenen.com/clientscript/yui/connection/connection-min.js?v=389 | 5.254.123.33 |
hxxp://www.altenen.com/clientscript/vbulletin_global.js?v=389 | 5.254.123.33 |
hxxp://www.altenen.com/clientscript/vbulletin_menu.js?v=389 | 5.254.123.33 |
hxxp://leakswith.pro/bannerov/leaksbannerov.gif | 104.18.55.132 |
hxxp://www.altenen.com/images/bluefox/misc/close.gif | 5.254.123.33 |
hxxp://www.altenen.com/clientscript/vbulletin_md5.js?v=389 | 5.254.123.33 |
hxxp://www.altenen.com/images/smilies/51.gif | 5.254.123.33 |
hxxp://paysell.bz/Big_banner.gif | 104.31.69.21 |
hxxp://www.altenen.com/images/head1.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/head2.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/head3.gif | 5.254.123.33 |
hxxp://altenens.com/qoEf3sh.png | |
hxxp://www.altenen.com/images/bluefox/misc/navbits_start.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/misc/navbits_finallink_ltr.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/misc/password.png | 5.254.123.33 |
hxxp://www.altenen.com/jpg/newofurmatn.gif | 5.254.123.33 |
hxxp://www.altenen.com/jpg/GX1OvJc.gif | 5.254.123.33 |
hxxp://www.altenen.com/jpg/L3Zd0Sx.gif | 5.254.123.33 |
hxxp://xslt.alexa.com/site_stats/js/t/a?url=altenen.com | 54.192.129.104 |
hxxp://www.altenen.com/images/bluefox/misc/w3cxhtml.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/misc/w3ccss.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/misc/nav_final.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/misc/username.png | 5.254.123.33 |
hxxp://www.altenen.com/images/head4.gif | 5.254.123.33 |
hxxp://www.altenen.com/jpg/twitter.png | 5.254.123.33 |
hxxp://www.altenen.com/jpg/facebook.png | 5.254.123.33 |
hxxp://www.altenen.com/jpg/sa1.jpg | 5.254.123.33 |
hxxp://www.altenen.com/cron.php?rand=1486741283 | 5.254.123.33 |
hxxp://www.altenen.com/jpg/gdtmvRl.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/misc/bg_tile.gif | 5.254.123.33 |
hxxp://www.altenen.com/anger1/head4.gif | 5.254.123.33 |
hxxp://www.altenen.com/danger1/head4.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/misc/nav_bg_small.gif | 5.254.123.33 |
hxxp://www.altenen.com/jpg/larme.jpg | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/gradients/gradient_tcat.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/misc/nav.gif | 5.254.123.33 |
hxxp://www.altenen.com/images/bluefox/gradients/gradient_thead.gif | 5.254.123.33 |
hxxp://xsltcache.alexa.com/site_stats/gif/t/a/YWx0ZW5lbi5jb20=/s.gif | 54.164.75.60 |
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx | |
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= | |
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= | |
hxxp://a692.d.akamai.net/certs/ca.crt | |
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4= | |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab | |
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J | |
hxxp://altenens.com/register | |
hxxp://a36.d.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= | |
hxxp://a36.d.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= | |
hxxp://altenens.com/cdn-cgi/styles/cf.errors.css | |
hxxp://altenens.com/cdn-cgi/styles/cf.errors.ie.css | |
hxxp://altenens.com/cdn-cgi/scripts/jquery.min.js | |
hxxp://altenens.com/cdn-cgi/scripts/cf.common.js | |
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-300.eot | |
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-400.eot | |
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-600.eot | |
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-700.eot | |
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-400i.eot | |
hxxp://altenens.com/cdn-cgi/images/error_icons.png | |
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-300i.eot | |
hxxp://a767.dspw65.akamai.net/pki/crl/products/WinPCA.crl | |
hxxp://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J | 178.255.83.1 |
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-700.eot | 104.27.141.154 |
hxxp://www.altenens.com/cdn-cgi/scripts/jquery.min.js | 104.27.141.154 |
hxxp://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= | 212.30.134.177 |
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-400.eot | 104.27.141.154 |
hxxp://aia.startssl.com/certs/ca.crt | 173.223.11.161 |
hxxp://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= | 178.255.83.1 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= | 23.46.123.27 |
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-600.eot | 104.27.141.154 |
hxxp://www.altenens.com/cdn-cgi/styles/cf.errors.css | 104.27.141.154 |
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-400i.eot | 104.27.141.154 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | 80.231.122.161 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY | 216.58.214.206 |
hxxp://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= | 212.30.134.177 |
hxxp://www.altenens.com/qoEf3sh.png | 104.27.141.154 |
hxxp://www.altenens.com/cdn-cgi/images/error_icons.png | 104.27.141.154 |
hxxp://www.altenens.com/cdn-cgi/styles/cf.errors.ie.css | 104.27.141.154 |
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx | 104.16.28.216 |
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-300i.eot | 104.27.141.154 |
hxxp://www.altenens.com/register | 104.27.141.154 |
hxxp://www.altenens.com/cdn-cgi/scripts/cf.common.js | 104.27.141.154 |
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl | 212.30.134.166 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon | 216.58.214.206 |
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-300.eot | 104.27.141.154 |
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= | 178.255.83.1 |
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4= | 178.255.83.1 |
donald-trump.party | 104.24.102.24 |
s29.postimg.org | 163.47.178.206 |
s11.postimg.org | 163.47.178.206 |
redspider.cc | 104.27.144.39 |
ah-antihacker.ddns.net | 177.86.90.37 |
s24.postimg.org | 163.47.178.204 |
sync.1dmp.io | 136.243.44.222 |
s23.postimg.org | 163.47.178.201 |
s28.postimg.org | 163.47.178.204 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 404 Not Found
Date: Fri, 10 Feb 2017 15:42:06 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca4.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:36 GMT
Server: Apache
Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT
Expires: Tue, 14 Feb 2017 12:30:43 GMT
ETag: CD4E411028F5966AE35940E7A80D2D957332E76F
Cache-Control: max-age=333546,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp29
Content-Length: 312
Connection: close
Content-Type: application/ocsp-response
0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..20170207123043Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y..[%.i..&Uf.9...T.....20170207123043Z....20170214123043Z0...*.H.=....g.0d.0...`..,3l.s.zT.M...h..&.F........C^..jdu..e..\.G.0H.dD$nk..Z.E.!.b.!.O.2.Y.<......]8M.c.{r.d..-.....
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=df3f71f4af9a46c9174e52993b6138dcb1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6ad28b59b4-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=df3f71f4af9a46c9174e52993b6138dcb1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6b32c059b4-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /site_stats/gif/t/a/YWx0ZW5lbi5jb20=/s.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: xsltcache.alexa.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Age: 69
Cache-Control: public
Content-Type: image/gif
Date: Fri, 10 Feb 2017 15:40:16 GMT
ETag: "10-Feb-17"
Expires: Sat, 11 Feb 2017 15:40:16 GMT
Last-Modified: Fri, 10 Feb 2017 00:00:00 GMT
Server: Apache-Coyote/1.1
Via: 1.0 ip-172-30-44-237 (squid/3.1.23)
X-Cache: HIT from ip-172-30-44-237
X-Cache-Lookup: HIT from ip-172-30-44-237:80
Content-Length: 2860
Connection: keep-alive
GIF89ax.A.....................................................................................................................................{{.{{.zz{............||..........{{{............||.{{|......||......................|||......}}......................||}...}}................}}............................~~.}}}.................................}}~........................~~...............................~~~..................~~..........................................................................................................................................................................................................................................................................................................................................................,....x.A........H......*\.......H.H.....3j.......?..I..I..O.\.........8@&M.....h.....aJ<p......HD.4.N.......d..@/...@...=k..;.)..3.X..UkJ.].|..s.Q.D...9`*A.Du2.H`...f%.U.W.....,h.@.....68.u...s........lQc..`.Q..(&......g#...@...U..................q>.(..D.=.2..u....(.O.>.-W..k.....s..._LLYm..9#oG.9;z...'.T...^j.E..x.%.._I...w.eGT...g........$p V.Bx.k.!..D=...f.< .~rUX.....V....bR#...k...Sa.e..z.........T)vf^.Xf...Zv.%q^.. ..A ..*.Y..h.9.......tny..s..'...........s.*..|.ZgEp..g.......V.i..f.(E......R.i..Z....r.%.........yj..j.f....'....'....*...k...&[^..6....F ...Vk...^ ...v..... ....k.... ......... ....k.... .........,....l.....o..7......p..Wl....T...w... .,..$.l..&.d..,....0.,..4.l..6C...<....@.-..D.m4.:...v.4.t.N?.t......TW....a.
<<< skipped >>>
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86408
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT
If-None-Match: "8017f9a85f10d21:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.download.windowsupdate.com
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Sat, 12 Nov 2016 01:34:12 GMT
Accept-Ranges: bytes
ETag: "02e4de843cd21:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 50939
Date: Fri, 10 Feb 2017 15:41:41 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
MSCF............,...................I.................kI;. .authroot.stl.6....7..CK...<.[.........].y.Q..YKv..%k.....!..H!.Q.-..$tU$.)7k..R.=...n3......}?...3gf......h<.2...4.(q..f......&{.`....02.s...2@`.J.<#..q..0Xy%.4..egd.:M.B....in.([....W....(.|.....|....s!..Mo..@......|"(n;Z..'~DE.}(........Mz:T....x..{..n.`z..-.\.............q....ld2z..N/.b.J...........X.S.:UN.S.v."..'l........:yz.<."!.]O..6.:d.....C.P ....P($.Y.Q y..y..B....u.`...u.00.....|(..A.J.Cp.c...X..g.........}..'........D.QVFf0...D...a6.f.0.....k.*8...<.;..o...(.....f...L.0..C.......I.A!.H.....'._)....Qc.V.....5D..,..d../(..j.F.d.....`..f...$>:_%.W..(....@.r.9..Ob.e.$..m.~.]....g.......%`e_..&Qhp .......ey.c.....H`.%<9.......#.\S...R.5....v.......dWE.....:...../"3.._..l.XiH.J!..............{.5C_...i.U....7....;p....Q.`....L.j........u....b.`:Mk.L.......*..@M^m..Jv...g........<d:l..Kq.X...*y...x1.u....... .....z.....c.(<.b...l.#....,z~..M.Y.]..Z....F..N./..[.#....Ol...f.k........U.rF)D....3..sK...`..W.....5.=.@#a....!./....>...g.(. ..9..>!.K..e..j..{x.0.^,...U9..ru.C......,..q^1.G..A.e.F[...".1..*...^...L..#:,7...:.z.n...fI1.....l..E.q>......E...x n....H....t....5.....\...<.l....7}.`\..~_..#..Bz....i..[{.w.....a...c....E w?..6..l......x8..H....7.e.;.%.:.!.*Q....#..bT.......(....ka.......B..|.........1....t.r...fk....C.t`....@3.P..*t..nmD.....8$.bd..`D...5X.....H..L../1:..Ap...w.\...,..U..../"X......}X...a...G....N.X..<....MG....r..H....._@..Q2..T...Q.....].e.G./.v,.Z5ib..5........9 ............z..!...g
<<< skipped >>>
GET /clientscript/vbulletin_global.js?v=389 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT
ETag: W/"56fc9198-659e"
Content-Encoding: gzip
1faa.............<kw.F.......F.2.O.`..$`fv..c'.=.p.j.2 .I....t......-...&'c.~TWWW...u.........6......j...U.q.........S.g^x....V....}...Y..O[...i...2.E.Xga..V.]4m........./4.....9..y......-..Z.g...%4..,.'...5.y;..E...p.........O.............|........em....]|.\........<.V........D..9.......E8.QJ..l.(@.E.:.......k..6......R .fs$...aB'..........?.E.....Y.3b....o.]..s.'...$....SX......{.\..,.. ....x..%.?.`..#..%..kVI.<R<a.Q.:N.D .[...!.\.h....FX...kp..F..:."....v.E.....w.>....md. ._.....m...z.F4 ..t.........../?...Q...WAQ.....j..)-`..R.....$.....7. .q?..8..6..vO..?.qF.s?I.k..RV..g4.o..i..e..qBg.ne..._....2..dM;Eo...oc/^..,....57!.].I6F..#.1.......l|....3..=..V...q........Si.e.,~.......i..xE..6......I....o.....M._.Z....0S.@Avc..`0kz... ...G.q;o..*..C...u.H.$_`l.. .....2...N..q....c^.J_U".Z..i.#..^.._..).....X!..8......).p.b..)*.Os. .....P......_.." ..BMeh ......BJ.E.Q...Z.J..(a"e.2...IB.:.U....O.I...`.rN.>.......^...fM.QY...y.ri....f.$.0...._1.0........N.q2L....."cb...a-....2..O_}G..z...8>.NQ^.O.....o4.A..{*.{.....c>..RL9.|.3.1D....=k. .7..k.[...y}......L........aU.HY .T<.e96.y..Y...~..zgn.k4.......^.=.....bF.v ..].l:...?.438..x.^"..h._P|t...9...CoN7...X.... g..........<.".Q|...S..Y...k3)..TtP>.X0W.N.._......*....J..'Y...&....Ey...*.5f..ON.).Yn..o...hL...9.....9Bo......b-..V.........)*[.Hj >...f..s....9.w..p.D(Y(.`D:...g..#.>.......X.&.2l>...0..' `.-....^.~..7."....?M.T.....qm.P...~...........u.6...X..}.\..lL....pw.....0.l...s.$..@?e5.......F.......:r\4K..i6.. ..9..8..s0.`.U.
<<< skipped >>>
GET /clientscript/vbulletin_md5.js?v=389 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
;.C=x.._=#...E..........o.oG........F..0.a.a}X...f.....hX.....?..>d........}.!..v....@.P.....v...)..!~......Zu...E.......V.Y;?.\..'.].g....G.L..'..A=s...?..h.I..{.(?R8.......Uo..}...W..].5...;..e5k...Ry....^..0T.#.:O[Goe...~..).....z...}....O....>.o..EZ..&.ry5.7Q..??..AF..,.........C.....dir..=.A;.i../n..W...B......aX..e......J.U_=.."h..T.6yQ.......&./....n._..`.w....l.e.......b@....._.......o.x.....B.............?...............<..l.....-...].7..>~......ko.h..'. l.x].Q....-.~..[{...U...m..D......."l_..D.x.r*v...._..`........U...zjo....~_..x'.f.........-....bS.4...t$. .`...]{......1...}k.....v.....x..{....D{....l....53../.....-<..._.v...O..[...ZY.7&.;.Q1w............"..b....aC.{@..c...i......jH....!.N;..g...........d.\.?......9./...~..Z./?.oo'.[X....OV..)B..4...y.ZC{..D....,....R....>L.8...o6p.C.7..%..Z...w...!j..7.....?4EwXX.....0....
..
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=d88f945ee8f86b78537fbfe644b73f56a1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6b10ca5954-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /certs/ca.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: aia.startssl.com
HTTP/1.1 200 OK
Server: nginx/1.7.2
Content-Type: application/x-x509-ca-cert
Content-Length: 1997
Last-Modified: Fri, 18 Dec 2015 11:03:49 GMT
ETag: "5673e815-7cd"
Accept-Ranges: bytes
Date: Fri, 10 Feb 2017 15:41:36 GMT
Connection: keep-alive
0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0.."0...*.H.............0.............lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.......,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.........`.g:........r".................\R<...*s......`.z/...n.&0.....W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U........0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.startcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startcom.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.pdf0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at hXXp://cert.startcom.org/policy.pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[
<<< skipped >>>
GET /site_stats/js/t/a?url=altenen.com HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: xslt.alexa.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 3153
Connection: keep-alive
Date: Wed, 26 Oct 2016 15:41:31 GMT
Last-Modified: Sat, 11 Dec 2010 00:35:34 GMT
ETag: "f4022b30d2ad8a3755b6e53f31c63252"
x-amz-meta-s3fox-filesize: 3153
x-amz-meta-s3fox-modifiedtime: 1291757166000
Accept-Ranges: bytes
Server: AmazonS3
Age: 4865
X-Cache: Hit from cloudfront
Via: 1.1 c722429a8af7d9f02db581c7256a2bef.cloudfront.net (CloudFront)
X-Amz-Cf-Id: bqeDJQuhbICRtFFNrkOBZXEioTG509zu6NvAyIlPYNwsEInTm2oXKg==
function AlexaSiteStatsWidget(){. var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /=";. var jsUrlRegex = /http:\/\/xslt.alexa.com\/site_stats\/js\/(.)\/(.).*(?:[\?&]|&)url=([^\?&]*)/i;. var jsAmznIdRegex = /http:\/\/xslt.alexa.com\/site_stats\/js\/.*[\?&]amzn_id=([^\?&]*)/i;. var imageSrcPrefix = "http://xsltcache.alexa.com/site_stats/gif/";. var detailURLPrefix = "http://VVV.alexa.com/data/details/main";.. this.replaceScripts = function replaceScripts(){. var scriptElements = document.getElementsByTagName("script");. var thisScript = scriptElements[scriptElements.length - 1];. var scriptSource = thisScript.src;. if(scriptSource != null){. var urlMatched = scriptSource.match(jsUrlRegex);. var decodedURL = decodeURIComponent(urlMatched[3]);. if(urlMatched != null){. var associatedMatched = scriptSource.match(jsAmznIdRegex);. var base64EncodedURL = encode64(decodedURL);. var imageURL = imageSrcPrefix urlMatched[1] "/" urlMatched[2] "/" . base64EncodedURL "/s.gif";. var img = new Image();. var fullURL = getFullURL(decodedURL);. img.src = imageURL;. img.setAttribute('border', '0');. if(urlMatched[1] == "s"). img.alt = "Alexa Certified Traffic Ranking for " decodedURL;. else. img.alt = "Alexa Certi
<<< skipped >>>
GET /qoEf3sh.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:39 GMT
Content-Type: image/png
Content-Length: 26299
Connection: keep-alive
Set-Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.altenens.com; HttpOnly
CF-Cached-On: Tue, 07 Feb 2017 22:28:49 GMT
CF-RAY: 32f0aa40f29759fc-VIE
CF-Cache-Status: STALE
Expires: Fri, 10 Feb 2017 19:41:39 GMT
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
Server: cloudflare-nginx
.PNG........IHDR.......@.....}o......gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs...#...#.x.?v..e.IDATx...w.\e...g.e7....e.HH......A.)^..,..Q..k.z-..r...z.^..E...P:.!,.@H...l......y...df........u^[f..9.y...._........$..@30..e....d.......z...3?k........@....e~..v.......t....,...j.O.2.....(..y....I..,..6.A....:j.t9.".^s..6#rY...^.:..u..1.D.1.D..<j.q$.q,..#.....&$Y...Hb.........@.....K2.CL(..!..........,E.....D.y..J....c...3.V.?&..#..pT.Raf.......#.i.@F3\D0....C.....^...&|..Ã$2../'#).X`.2.....B........$...\B..<AC.C"5..r.p>p*0.p.?..4..<...o............0$.....H.,d\m...E...R..n.nC....X*..P*..D..q..8..4-...Q.AD&..7!......J!&.2."...t.b.eH..U..a.. . ....b[K...J.`..$.....H.W............V.....1.....L.^...yl..}mc.....Y..........D..d.p.".....#\..$.k.w(..Ki..J...d6.Z.2..F..Y.......k.Z..K......2.......\........q..~.r.b.P.....X.h'....A.x1..4R.......\.bB..K.....x;Rub....w..F.,qRb....O.2.....!;I....cD.H.pQ.[.*......k.N.iLFu\.F2............5..z.::6T{..BL(#.Ro.G.....M5..D.L...Y?....3=.O.z..i.I...;=.....o...Y...A=.)..6....f.{.9.....T....w rg.E..".X...,7..H....."..b.I...ZVr ....c'...4.>.Y...#..t..i.j&7...:N..h.Hb..{.9.X?..V...&..:s.........X.*.m@e1w....AFV2...J.X........8L..H!.c/".-ham#C.[...Ax.....%Y. .....NE5ef..wIT.j....#.?..4R.:...9.I.s...H.2~..J...4.o.>....5E....EF...v..(yo3.....t..OC......)LC.1...1.I.^Q.Bb.\.2.G.qW .x.I.[....<r!&..,..'P...j_WH..F..&<..v.5hg.Hc..L.nXK..C..3.Q.E...".hEd.b.W..O#r\..Q...Ad...6&.#.bBa...t...L<6.....B.ZT..a.F..Nd`....
<<< skipped >>>
GET /register HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283
HTTP/1.1 522 Origin Connection Time-out
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Frame-Options: SAMEORIGIN
Server: cloudflare-nginx
CF-RAY: 32f0aad1818c59fc-VIE
1734..<!DOCTYPE html>.<!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->.<!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->.<!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->.<!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]-->.<head>.<meta http-equiv="refresh" content="0">..<meta http-equiv="set-cookie" content="cf_use_ob=80; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">..<meta http-equiv="set-cookie" content="cf_ob_info=522:32f0aad1818c59fc:VIE; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">...<title>VVV.altenens.com | 522: Connection timed out</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />.<!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>.<!--[if lte IE 9]><script type="text/javascript"
<<< skipped >>>
GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: text/css
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-6eeb"
Server: cloudflare-nginx
CF-RAY: 32f0ab8da2cb59fc-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
1313.............=k.....E..`...GO...\.r.!....|....D...DE.n.....>$.)...,n.XX|...bU.......?..^.....w......wP...h{.}/...M.......... xj.l.7...Y^...}....d\....jA..q..!.....g...a\......n%t.v.hw_.O..<...w .v_>.r....>..}..;.W|8L........vM..[.}9~$..HK.K..E>.l_...~..V.%..K...s.m....,y.....,Qy..c_...Y.qg.fV......uB..2.......y..7.6...sq;..?.9.gg.m..{.7po.6.mU...s.....p...3.. ]Bg!.... .{/VRx...N~.3.|...!.7..w..u...Wm.....;.2y. .7.2.Xif.....6..a......7rC....r[.r.e/?...\....=..I8..5d.z...Tw.Wr..:(c.!.v....\~.....T.k..y.......Nz.....2........x4m...}#o...J..d...................\Y.tlp_.M])...O.....P).N.....x..L.B.[..Yn.U/5T@.$...3..X^..]..#....{dQjA).oa.1.-A!...@..5...M.....{..,A.]i....^..N..N&{GDPn9)..(Sd....2...R....].T.<G.q.<.q..f..3e...lP.......A.......a..@...p..^ 1e..A...n.ZX.........Af..N..dJ...n..(.F.c.q.Q[....Zji....g..............l.t.e-..^.d..2y.5N. h..l.:..&...Q.d..`..>x....Q%..|...#.}.........$.&....j5n.....t..2.b.S.C......T.7.U9<....O..p.........q....*w...../.x.DCW.. P..G......L...,t.U.O......c2..D.u....dd.<.._...u~.j...'...lK.q..D.f....8\...q<....;.h...(.ha...Q.Y.e..g..U......*........CK.k...4p..#........R..0.>..lR..M..)... =.l.@i...W....k8.....s.D"@....g.....~_.....~....IZ.E..$b..D`.Q..BZ....f.2.....9.^.5.V..r.K.*.}...`yw.l`....#a...;.......>..Q.M.m...... .p..0.;5...g....].....l.i}v..E0....-..t....G..m...n..h=.wjW.Y9./..M^.g..f~...t.L.N..*W.U....6*.N..av...d......w*..g......|..:..-H.d...i;...LZ\..W....f..]M.......]A.i...M).e>....3Vq./.V..k.9.1.>n63.........}..N.5J....M..
<<< skipped >>>
GET /cdn-cgi/scripts/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/javascript
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-17bdc"
Server: cloudflare-nginx
CF-RAY: 32f0ab8de30759fc-VIE
Expires: Sun, 12 Feb 2017 15:42:17 GMT
Cache-Control: public, max-age=172800
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
500a..............i..F...}~E....b.E.v.1.,.,.m....n..R....Q$...Z.....8'.$@Pr..{..7.*bI....9.OG..........t.l.....b..~Q.......h..o......m... ..^..(.-bH.q..G...E\;.....L/ver...{..T<...>..[..I...DQ....hF.. .....MB.uU._....uU.....W..6...._..ER._....._./...D}[.........s[$"...8#]].} ..z..h..w...Y...Uy*X<=@w.....,b^......aM.,..E"..Oi........|SWy.....k~.....*.....-$.1G..C....j..D1M.i^.5.9..]..........b..b..7..'........arIo.........".YN....i].}...K~..9..dVL.UY..{.QN..G..8..m\.._.....t...EV......U....m....o...=9.L..)..~.....fW<..!...T.........F.M..M'K.......2.I.V.<By;}..J.}.s.... m-............>.7X...Hw|?...3..........hl.s....0..9R......XL.~.}..Se8...A.W..\.....#...&.........F..l....e..L_..._...FWq........ ."9.J3XMs:.r>..=.U..S...=v[<..GZL.C-...JS.Vy..N...*hJ3f:1.....H.lN...n.5...).cQYn./.]3s]..e...*.....m6k.b......H.x.{<..f....er..'.......(O=..<.)...Wr....p.....L.O6b,.....@.?ly^.~.b(.VS~........./b.9M.w..%'..Q..s;/|.x.P<.}.].....we.\.Tm0IL...........I.....{....^O x....Vb........3.8.....O.....p.t.p.$.u\.....G.....w.#.1VLa.1..5>....4..pxs.....:.g..g.O..._|w..U..,RHk.*Ow...?..&{^......^D.. 6.l_...;9..Y...`~q.r....kk..|..A..e0...i..(.......B...I[R].........6r.....;.zc...}...?...S.-...:^{f....P..../.....t...ED.n.S[.{.X.4V.#....;c<.c..Ov..Fk*..A.^.....i_.?.l[F|...o.B#...:..|.E.u=>.."~.W...fqD..T......A b..[.1....B.Sgw.8.......D|.w....#g.......u.My............4a3....\.0V1.j{_.W.".{l.Z..gB.....IT..9..A\......=...BO.o....`...*a{..c#z$.E.FM...V^.qx..l.$..SL..........?...)'..G...e....&...R.k
<<< skipped >>>
GET /cdn-cgi/styles/fonts/opensans-400.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/vnd.ms-fontobject
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-4b10"
Server: cloudflare-nginx
CF-RAY: 32f0ab8ee3c759fc-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
4980...............P.@..9....>...............<....A.[....H.....wo...........V...... ...... .""<......2...d...O `....d...)..@.c....../..P.x.l.n..@.`.p.x...L....`.....,.^............G......`.p.8..o............A...@...m.;w.4..@.f$}....JV.c.`8.S}..q?.......~i.i..>....!V.7SMV\.O..s.|..p...M.M._.L;. i...Y.|2.2./E[ri].;.^{....&.'b...b.].%....YS~...U....E.}*0"%sZB..0t.:.ZI......h.....^.....^..%R........5..53...%...a...y..P}.}T..'.3.z..X.i:B....{..i.]2K.h.a.NS.n\..@.@A.7........'...a-..].....2[e...,..].`.....vNB.....(,..S.g[..\4_...[....M..f.Ij.Q.....!...G..P.....v..bQ.<.i..U..t.......P!..hP@..E4.$ ..p..D..8...&......!a.8{xk..D-........v.N.........3.!b...31N.....L..S...v.0.p.NR6...D...............7i8o.6....@......V.-)J.h....v.#.O.. ......p4...L/..].....0...!.~..c..F..D-,F..c..:..F..n#..;...Q4..;..|:M.f.-..j..T...s. {W1..'..j>b......,._....b.. T....#_4.....V.=i.i.w%n......op..EfDeQ.^.f...w..t...*.....P.Xuu. t.u...6......... .u|p&... ..]....s..B...}...6....q..#`.....=&..I!G....m..h.ZC.&m...;.....%Y..-.I....Ws]@.....rlmos\s..AN1t..`. ..:3...RCT6lT,....6....Z1.0..q.F..).&2.N0.9......./....*....T...N.<....Y.9.s.\dM;...2..{.&.B...-.....V..B.mBN....x.......d...).u........._....p..j....p"...j.e.fcW.p"..`~.......7IS@l...q..$........;!...d._`..h....(Z....f.$...:tG..Moh.3.&%4....<....>..iq.i...t.{!..A.#'./.l....@.......HZ=..<...M.. ......-....W.:.G...$...=$eZ..f.T...w..(........?..S>......Bj..T..;u..^.8QLV{.L0..|.p...........|.q.n....$..........r..EKS.......w8.u>.(......D...!..f.u..M1.T........%
<<< skipped >>>
GET /cdn-cgi/styles/fonts/opensans-600.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/vnd.ms-fontobject
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-4b8b"
Server: cloudflare-nginx
CF-RAY: 32f0ab8f742259fc-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
4b6f..............SX%...7.......m7....m..lL.....&.....:....97..Y.f...W..2.......... TD.0..........8......kL..`.........`.~f...-@.......(...K. ....-..........6..........|...K.'........O......?{..;......x..............?..v...o.K ...g.,n.bM..A.C..?...' G..I..>.......].t.&B.....j;...F....nX....B.......v..Q...(.7....[..u>.eb.......Y.^...u.@0?.i..9..?.|]...[......9..g...2..l..../!.T......=Cjn..F..S..T....._..^0s.."..I ......x........j...b.X...'....O 8...<....]......]...b*...Zi2[7.....aZ.........?d.jN$.m&...-3.....{..\..R......@...M.u.lO.\....eH.D.r..X.-...(. ..*...P.....A..d...Ak.=4..M.mo....'q...@J;.`b.]N..."C....%...2?'..lDom..z...2Lk..3@.4........Q....Z. .*@B...g9i=K.&.......I.B.NI..@.A..`;.......GD.T..x..........4r..YR...p'0...lq*...k..(..W.j.wR.....&'.G..FJ..p.*e0.5..._.......o...KB.f%......... ..]..4.......`.........`X:ftn..@voR.2.&4.D.Tr......\...J..?7.,Q.*4.@..%..G..V.x.._....D.l.5f........X.......g...Q.....Lj......5.v...."..... ..K..z.W...9?....L}...)aHoZ1.B.F......[f.4.....L.IZW..[... j.N....1.@JO.R<b_E..\.h..K..^j.....8#...5.......zzO...k....Ki0....\.5.!....=....;`t.......`......Gi.n.Dd.....@0...I.Q~*..#.....l.....Q.W.'.)f`q...O.7..1...M@]..n^...$|..,."...4.E....!..f*d@........e.&w......(n...)n...mgq..C.m&.L.k...?.7Y..L...W...a..?...A....s0.u................m.B.'......U{.:t..(f.>a}`.....<U&.$......T..?..T....s_......j....G`.Q.>.>...5...u{7..S..\.c(fAB..S#.../..._..wJ..".....I..Q.Om..|.Nw. .Q.KT.SQ.3..u.:.2A.....e....=.....v[......-... ...y......n..fY,..mO.V.!..._..........M../5....6
<<< skipped >>>
GET /cdn-cgi/styles/fonts/opensans-400i.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/vnd.ms-fontobject
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-52dc"
Server: cloudflare-nginx
CF-RAY: 32f0ab90148c59fc-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
400a............l.UX...dC.nA.....ww..w.b......;..ww .?..K..~..vw..........u.. ...... .22"....! $#.. .../ `..5......!...w.............-..@...X............X.\...k..@.0.......G......8.<.n..@..Y...>. ....?.......~..(...o.g............Z}Q/v.L~....6......-|*...@~\MA..blu.EV..{.Fc.}.a.....Y7....3(zk.5.Ki.....o2...k.Y..g.A...u[.p%.Y..%...K..x...T...DTM.96j....b.P[`.:..@.K.u...r..R2i...h..Q4.c.kfg].&E.X......K.r&..8X..........-\(.<..?O........!.<.~....x...A..0......h.A.k....hI..'.f....JKWmD......THkHdF5$....sI../..........a..0.!_.f.q.)..B.?...=....g...z......Q.-..0.L....v.R.h.....?...*.%*.di..Z..s........F.{...!5.M.|[...!4 ..:.ö../.)f........9.2B............M.y.g...<%...DF."38..y `<...7.;..yo...S"..c=.........d.I.cY..<......K......[......r.o....H.XB...qSn.s..........!....?@.a....y......D.$.o.d...b..&..Q...k.f...3tda-......%.....em9.J......-&..:..r%.......s.%.....M|....I.!/<'.|=.k.i:Op6W..e.O..x...W...n...%yV.nl..._......U...'~D.....**...PV'*)wL.L.jd..Bh...$...H..':#../rX.*.... ..'...Q..*E...p!2..&..e8..p,..?..`Es|.X........a`..[...7E.....|.A].'xs..E~..5..;9nu/....... {.........;L.=......\.g.o.M.\..Jz.^$i'V....4.........q.I#=a...F..',i...D~.....)..u....f&}..F.T.;?."..g..1)%<.W=.m;....K..........T.1%.G..[I......aBD...%/.P..@.8Z...,".....{..Y.9K#..h5..m....W.o.9.......0.`..0C....o|`';.!z...........5|8../m.Tn. .bQ.X...n..A..........E..............=......)...J...\.t.p...F,.3...23#|...*...*......G..I....:... -....Yd(P......T.a..h.,.R/.!.....).t...^..f'../..._....C..0.L..{....i......b.o.PK..$...p
<<< skipped >>>
GET /register HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 522 Origin Connection Time-out
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
X-Frame-Options: SAMEORIGIN
Server: cloudflare-nginx
CF-RAY: 32f0ab90c51159fc-VIE
1691..<!DOCTYPE html>.<!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->.<!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->.<!--[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->.<!--[if gt IE 8]><!--> <html class="no-js" lang="en-US"> <!--<![endif]-->.<head>...<meta http-equiv="set-cookie" content="cf_use_ob=0; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">...<title>VVV.altenens.com | 522: Connection timed out</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />.<!--[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media="screen,projection" /><![endif]-->.<style type="text/css">body{margin:0;padding:0}</style>.<!--[if lte IE 9]><script type="text/javascript" src="/cdn-cgi/scripts/jquery.min.js"></script><![endif]-->.<!--[if gte IE 10]><!--><script type="text/javascript" src="/cdn-cgi/scripts/zepto.min
<<< skipped >>>
GET /cdn-cgi/styles/cf.errors.ie.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-d65"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:17 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-d65"
Server: cloudflare-nginx
CF-RAY: 32f0ab92761f59fc-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/scripts/cf.common.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-1138"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-1138"
Server: cloudflare-nginx
CF-RAY: 32f0ab92a63859fc-VIE
Expires: Sun, 12 Feb 2017 15:42:18 GMT
Cache-Control: public, max-age=172800
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/styles/fonts/opensans-400.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-4b10"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-4b10"
Server: cloudflare-nginx
CF-RAY: 32f0ab93067d59fc-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/styles/fonts/opensans-600.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-4b8b"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-4b8b"
Server: cloudflare-nginx
CF-RAY: 32f0ab9376b559fc-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/styles/fonts/opensans-300i.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-53af"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-53af"
Server: cloudflare-nginx
CF-RAY: 32f0ab93c6e059fc-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/images/error_icons.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: "589b19f3-4177"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-4177"
Server: cloudflare-nginx
CF-RAY: 32f0ab94070459fc-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
HTTP/1.1 304 Not Modified..Date: Fri, 10 Feb 2017 15:42:18 GMT..Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT..Connection: keep-alive..ETag: "589b19f3-4177"..Server: cloudflare-nginx..CF-RAY: 32f0ab94070459fc-VIE..Expires: Fri, 10 Feb 2017 17:42:18 GMT..Cache-Control: public, max-age=7200..X-Frame-Options: SAMEORIGIN..
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca4.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:36 GMT
Server: Apache
Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT
Expires: Tue, 14 Feb 2017 12:30:43 GMT
ETag: CD4E411028F5966AE35940E7A80D2D957332E76F
Cache-Control: max-age=333546,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp29
Content-Length: 312
Connection: close
Content-Type: application/ocsp-response
0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..20170207123043Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y..[%.i..&Uf.9...T.....20170207123043Z....20170214123043Z0...*.H.=....g.0d.0...`..,3l.s.zT.M...h..&.F........C^..jdu..e..\.G.0H.dD$nk..Z.E.!.b.!.O.2.Y.<......]8M.c.{r.d..-.....
GET / HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Set-Cookie: BHC=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT
X-FireWall-Protection: True
Content-Encoding: gzip
1b1.............R...0... .:,...N),]Y)....tais(...{...%W..,%..Q.'..[.0....i..t..y.Q5.....k..U.........Z.c..,../........."...`.h...*.....?x..k.G.u.Vu8...f.....hX.j....%N...D..6.#w1x.6........CGX^..J...2`R.nz.1......M.....\.P.......R0.v.x..P.).TGmy..)j...t...$p~..aX...t6.......T....g.._.....0.(...f.........y.0w....!...V...h.O..5...c~NL)_.....<u.A.We9.... ...\.&..`..H..........<h.kI;....Iz.....KvI.^).U../z......g...%.*.)..}..]._.....d......0......
GET /banhammer/pid HTTP/1.1
Accept: */*
Accept-Language: en-us
Referer: hXXp://VVV.altenen.com/
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: application/octet-stream
Transfer-Encoding: chunked
Connection: keep-alive
2e..JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054...0..HTTP/1.1 200 OK..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:45 GMT..Content-Type: application/octet-stream..Transfer-Encoding: chunked..Connection: keep-alive..2e..JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054...0......
GET / HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: BHC=JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054_
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: text/html; charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: BHC=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT
X-Powered-By: PHP/5.6.19
Set-Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; path=/; HttpOnly
Set-Cookie: bblastvisit=1486741283; expires=Sat, 10-Feb-2018 15:41:23 GMT; Max-Age=31536000; path=/
Set-Cookie: bblastactivity=0; expires=Sat, 10-Feb-2018 15:41:23 GMT; Max-Age=31536000; path=/
Cache-Control: private
Pragma: private
X-UA-Compatible: IE=7
Content-Encoding: gzip
ebf.............].w.6.......e..vk.z.......$.7.o....E..)..%.$.G........)J~....s...)`0...3.....G...?...Q6.....oN..Ss.....{t~$........7.y.M.0.......;G8.,......e..]...{..."XM..>.2.f..|g.......8....8....Y..~.t.(K..y.a..&.@...h.d..x...$q/.RG..I.L..3....\...(./.....z-.}.^t.CY.v~=...Yp........$..........N.i.....I.xY.<M../fQ.d.D.....Y......2N|.k/.....^...u....F.#..%H...0......c/....%..._.&.0.....$I..8.R..=....M...$.^..d.N...p./~...pJ.m.....8D.....[.D..8....l.(.:..wA..t7..$. .=F...:.D..w.&m?Mi .<~.....|{.x.K...^/..Y..=y.b.A. .. .../z...o..O.........a..&~..G1.<m....].~6..........0...]1.}?.....s.J5.x.7...e..o$I..|..<.Vv..K.....Y?.........Y,."N0.DS..L$.O.......0.co2...ZpMP6..e.E"...(*_......2....i..z...M3/..):......`@.....DL.. J...PaS!y..<.:..^.1.8.$.c.0..&.p...A~.T...CD..&}.%..`...eA...}{.8..Y2..~.....X.....@....x.C.y.q>.r../y.].8...........P..0...8.....0U...aBbj.G....?...>...../....q."...:..G.d....h0H5.....h.y..`5...$0U....5..?w0......q0....3...k......sM...$....q..:..M ..i`.....zi.`..J........6.O.....yF..`...3#.%...@..A..L.........K5./.O.UG..g......v.5<.Q......[c#.... ......H....O.Smb....X.x......7..O..w.....Y.j.../L..._.cP...40{..kC.q...4..0.P.A...%....K...?.D.h...)hM...8k...`.....Q....Q.r.B..._..k..5]..D.Z....;.z.~... L..G. .\..L..=.5..s-....... .....nK.\...t. ..*C......a*...EL.a.....?c..N ....(..X9....S...W.(.............xY.WM<CQ...*...-.!.........1.......~..{qO.....}.3.....8?.1.$jB...n[..>.........9........\.p........U7=]U...s.Xm`%?..A<.V.k.W. ...=...$(..D....X.2...\|..@..V7..@.!...
<<< skipped >>>
GET /clientscript/vbulletin_important.css?v=389 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT
ETag: W/"56fc9198-68c"
Content-Encoding: gzip
26d.............TMO.0.=._1..R..-*..q.R.J|Hm..TBN2i.u..q.V....r.I)]..V......{~..;......l.....M......h..S.........h..........~..u....^.....J.'0...WB.....`.z....5Ky.....[.T.B..1/..ai0..Q...JC...'<b.@....h}..O....F.......8...h.........>........WU.-..cz..`.....G(..R..wV-.:o..|..;p....6.*.\.....N.t./.A.........yu..B.6...P:...V.S.=I.X.N.4n.........K.%.la.,Q..P.L...d<..6.R..-......c.4.d..E..2.P..).. t..7......q...4...2...T..P.:.4{.6".....%t...P....VUsR''.J.v..^8....`..j(..[.]...(.LJ_K^...$tJrQZf.J....v...s.e^....{."..aN*:...x.2......o<{_...~.....@..U .........UIr;....,..N`..p.4....v~5...4...pj'.1..G..m.......k`...../..).........0......
GET /clientscript/vbulletin_menu.js?v=389 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT
ETag: W/"56fc9198-24d3"
Content-Encoding: gzip
a58...............r.H.}......H.....4.@.... l....%....F..%.........SB.{.......2.......Y~?|.f...}.....T.f..C.H...................,.L....~......V.^.p.....6.|Ss.P....v.S.lp`...K.js.bm.m..2m....$e.....4@y...A.-%.....EL.......8.e...7....6.....j.W..v..b..s5...p.X|vrr{{knf.^.OW..u.$$>.Rl..*,Q=.^??...|S(.......1.m. ..........K.`...#.....~..:v/.(.q....4j..Gn.p...}.\.{...^.b....Mm.SI...jN.x[....M;...&a3N(.l.c..1.........X>X'X...E~3..L.... .Q..dd..B.^....$4.9.."&..it#.R`y.....x.6.?:.....1.9. s.A.kp.?MA.d..:...I...)..>....A...i.....G. ...z.E'|..:P......~2e.S....`.N"..}T.K.T$n.........1....Xt#..l.b.. ..b.3q7q....N.1!x0..O/.S....m...~A.}~.d.3.Fx/....[....48PW.cb.....=...Q......k.r..J........4..(.D...M.....3.U*UY.......r$..0W...|...c./]:.7..^...... '. n).......{.q..V3<(y. ....E.....X..Tl.!..X.C............Z`y..}..='I..K.....M.y.w.vl4..6.4....Q..w.~."P..s...........;..O.n......k..3....S|..Qp.....y1h/...".50.C....0e@10.=Wl.Vf4. ......b.!x.B..rP.........rr...f....%n..NP..2..NR..1%.DvW..!....vaCcnri..J`W.[.HV.b1......8.=`."p6../.6...%.Rb.R..<._...@>..E$..6..V.``.W...B.;..LUw..j....;...... U.................(.w._..Wa...t..<d....\{&....`Tb........x..8.....=.{>a[({....v...D....6:..eY=.....@....].W5..p\....P...WoP7.........q.`Kk...c..B v.5m..P.../........?....tqc....*...Mc..*a..w:.3.F........:R....|......._. ...~U..fOC.f.....q.=..Rn.de...~....].....kD_.....E....C.....R....@9i.xQ.0.P.%.e.....k...l..Q......"..C..&.....-........6>.@...@.L..n.....\AY.kQ.S.[.!7.....N..o.......7.[..9...O...=9....(....{..)k._.p....
<<< skipped >>>
GET /images/head1.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 25780
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT
ETag: "506e8106-64b4"
Accept-Ranges: bytes
GIF89a...................w...35.PQnAB................%(~-/8..K()..................|.....e...lp.........t.....l.....d..\........T..L.... x..D..h..,$%<..X..4..,..J..$..8........(................,..............................4D4.......................(.....H........................(%.....................)..<............................. ....m.....X.........O......X9...........v....l:..|.:".....l.H#..b...'.H..k.(...O..U.........|....>..0........?.$.....i..|...8.,...U04..X..9/-....#.<...yw....'.D.....T.....L.....|..t..l..d..\...'...............................'......... ..:24...FD..............................|..t..l..d..\..T..L.....D...........<...........4...........,..|..t..l..$..d..\..T.....L.....D..<......*),..W...C@$......>=I.....a/....H44.ccWGG...H??...dYY............!.......,.............aK...9....L...C...>L(.....-ZT...C....#...A.2".[.N.C..GB..1.K..I....`..#}....... u...r!C.7..|:.bS.OaF,x..6h........w...k......L..'........J..G....H(..`.:I.....ch.L..I....A.7v6..5n..c.&......j....T.U'b...'hh....<......QcV........(p4h.T ..n80.....,i.45.....Z...t..x..^.gfr..-....cj.KC.|#q^.7L..^{..ZL..._c`.u^e.=..A.(c./o...7.5..h......agb`M!..m. c.x.qs.W....t..4.m.0.N3.-..l"=w.WC.E.U....F....7&A..H.5..z..D.4....q.4C.F..._.D..../.H..(......3.2.R.\:7.$ZmmZ.SP.6..g..g’`..&GR..A..E.JQ.f.k1..M....RjXb.XhT...7.$.3.qo...6h...@..T.F.5.*f...XF.!F..>.....J......U{..e#8/HvC.:.....@..C.8s.A0.H%AM...u.>...*.f...*.U.^...z.p..1..*./.8...h.Z.^Te.......u...]..qC.N0..U.....TXn......&C..P../.@.//@g.J.Y.lz....S.*
<<< skipped >>>
GET /images/bluefox/misc/navbits_finallink_ltr.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 576
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT
ETag: "506e8108-240"
Accept-Ranges: bytes
GIF89a................~*#....)#|'"~)#}(#.,'.($.*$|*#|)#.,(.,(~)$} $. &. &.)%. &.,'{/)}/*r1(q3)p2).74r2*s4,.IA_@/XG3YH4TJ5.yi.......*(.*(.,,. (.-,. (.0/./...-.*'.53.10.0/.... ). ).--.,*.33.-,./,.11..,.//.0,~0 .10.0,.2/y5/v4-p4 s5-.PMl?3bG6^K8UN:..|HK=.......00.53.54.53.11.--{61MN>...EFBDDD............................................................................................................!.....[.,........@...[........[...?..&...$.8E..[.,3S1.TR/."..KC7..WL...N .....!Z... 4M.PY9.5...=......>I......#..*(.'.....[.)Q-.H-2U0F.[@.....O.6G.B...\P....;..S.C....-T.b...k...;....
GET /jpg/newofurmatn.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 1507947
Connection: keep-alive
Last-Modified: Thu, 09 Feb 2017 19:56:56 GMT
ETag: "589cc988-17026b"
Accept-Ranges: bytes
GIF89a..z..........999...CCC...nnoRRRtttMLM......222........................ddd^^^.........X..s........&&&...............hhh.....................WWW}|};.....# 2.......................H..............................................................................................................922......YWX...LBC.........|}....QLM...*(*vpq...* qqqohi=;=...eee...wwxzz{c_a......s........iii...ljk...`aa...rrrQQQ...HHHllm......rsu}zzVRTzxxbcd...B@A.........PPPTTT.........YYYXXX......fgh866...QRRWTV0,-UVW............gfh...fefZZ\..................cbb...JJJ>>>............FFF...~~~...'""...@@@.........444......666.z|............###!!!, ,.........%..ccc.......................................UUU..................fffkkk.........[[[............ ....................................!..NETSCAPE2.0.....!.......,......z........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..U ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.z4...c..M..]..s.....o.....N..q... _.......K.N..u...k...{.......O.5....._..<.....7.~..... ........._...h.z......R.`..F(ao.Nh....Va..v..d.~(..$..b.(...Z'.."k3. ../..b...3...\...3..#....cl...B.=J...@....1..T.@6...G..$..b.$.V....Z*Ee..q...<...u?B.f.1..e.y.Y&R3@...[....QV..Ou.y..T.y...Vy.R_....2^j..Q....}z:T...Z.w_B...9...........E.'.."...K&...T..#.L..j...Z).k..kR..Jhjn^..P..z&.6..(...J%.2...VX*.).N.Z%P.......KT.K.[.......Ku.'.aA./K...$.7..o.3..p..^[T....Z..M....Z..K.;.../...Ob.......i...|.....s..v*....$m.;
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.trust-provider.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Server: Apache
Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT
Expires: Tue, 14 Feb 2017 12:30:43 GMT
ETag: 5907E30F032C051F75CAAEB6ABD5F2B380B5ACAC
Cache-Control: max-age=333552,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp29
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...20170207123043Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T...CR.?..........DN....20170207123043Z....20170214123043Z0...*.H...............,.....y...{.J....<ox.*{.`rU....=.1.v]'..Tq.V.....O.2..!....s..!#^..DGC..6.Xo..h...}...>..q...*Z..[[....^r%.1......p~.K...}..<.....H..X"Z..A..&.....x....&..O..uN....4"..l...i.W..? ~.....A?..]..ZX.h.........7..$......tv.N&."_].b".....Qr...........'I.{..m@U..
GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca4.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:41 GMT
Server: Apache
Last-Modified: Wed, 08 Feb 2017 18:34:57 GMT
Expires: Wed, 15 Feb 2017 18:34:57 GMT
ETag: 35B3F2D38FB07E0E4D1650824751696EF02E7821
Cache-Control: max-age=441795,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp29
Content-Length: 281
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0.....0..0......@.ag...qO...,o.. v=...20170208183457Z0t0r0J0... ..........3.....>v..1.9S......@.ag...qO...,o.. v=..........1....X.K......20170208183457Z....20170215183457Z0...*.H.=....I.0F.!..JB\.1...3....0k.rw.v.......&.7..!..dW..:..S..#.I..I.]".A..a...K.....
GET /clientscript/yui/connection/connection-min.js?v=389 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT
ETag: W/"56fc9198-2d54"
Content-Encoding: gzip
eda...............r.F.}.B....0.=.f#..@H....f<.IiU.,Z....._J.....4.9......O..s.t.........~IZ.\o.w......e..o....r.....V.3.>...E.nE.....Zy...E...~.Z.|..nI..wx....%k...t[3...9...r.<.w.8..$..............M&fN...'q........Ut.N..0.M.e8O.,Y........52..W.>...G..3.f.-=....p.......U..~.a.6..m..~...u..1.#i..M3._..6..A.O......$]..i..90..Z...f...n...D.>.........i....Dy.d~...8#....%...*..l.g....B"Y.ca........=......Qd..U.O|..:."...Wx...M....6......~..@...?.L....H..."..1......P..v.f..@...c.T.7.BStj....M}...@...d.S......@F.[_.<.i..w..cr....`..v...p..@......}?..n.i4..m.........]NH.#...\.<.q.......3........,...|.2.'.u..8...`z....8.@W..v.[)&y...bX[......5.......^..[....$ 6.!..tc.H"L._....(..s.eo...a....<}....Kr..........y.....o..(.T...<.gV....g..H..`.@T..@.o(.WN4.H...Jp...9...r..$..H...)...A0.p(-.P.........v..z..@...o.2....7.8[.....[.q.s....{ u...j....P.')..$.m...cm1(hm.].D....{.;].UO.}....*.oq.].U .E......G...;..v...8$.@.).^.o?O.O0.5...\F.......X$}.86U.j...5.7sp6=. ....B../5O.....s.Z.I..!z......p.......w~.mw...5...2.... ...a.G..F8........@b.b.S..._....a...X..`....@.\..oo.V.........'..N../%S....I9!..:.}J..=.s!.EbF..qq*<[.N...).k..FO...N....6h..&.6.......^......a.Pa|l).z.y=A?UT.Ef.g.t...."....K....&:L..v8E....C....k%~..7H...O.v......ck.......BC.........Cm.wj.AH..]......c;..e.....v7..v..8_...C..b...#.4. .S..,.#.............IM..........X..b,}_u."}....Bwqp.kH.h.h.w.........1&.rI...~...r^U................L.VQ.......Rk...\..G...Z.q../0......V..2......."..A.W|{Z..6.v.(...\.)....<eF.x.p....F...Wk....a.m...
<<< skipped >>>
GET /images/bluefox/misc/close.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 428
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT
ETag: "506e8108-1ac"
Accept-Ranges: bytes
GIF89a.....?.....j9......./..<..KJ.zI......zyy....],....PP.......S".6...S.mml]]hff.......N.....nn.SS..........,..D..M1....&.. ...........E..>&.X&.;;.*".K..Q../..``....77..j...qdd.80....?..D.....J..mm......!.....?.,..............f...?.K..!{...sD.V0. !..&"..B..$..G..L.$Y .r.,....z3P...(...\?.,.... .....H#.*. )....NB>.". ..3..Is.......G?.....<!!.%;M.....0.99..../.)%..0!.(1j.:. .... ...8.%.'.....6.....'..G....:,@.`....Fh.`.G..;....
GET /images/head2.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 30760
Connection: keep-alive
Last-Modified: Mon, 29 Sep 2014 11:30:44 GMT
ETag: "542942e4-7828"
Accept-Ranges: bytes
GIF89a"....................)..{..........dY....C;...vupw...........7..f..F...#..JCV..'...........................pn....~w.......... %.ZS......*))....jd.zs. ..kd....|y.......sl....QK.un.'#.94....72..........HB...._V.............0*....3,....C=..../ .UO.....................................HGc))............. .gBA.`[. ..(/......................# ......................!....d.....|}{..................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B65E0B12B647E411A4ECB674E47D8C8B" xmpMM:DocumentID="xmp.did:E2D2E1FE47C211E4AE82A20A9E772400" xmpMM:InstanceID="xmp.iid:E2D2E1FD47C211E4AE82A20A9E772400" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B65E0B12B647E411A4ECB674E47D8C8B" stRef:documentID="xmp.did:B65E0B12B647E411A4ECB674E47D8C8B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
<<< skipped >>>
GET /jpg/GX1OvJc.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 302184
Connection: keep-alive
Last-Modified: Sat, 27 Aug 2016 06:07:26 GMT
ETag: "57c12e1e-49c68"
Accept-Ranges: bytes
GIF89a..x.................K...fRu..YV.3J.........[..s......a,..I....rO..U....)0.l................u.....Klr1Mi...P..l...EiVWX ARvvw......bdew..K.............0...445.....o....J'....O6ACD.{.$%%..6......CWp[.uh..h.....0'.RD.[.u.y.............V.....9i..n..........dT..........wi,.....-S..V...EOl...!....sd.R..... ....Vy....o.u,6.......<..........T....-.."57LF#*........$..............g.>...S..u........vpIQ..............x..cX).....Zp....s.....:0ajDg]..Q.3)...~HTM..'....)....cc...*{.l..s.....FRW.......(::.]f.#.....:...e...lAEHV......D..4.OK.........4;kkm...,..ew|c.....q...y....3Y|../.=3r.7a6.;4.xVl.....E....Ei..A.{.}zc..............@......X{nWCS.............dp..... M..;#9.19a..8i_.\.1).\WA..!JJJ;VO......................................................;......!!=|..@....n...`.......!..NETSCAPE2.0.....!.......,......x........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...Y'....0R.b.4.h.P3....<.w^.@.).M9.i..#....LN.d.PFY..RVi.}T^........`..e.d....f...ph.........t.&g.x....z...c|.)....J....eh..6....F*.m.Vji.^^...rA......i................I.......J.................z.K..s....j*...a:...ZJK..QZ...Hj...Az...:.K..1....*....I....n.K.................b.K..K.....)....9....IL...Y....i....y.....L...................L...................M......
<<< skipped >>>
GET /jpg/gdtmvRl.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:46 GMT
Content-Type: image/gif
Content-Length: 127641
Connection: keep-alive
Last-Modified: Sat, 27 Aug 2016 06:06:42 GMT
ETag: "57c12df2-1f299"
Accept-Ranges: bytes
GIF89a..x.....^........$j..d....%/...ccc6..d...........U[ity..........\\\.......0.....gkg...........RRR................|.MMM...|||......2Ji..@..7...222...qqq....$..............PT ...<<<Vd.AAAo...N.kkk.5.[cu..8...... .t... ..................P......e......Q...-7Q.........e..........H.._..M...v.....;DX............&p.,L.....>X...fhpm.........J_&........Y..BT....Lm.$,3.b....(......s..yk.............(RGLZ.*E>4.'=m..&..).d.679.......$V..Z.............=..............t....H....6cu..)o.3c.2u-./..............:!M.BUf. G...=..........$>`..|.vvw.$....PT_~....... ...S..5".....0]....?m......WWW...&&&..b......D..Xy.EEE....W..<>.....=.v.......ho..... \... .......O.........fX.......TH......................xf...............2.........III....!.xlr..........{....f`v......B{.....&..........!..NETSCAPE2.0.....!.......,......x........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...".....0..@..P.b.8.HY.8.Q....(...1...4.I..L^f..G2.d.TV.L.s......]z.P!...B.. ...V..M.....K..ns8...R.U..~..Kp.g...Dm4F....!.....z.k.B....0i.&.....mM.I.B..r...Xh..r6B93@.s.C...>W....em.[...........V....(....m..#...Z...;......"..NP...{..I.@K..-Ry..F..wk.\.......r..:[_-...F8...s...J.hr..M.A..mi..M~.qU.B.P.:.........M*.2.J)............V.^...3.Y....
<<< skipped >>>
GET /danger1/head4.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 404 Not Found
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:47 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
bb..............1..0..w..pv.i...........9.@.....{.ZA.........6u^.g...R$.<....H.vt.Z..(..d.!.CcZ............F)l.....'{........W...*?.>......c....v.@".....p8........!....}..#.|a...G.:..J..\;.....0......
GET /images/bluefox/gradients/gradient_tcat.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:47 GMT
Content-Type: image/gif
Content-Length: 1453
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT
ETag: "506e8108-5ad"
Accept-Ranges: bytes
GIF89aN."..H.^.._..b..c..g..j..k..n..o..s..v..{..~.................................................................................................................................... .$$. .22.44.66.??.BB.DD.II.KK.TT.VV.[[.]].``........................................................................................................................................................................,....N.".....G......F...G....F...E.E........F....ED...C...C.........B.............?.@...........@?.......A.><.==<..................;9..987.......o`.......#a>..#..A....22..xq.F.5B...Q$...7..(2...-m.......7].h.S'N.9}....(..>..=.....F..0..*..)......W.*.n..V...g..M!v.[..iY.`A..\.!@....o...C..<./..!...1........L......X....f..?w.p.4.../.V.!....c...A..../[..A.....C..!.o..../.......?g.\.....g...;o.....O..x...7h`.<.....o..........`A....(....h...*.`..6.....P...Vh...Nh...n.!....a...X..'............".-...........H..?....6..c....@..L29..G....4..#......3r...\....0....6..f.7.0..C..'./.Id.v.y..7..g...H......./2Y....j!.K.8h..R......h...h...z.....:j...*.....@.."......j..F....6._......... ..>.........0....2.^....-..u....Z{-}.P0......u..;.t.B......[..6g...V..... p...;p...,0..(.p.....l...V.j...Y..s..l...A.$.L...i...&....-..2n0....1w.r.,.L.....s.-..X...-4.G..W... ..TW-.a.U...!\-..T_.u.`..u.S.=6.T.`..%.`B.%.M..&.]w.t.mw.r.m7......'....(.....#~.........-...7N.../.....>..x;..d.7^9.y...a}. ;...N8...N...3&.. x..`..V<..#O..%{ <.y1.<.......g.v.....>clk-.....<.j/.}....;..
<<< skipped >>>
GET /pki/crl/products/WinPCA.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT
If-None-Match: "8071417b63bece1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 02 Dec 2015 18:30:0
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.trust-provider.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:31 GMT
Server: Apache
Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT
Expires: Tue, 14 Feb 2017 12:30:43 GMT
ETag: 5907E30F032C051F75CAAEB6ABD5F2B380B5ACAC
Cache-Control: max-age=333551,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp29
Content-Length: 471
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...20170207123043Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T...CR.?..........DN....20170207123043Z....20170214123043Z0...*.H...............,.....y...{.J....<ox.*{.`rU....=.1.v]'..Tq.V.....O.2..!....s..!#^..DGC..6.Xo..h...}...>..q...*Z..[[....^r%.1......p~.K...}..<.....H..X"Z..A..&.....x....&..O..uN....4"..l...i.W..? ~.....A?..]..ZX.h.........7..$......tv.N&."_].b".....Qr...........'I.{..m@U..
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=d3c023c39da32b5569398126e9bf47d9d1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6ad45659d8-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=d3c023c39da32b5569398126e9bf47d9d1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6b549f59d8-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca4.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:41 GMT
Server: Apache
Last-Modified: Fri, 10 Feb 2017 05:48:52 GMT
Expires: Fri, 17 Feb 2017 05:48:52 GMT
ETag: CEE8475F3B689BDA381668010AD1794EDB42BD6B
Cache-Control: max-age=568630,public,no-transform,must-revalidate
X-OCSP-Reponder-ID: rmdccaocsp29
Content-Length: 278
Connection: close
Content-Type: application/ocsp-response
0..........0..... .....0.....0..0......@.ag...qO...,o.. v=...20170210054852Z0s0q0I0... ..........3.....>v..1.9S......@.ag...qO...,o.. v=...E....K.^.......>....20170210054852Z....20170217054852Z0...*.H.=....G.0D. Q....;`...b.A....?.Y.E...v....... =$.w?.....v:..s..m....C.....\..M..
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86408
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT
If-None-Match: "8017f9a85f10d21:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.download.windowsupdate.com
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Sat, 12 Nov 2016 01:34:12 GMT
Accept-Ranges: bytes
ETag: "02e4de843cd21:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 50939
Date: Fri, 10 Feb 2017 15:41:41 GMT
Connection: keep-alive
X-CCC: FR
X-CID: 2
MSCF............,...................I.................kI;. .authroot.stl.6....7..CK...<.[.........].y.Q..YKv..%k.....!..H!.Q.-..$tU$.)7k..R.=...n3......}?...3gf......h<.2...4.(q..f......&{.`....02.s...2@`.J.<#..q..0Xy%.4..egd.:M.B....in.([....W....(.|.....|....s!..Mo..@......|"(n;Z..'~DE.}(........Mz:T....x..{..n.`z..-.\.............q....ld2z..N/.b.J...........X.S.:UN.S.v."..'l........:yz.<."!.]O..6.:d.....C.P ....P($.Y.Q y..y..B....u.`...u.00.....|(..A.J.Cp.c...X..g.........}..'........D.QVFf0...D...a6.f.0.....k.*8...<.;..o...(.....f...L.0..C.......I.A!.H.....'._)....Qc.V.....5D..,..d../(..j.F.d.....`..f...$>:_%.W..(....@.r.9..Ob.e.$..m.~.]....g.......%`e_..&Qhp .......ey.c.....H`.%<9.......#.\S...R.5....v.......dWE.....:...../"3.._..l.XiH.J!..............{.5C_...i.U....7....;p....Q.`....L.j........u....b.`:Mk.L.......*..@M^m..Jv...g........<d:l..Kq.X...*y...x1.u....... .....z.....c.(<.b...l.#....,z~..M.Y.]..Z....F..N./..[.#....Ol...f.k........U.rF)D....3..sK...`..W.....5.=.@#a....!./....>...g.(. ..9..>!.K..e..j..{x.0.^,...U9..ru.C......,..q^1.G..A.e.F[...".1..*...^...L..#:,7...:.z.n...fI1.....l..E.q>......E...x n....H....t....5.....\...<.l....7}.`\..~_..#..Bz....i..[{.w.....a...c....E w?..6..l......x8..H....7.e.;.%.:.!.*Q....#..bT.......(....ka.......B..|.........1....t.r...fk....C.t`....@3.P..*t..nmD.....8$.bd..`D...5X.....H..L../1:..Ap...w.\...,..U..../"X......}X...a...G....N.X..<....MG....r..H....._@..Q2..T...Q.....].e.G./.v,.Z5ib..5........9 ............z..!...g
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1
Cache-Control: max-age = 440358
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.10.2
Content-Type: application/ocsp-response
Content-Length: 1454
content-transfer-encoding: binary
Cache-Control: max-age=478809, public, no-transform, must-revalidate
Last-Modified: Thu, 9 Feb 2017 04:41:40 GMT
Expires: Thu, 16 Feb 2017 04:41:40 GMT
Date: Fri, 10 Feb 2017 15:42:17 GMT
Connection: keep-alive
0..........0..... .....0......0...0........FC..&..<.0...Y......20170209044140Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20170209044140Z....20170216044140Z0...*.H.............\....4..M&...8#8d.)..F....oe....k.'4.......U...I......j?.....&.'.......:.D.....[.t.~.c.{.g.^...R.?..aU9M$........l2.).gL...*.......t.........E.y...Ff/.3..x.'.b...._....u,....G...].........r{........../...D...'.{v.I.F6]......SW|.C..c.qJHzJ/..&....~..:..........0...0...0..4.......My_e.\....'....j0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 50.."0...*.H.............0.............4..IP.....B..h.....]..).]w.!"..a..{...="....._...~.s1.E.......;...6&/...\2..A....\..T aH:.8lH^.....l.v.$...K=sZf.*.|.%.Pb.......B..*f.T\w.:.s.... ....9..4..cV...3.qc.c..j<.f.....>1X.I...P%?.........5R-....Ca14..X.U....u.....:.z.\.k..b.E.v..,.J................0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-470...*.H.............G..\..R.P..e]...N.....m.....4f......b4"8v..b.R....`.Auz..........2=...@..........5..cWh....J......r...g.h......Kw'...j.@...x.....
<<< skipped >>>
GET /bannerov/leaksbannerov.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: leakswith.pro
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:23 GMT
Content-Type: image/gif
Content-Length: 2629427
Connection: keep-alive
Set-Cookie: __cfduid=d537f39d050a94905c11b5e67cb55cfce1486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.leakswith.pro; HttpOnly
Last-Modified: Mon, 06 Feb 2017 17:20:17 GMT
CF-Cache-Status: HIT
Expires: Fri, 10 Feb 2017 17:41:23 GMT
Cache-Control: public, max-age=7200
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 32f0aa4094ea5a20-VIE
GIF89a..x....................................."..'..8..-... ..!.#!.*#.3"...'..!..$..4!.!,.!:.!."$.% .% .$9.*4.-;.(6.-9###*%%&(& )&$&)*')%* 4#%2,,9%'#,3,.1#.92.2$2< 38333;;;76:01.H..X..Q..g..x..q..H."W.#h.#w.#|. G#'V#(N36k(-L!..)G..D.4H.6X.;V..Q'9G9=D%>S0;M.:f.:k..JB>CX=Bn<C.C\.B\(DY3GX4BK.Gh.Ku.Sz.Gs&Jf'Ux5Yw.Pk8a}CCDKJLHEINLQQNRSRTYVZ\Z\WTXQLO]\aHWka^bz\bdbelkmhfjnmqqnrznutru|z}yvzqmrdW^@A>....................".")..........59.=B.[`.JO.<D.X..\..R.%[./]..d..c.7d.&f.6k..g..Y..j..u..m.$l.(s.7v.%w.3v."^.~|.mx.Fy.Fm..{..t.${.,z..{..V..~..|..|..{.7.....`........'..%..7.................'..'..&..2........%..F..G....................................................................................................................................................................|..!..NETSCAPE2.0.....!.......!..Resized with ezgif.com.,......x.....#....#(*((%.%.#...#%.....#....%*.7*..(....17...*44.//*../11.....7..#.'.......*..(...)4564..../41,....6.465..*/6.1...'1............:W#]...Z.......7jH..oX......!.#.P..$x..Z.?.;..hpb>....D).&.....C....?<.UT.!..w...<..F.L.R.3.meIa7;..q.'....I.W.E..b.....-Z..............B. A..Vm....c..w..%.8.......C..^...3U.....'..........4.hR%..5I 0 .....G.......%r..v...}.b..p..q...".xm..l,.W..........f#..P........... ..u...9..z..T...@..0..B.V...B .... %l0.H....H.P. .....#......L.H# ...!....*.`....t....D".n.t.H.-v.....C.1...H..(..!H'.......P..*.M9*...<.<.....iH)..$T.1,....Yw.... .q..DC.Ba..h.L5UE&.d.P..".Q.h..,TJ.bi ...d).5.67.6BK.NV.:..&.r.m.XyO.h.bn...H%.......JZ.ueC
<<< skipped >>>
GET /cdn-cgi/styles/cf.errors.ie.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: text/css
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-d65"
Server: cloudflare-nginx
CF-RAY: 32f0ab8de6f1595a-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
31f.............V.n. .}...T..[,...-....8F...\......c...6......p..Dsr.... .9...KaF.*..l.1...,c..G..n...,....KbTrC.>..<j...q;...,.E.....-4.7.f......o...uc.k.Qk.I.B....XG..4.;u....4.@-..T%...$...2^..*.2.$CC.b.)kv(l..;,....2.....U.Ka.a..o.........s.).R..&.^0.;.....j.e.yh...h..XV./..g..S...c...I.....}.....h.QS.!...3..fT.*cFq...\.....9.g*...{.(.?.....v.Ja..L(.&..N].kn.=...6FV.*YE......H.....IC|...m..P...9....y..Ki..!....7O.7...m..*.`..-&..$Lp&..D?.....]JN.-....J..;M^&.u.?..T..5..O..}...p..rjG.... SP..@X......T'..M.i...!5..-.....|T.......h...........J5.0..C.yP....Y...}.f.6....Sr..r.l.LJ..&.Bz..... ......"..a.6._..m.c.......].....}...B#0...hd.>Q......K.U.I..,;......>X...\0..(....T.u.g........!.I.&...t.b...D..1d...a....R.Y..:...r....N.....\...h...}.)..h....g..........~.3...P....FM'..@...;.us....E..e.....0......
GET /cdn-cgi/scripts/cf.common.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/javascript
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-1138"
Server: cloudflare-nginx
CF-RAY: 32f0ab8e171e595a-VIE
Expires: Sun, 12 Feb 2017 15:42:17 GMT
Cache-Control: public, max-age=172800
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
7c6.............Wms.7..,....j.#z%{.I...K.6..t......P...6E.H..E.......vzs..,A.........h[..h.p.o.riMw0..._...!.......m.......Z.e.'....GJ-Br..g1\./..'.ff&.....`@z.#..\..a....r..S.2`....A(.....;......0...xL...@j...Y.2s..U..r.Ri/@..r..K4.3"."..h0.U..B...%.].."...K....x..).1.l.n@.-Lq...D(.OV...}...a .C...LjL1...v........0..0_H.y....Z}.....iI.A:...'T..........j.1)...h.pv...y...Iq....#M......4.../...r.$.........>X..ML.......X|...E...U........Z.zx..'..*p......d4.n.d8.*-....JQ..4?.d..[.0..v..4.UMa.|.......@.Z.. HC.....)..z...B..z...&n..>.....g?..nX........`...3..1....!.`.Y...^o..<Jg..9......}.u......@FS.}.....'f..h.....|........d.DHV......'...o#...Km......L....'.m.M........M..j...:.(..9......T...I$u....L.p9>q....a*..!.t...r.I.u3~.n.k.wi.2v...}P..YG............X...b<.!]......t.KfK..St"L4.E(.=~....J.$w/.....e......2..OO.:..iX..}...b...J.Nl.....nif..v.h.e.2.q.B..wb.n).K.x.......N....xQ.u..J..w.~...iz.....`/..#Z.N.j...G.....r..V_...a|}9.....~'.B&...U.cm..Z.........4.... e...U...N.....r&..d..[&..3.BA.8&...M.rLXNj92A7.`H.sE_..V.FQ2.T`.....\..?.i[....x.l.....$s%.6.NX...%m.V.~.y..g...Z..ai.R.Y...2W.s...........t...&..(..jn..n...<..'..Ger.(......:.{_.....o.!.6...........=.....j........L..p.....Qs.g...r...8.]...?....X....y.2 ..=..<...i..x....y4.e...8.....~4....K.k.1.....Ia.....0..=...P..U=......z@.\I..R....K......W9..H..X......A...-..t.2.........v..GB........Q..-DQ.Y:.\.......Z..of"\C..G.. ..DQ.}(.&.;.(Cp<*.M.F].=w.<"R...!..c.|@...]9..>B(d..o@yp(.....i...N..b.........;.w...M.X......{...h..&(]=....a..
<<< skipped >>>
GET /cdn-cgi/styles/fonts/opensans-300.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/vnd.ms-fontobject
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-48ca"
Server: cloudflare-nginx
CF-RAY: 32f0ab8ef7d0595a-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
48b7..............SX%...O...m.6'....5...ms..LvM.l...j....w................. ......@d.<.............e.. `... .......(..../....2....`.p.P.....W.'....p.....^................... ...l...O.....Yr............Q.... .%......l..L:..-.......5.I{%w..?*.!...L...-\4.g....;.T.:|.....J.....f)....j.5...I.>zQx.d[.. .(..|.Y.6.....%.....6....g....u7.....2^....a..jP...,........zL......O....Wqr8g.S.\eZ%L<...P."...'..w..Q..!.R..,.....H...e..l....._q...(;..2v.%.:-.d.{. ..{.kY9.[.8...0..!../.V...X..$P...#-A..T.|...r._.h.*.W........Xa..~t%D..x.,&..-.C....&....>.....V..c..<..Li.R...0...V..s...?-T7.^...L`.^....7......7...me,b..m.l.~[....&.^.>......uA...?.B..2.....-]..C......Z........ow..t......a...F.NI.?...n..\.uc.*a.....:f.bW'K.vI6.:P..).)..".e......mp. 4...2.......b.....a....#.t..).>Z.....-....T..P..V.x.(....T...F"R.- .........P..h...[.._...%.5mt.F1...M.......V.../K.C..%..z.b(..|<....n?N|:l..S}.d....4.*9..^=.0AxE<...M.7a....D....MZ..2.o..`>t..G....Y.....`......P..R.... ...$..#...b....8D...7lqy..N'M....'...~/e..HvHE..v.cW. ..JO.P]...... ..TW0X.:j1t...)#j..p.H..l.5"N9.G.D..-Lvk.}..ZW....O........8.......P...~.X&V.'.&k.a.:..33 ....(.\..1.Xu......".g..0f..6Y..V....{}\mk..{<.X[H^w3_6V.A1...\g......7t..4..Ia6~U...dt.@.pL8...Z.l....8.'.(".~...D.8{A.v,=A..A....>W.........p...2..,.......B..@...<....Y.KB.....R.......P6.u0.....2..&.`......m.H1v.P..qV.Y1Q|.5.`....h...E..].....q..I....~..gAsg.9_....:V..}.......C v.]H%y..I.h....i...}Nx....m:{..Ci....<q=.[l.Pt,:.m.."..|.z{.V.2ur.b.NAB.2A.H.,._S...l)...{) .$.
<<< skipped >>>
GET /cdn-cgi/styles/fonts/opensans-700.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/vnd.ms-fontobject
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-4d50"
Server: cloudflare-nginx
CF-RAY: 32f0ab8f702f595a-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
4d4e............l.ET....waq[\..../.....I.w. ......;......C_.K_..2...\G]...U....p.....CCF.G.......8...PV...l.A.P....;.....$...........6.W............2@...p.X..."........8...W......p........?\.@RKN...........L........Q...1{%....T:B.,..<....1..........a!...(..4}.^\... n..T].K1J5.V.B...l.yFA?.ZG4M.X.OuDK#U.!-..].."..&^..=..8....|....E.....B...U..2b..|.i ..y...p.......:..j.......E.[..~'.:..~......0...A....L:.%...A.$..M.s.....r]...~j...Q......V.o=......V.g.l.Y....;^...x.....u...&.....v.Y}...OE....6O@s;....<B..}yd...O..&..(.l... ..S<..U.V........f.^.G..-T..Y.hD...P .%...4...........k.....DW..`b..JE....*_...8....YBT<y...}....uU....N..._..EiI..{........q|..5;..."..^`c.._.K./\,...}?@....,.O.?..m....)...(..sP.N...JX.p.....fA.'P..],].. .h..(.F......E...%.:.M'........I.m[.GO..n.Pi.S.8dh=.t...'2.d..=.ZdX.0G,....g..]...E....H..r..4F.'..5...Y"...&6z)\{..2........5V<Y..I.rUP...:<E.OD..bf....#,.[0.\..."...19...#`.. $=... hj.8R..0W..E...H.&.=..`..6*$.p|..... .=.b.jR,.*.B.....L....1z..J..v.....q....ZDL...?.....r...Ni|..!.7..D^$S....u......aB.j|$.......Y.Q..#.S.cT;G..x....&.p....D.....K-.8.n...ql..C.%._6r Oo..y.....Y^.....'..)..c._=C...cQ....... .....n%.A../..N.?..uJ^U.v^...2......b9#c.y..&..<.x.P ..1C..v.8...t....4...T.3..C._..OK...{X....H.$..q.c.5h.g...w.~..4)r......x..;.v..TjM$.........;OO...:g..lk....F.g.U.........p.N.._.._D7Zz.`............ K.GF@.tWbJNc...Zt.5..3......`D..../p...ur...C?.E..X..0.='......ewu.............5.*D.T~(...nn....?.....O-..dT.....g..Z.....9^.h...b.q .......W........|.J...?....*.q ...
<<< skipped >>>
GET /cdn-cgi/images/error_icons.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: image/png
Content-Length: 16759
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-4177"
Server: cloudflare-nginx
CF-RAY: 32f0ab90009c595a-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Accept-Ranges: bytes
.PNG........IHDR.............R ......bKGD..............pHYs.................tIME...../....x.. .IDATx...y|\U...$m.)..;.4..*`A....^....E)..d... .N...z..T.M@6.....HY..(.;.BY...=.?.I..&.....;...........<y..s.y..!..B.!...u.A|t4..........)"...1..k._....p.V..q.....8.{...L...@'0.....b.-E["G%.P`3`.....@...q3.x.x.x.x..X(.U$r9.6...;..._..{t.o......Jl.\*.r.X`.`.`....t...O.....<.\[.....&....9.Xo....:..D.............../p.puk...D.O.=....m.%.....m-..!..).....w.......|...ba.D._.5........BL..............c.h....:/......Jd?....=.XN~........S.9=....`}.X..._....DNN........LF...1...M.9~.....XY...-..............WY8.f..[...H..$^.p>.z. Q,p.pR....<.x<..`.y.....[..7%...n......7...Z...$r....n.v.?^.)...b.:.O..3.W..Hb/Y..CGs....}K...W`59.=W.G.4.....G..!\.)............[.w.K...q......E.hn.....&'2.=..ig...%...[.g....:.[....%.v#.A...\...kCd7..W`y...8...&Dv.A.FCly......s}...vn..T{.....Z,.9...]...u.u..-...#w4...nT............$^.x.M..En..M..W}....n..5.X.B9..#_.V9.:gv4.l...EGs.....Zc'.s....d..$.R.U.X86...b..<`...(..7.&.].7..Ae....,..9.........%.DX.J.'.............}eS.Z}.w-.p.!..O..........4..|n...Ow{..)...tZ.$.;a-.....g.g..Z...K.t..........O..#w4..........Z...J.}i.....Pw....=.c0..`...?...}....;.[V.........J...{.%....gx.?..g.K8G..:...3}.Z...NI.0.....4..N..<.x..$..L..w.........-.{#rGs.......o-.....?.v.T..."q...MX..'.........M.}...../.l..\f..u.{.|.p.g...GsKK."....g.........g...../8..*...R......i...!#....&..Z,.Wa..v.yr.%.!.Q......nnN."........gT..]..)..o'.[Q...X....1..=i.%.o.&rGs...;....b.....[....xL....\'...........T...xU..y..d~1.L
<<< skipped >>>
GET /cdn-cgi/styles/fonts/opensans-300i.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:42:17 GMT
Content-Type: application/vnd.ms-fontobject
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"589b19f3-53af"
Server: cloudflare-nginx
CF-RAY: 32f0ab9050d5595a-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
400a..............Ct$..e.b....m....Y.m.c.6:..t:.......?....z..F..`Z....@......"$.$4................C..@....)..@..=L..........`.p.....3.3....(...6.[.'..@...<.f.G..........V.w.......vl.f......0..j......5dT..'H.{..............2....Up...%..wgd..4...FAr.[.Y}......HM*J ..O.o7K..v..(o2.6L3..(.h$[...BEy.;....\..q..O...\q....=*~.`n.@:.5J~ A..`Q.-..t).......r.(0.......m7.I.)...6........{L-..2oF05......O]..8....ZX.............0.i..!.nfA{.1..j<..le&..2...s....C..r.5.V.k).8o...&B...p3W..n]..L.{..>.........2|....g.. ...iC...l0,..........8.!..9I..`...)%..l....j...c.6.G..N5..?...........#.Y...-s.......wr.Ah....!......3...o.......... =#..J.......Qu.G...8...4......'.z'.%sMD.x7...'59..Q..X.w.p.H.~.Pw...V.g..#....-/&.........%f$;!xU.a..&..&..D ...$....(/#.........'..O..!......h.......q .Cr(i....=i...X.n.....tC...."......BX7.H..*.l....=S."..r.>.S...d..7@n:..&.R.B.n.t.z.o...P3G.G..N....<.....[}"..r.-.|....I..G.|...6..........{.^....).}tc*.p.a2......t4.[Z..5. .y.....r....L..K..M....#....T.]..s"I.R .....m.....N.....sC..r......lF...&$.....Bx.Pf....q.(...@D2....`..x0... ..d..7.....}.h.Vp..`.7.NR...-4...FrY.._J.(...x.6!.3p...Xwq.........(..Z.(B...V...0.U....Soo{DL2.....@..!la...;...D(....p.(m]o.[kj2~.......=....{.....&./..j..b\.,.:C.....r$...|x.R.0K...,......E.<._N...{.z_..(^..D....7....Df....L........m;S.\.w.E...<.......{q._.3m..r...6B..C....@C...}.tD....k.2N.w... '..*..":US.....5...1...-%..jx.gYc..&....k.......s.nJqwtc..B.....?k.m..]31G.n^./.'M..n.$(....}...."qA.A......I..Y.j..%a....L....e..$oG.T....Qy.$./....E.tS.
<<< skipped >>>
GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-6eeb"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:17 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-6eeb"
Server: cloudflare-nginx
CF-RAY: 32f0ab926228595a-VIE
Expires: Fri, 10 Feb 2017 17:42:17 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/scripts/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-17bdc"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-17bdc"
Server: cloudflare-nginx
CF-RAY: 32f0ab92a250595a-VIE
Expires: Sun, 12 Feb 2017 15:42:18 GMT
Cache-Control: public, max-age=172800
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/styles/fonts/opensans-300.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-48ca"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-48ca"
Server: cloudflare-nginx
CF-RAY: 32f0ab93028c595a-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/styles/fonts/opensans-700.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-4d50"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-4d50"
Server: cloudflare-nginx
CF-RAY: 32f0ab93b2f5595a-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
....
GET /cdn-cgi/styles/fonts/opensans-400i.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenens.com/register
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenens.com
If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT
If-None-Match: W/"589b19f3-52dc"
Connection: Keep-Alive
Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE
HTTP/1.1 304 Not Modified
Date: Fri, 10 Feb 2017 15:42:18 GMT
Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT
Connection: keep-alive
ETag: "589b19f3-52dc"
Server: cloudflare-nginx
CF-RAY: 32f0ab93f32e595a-VIE
Expires: Fri, 10 Feb 2017 17:42:18 GMT
Cache-Control: public, max-age=7200
X-Frame-Options: SAMEORIGIN
HTTP/1.1 304 Not Modified..Date: Fri, 10 Feb 2017 15:42:18 GMT..Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT..Connection: keep-alive..ETag: "589b19f3-52dc"..Server: cloudflare-nginx..CF-RAY: 32f0ab93f32e595a-VIE..Expires: Fri, 10 Feb 2017 17:42:18 GMT..Cache-Control: public, max-age=7200..X-Frame-Options: SAMEORIGIN..
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.startssl.com
HTTP/1.1 200 OK
Server: nginx/1.7.2
Content-Type: application/ocsp-response
Content-Length: 1769
Content-Transfer-Encoding: Binary
Last-Modified: Thu, 09 Feb 2017 10:12:37 GMT
ETag: "D897C7E78CB5282B4C0FF19C78568ACE591CC8A7"
Expires: Fri, 10 Feb 2017 15:41:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 10 Feb 2017 15:41:47 GMT
Connection: keep-alive
0..........0..... .....0......0...0...I0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder..20170209101237Z0s0q0I0... ........As....j....k..b90pi5..N....@[..i.0.4hC.A....j]..;NO.{i....dk....20170209101237Z....20170213102237Z0...*.H.....................h ...._XE.....Z....&.k.$&...R......%.7...%'.}d...N..."..0..q.E......p3.4.w.T.:0u..i.....c.m...O.].."mF.#.....z.3....k./|..m...8I.....p.~.r.2P.|..%.....d..M.Z..P.,X....C...u..=../tB.......|:.w$u,........^(.]%'.......{z,...t..!#.......z..0e1....t..=z....0...0...0..........t.P..M7O.">F.v..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...160920000101Z..170920000101Z0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder0.."0...*.H.............0..........W.-..Z.\.....u..6.F~....~>IXqW..h)..{ .C..k.wL..e..{.k.o........%...l\..=......b...,a....9..4.....6..'.h..ca[....[.>...e.vdpm..)...e..-....6/.e...ay...T.c.}..a25...'A...x.S..<.#... ..xl....D....p..5........L.o. G!....Ld\.!..)o..GK..i.w...b.....p.S.r.............0..0...U........0...U.%..0... .......0...U.......0.0... .....0......0...U......_tY."....!\.n..&..*.0...U.#..0...N....@[..i.0.4hC.A..0...*.H.............-..x5i...H...$Y.....y....2r.!..W]T....z.5..w^...[.1....H`..N...|.3...(d<.8..4..l.*.@...:.GV...........=.n.... ...y.WK.x..~1.%...j....d..../R..p<.mR...Ii.%....d.5.P.Z.s.... ..p.7.W_.9.*.T......... ..l>M.=...w8.K~.).uU...n.Q.@^.cR.a...5X...]'.P.Yf...0V.3. ...h
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.startssl.com
HTTP/1.1 200 OK
Server: nginx/1.7.2
Content-Type: application/ocsp-response
Content-Length: 1769
Content-Transfer-Encoding: Binary
Last-Modified: Thu, 09 Feb 2017 10:12:37 GMT
ETag: "D897C7E78CB5282B4C0FF19C78568ACE591CC8A7"
Expires: Fri, 10 Feb 2017 15:41:47 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 10 Feb 2017 15:41:47 GMT
Connection: keep-alive
0..........0..... .....0......0...0...I0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder..20170209101237Z0s0q0I0... ........As....j....k..b90pi5..N....@[..i.0.4hC.A....j]..;NO.{i....dk....20170209101237Z....20170213102237Z0...*.H.....................h ...._XE.....Z....&.k.$&...R......%.7...%'.}d...N..."..0..q.E......p3.4.w.T.:0u..i.....c.m...O.].."mF.#.....z.3....k./|..m...8I.....p.~.r.2P.|..%.....d..M.Z..P.,X....C...u..=../tB.......|:.w$u,........^(.]%'.......{z,...t..!#.......z..0e1....t..=z....0...0...0..........t.P..M7O.">F.v..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...160920000101Z..170920000101Z0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder0.."0...*.H.............0..........W.-..Z.\.....u..6.F~....~>IXqW..h)..{ .C..k.wL..e..{.k.o........%...l\..=......b...,a....9..4.....6..'.h..ca[....[.>...e.vdpm..)...e..-....6/.e...ay...T.c.}..a25...'A...x.S..<.#... ..xl....D....p..5........L.o. G!....Ld\.!..)o..GK..i.w...b.....p.S.r.............0..0...U........0...U.%..0... .......0...U.......0.0... .....0......0...U......_tY."....!\.n..&..*.0...U.#..0...N....@[..i.0.4hC.A..0...*.H.............-..x5i...H...$Y.....y....2r.!..W]T....z.5..w^...[.1....H`..N...|.3...(d<.8..4..l.*.@...:.GV...........=.n.... ...y.WK.x..~1.%...j....d..../R..p<.mR...Ii.%....d.5.P.Z.s.... ..p.7.W_.9.*.T......... ..l>M.=...w8.K~.).uU...n.Q.@^.cR.a...5X...]'.P.Yf...0V.3. ...h
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.startssl.com
HTTP/1.1 200 OK
Server: nginx/1.7.2
Content-Type: application/ocsp-response
Content-Length: 1816
Content-Transfer-Encoding: Binary
Last-Modified: Thu, 09 Feb 2017 10:43:27 GMT
ETag: "19EA21C5EC4190A4DC16E6AF38C1BC22119AC819"
Expires: Fri, 10 Feb 2017 15:41:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 10 Feb 2017 15:41:52 GMT
Connection: keep-alive
0..........0..... .....0......0...0......0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder..20170209104327Z0s0q0I0... ........Qh.....:U.`."....0=)....N......g.D..3....... .m..I......i.......20170209104327Z....20170213105327Z0...*.H.............~..Z9..]r.........s..x>.HO......a.KUL`...>.Rn.,.....T&.......>,.}...oo.,...o~ X#N..k.Z...G8..b......d!................6..(.H...62.g.......w.D.r....W./..cy3_..Aa.q....xh.oGI...Sc...%3.....P.8....T.l=l...b,..-X.N...FW)k............;..e^I..f.f.Ok...$."r...|:.....0...0...0..........T...._fA.....v..0...*.H........0x1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1&0$..U....StartCom Class 1 DV Server CA0...161210034431Z..170330034431Z0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder0.."0...*.H.............0.........Y..J.?V..F.r..,.:..{{o@.O....$bC...s7!..J.h..T...jY....V..c.\$.(q.{O..L..u.X89U....{.K.?}..,(.S.>F<`].`...yJ.......2.v...&."><.f.......CK.....}.k.8...[....Rg.t..x...z....(..?..9xT..Z.\|}{........>.........a.2.G.'..h....!I.....:..<..h...5.H$.\.>PI.....JY..........30../0...U...........0...U.%..0... .......0... .....0......0...U.......0.0...U......o...iOM...:...S....T0...U.#..0.....N......g.D..3.....0o.. ........c0a0$.. .....0...hXXp://ocsp.startssl.com09.. .....0..-http://aia.startssl.com/certs/sca.server1.crt08..U...10/0-. .).'http:
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.startssl.com
HTTP/1.1 200 OK
Server: nginx/1.7.2
Content-Type: application/ocsp-response
Content-Length: 1816
Content-Transfer-Encoding: Binary
Last-Modified: Thu, 09 Feb 2017 10:43:27 GMT
ETag: "19EA21C5EC4190A4DC16E6AF38C1BC22119AC819"
Expires: Fri, 10 Feb 2017 15:41:52 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 10 Feb 2017 15:41:52 GMT
Connection: keep-alive
0..........0..... .....0......0...0......0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder..20170209104327Z0s0q0I0... ........Qh.....:U.`."....0=)....N......g.D..3....... .m..I......i.......20170209104327Z....20170213105327Z0...*.H.............~..Z9..]r.........s..x>.HO......a.KUL`...>.Rn.,.....T&.......>,.}...oo.,...o~ X#N..k.Z...G8..b......d!................6..(.H...62.g.......w.D.r....W./..cy3_..Aa.q....xh.oGI...Sc...%3.....P.8....T.l=l...b,..-X.N...FW)k............;..e^I..f.f.Ok...$."r...|:.....0...0...0..........T...._fA.....v..0...*.H........0x1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1&0$..U....StartCom Class 1 DV Server CA0...161210034431Z..170330034431Z0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder0.."0...*.H.............0.........Y..J.?V..F.r..,.:..{{o@.O....$bC...s7!..J.h..T...jY....V..c.\$.(q.{O..L..u.X89U....{.K.?}..,(.S.>F<`].`...yJ.......2.v...&."><.f.......CK.....}.k.8...[....Rg.t..x...z....(..?..9xT..Z.\|}{........>.........a.2.G.'..h....!I.....:..<..h...5.H$.\.>PI.....JY..........30../0...U...........0...U.%..0... .......0... .....0......0...U.......0.0...U......o...iOM...:...S....T0...U.#..0.....N......g.D..3.....0o.. ........c0a0$.. .....0...hXXp://ocsp.startssl.com09.. .....0..-http://aia.startssl.com/certs/sca.server1.crt08..U...10/0-. .).'http:
<<< skipped >>>
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=dafb21e8c4237f866f7ead9a70dc4bf651486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6b12eb59f6-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:30 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=dafb21e8c4237f866f7ead9a70dc4bf651486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT
Expires: Tue, 14 Feb 2017 12:21:32 GMT
ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 32f0aa6b632e59f6-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>
GET /certs/ca.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: aia.startssl.com
HTTP/1.1 200 OK
Server: nginx/1.7.2
Content-Type: application/x-x509-ca-cert
Content-Length: 1997
Last-Modified: Fri, 18 Dec 2015 11:03:49 GMT
ETag: "5673e815-7cd"
Accept-Ranges: bytes
Date: Fri, 10 Feb 2017 15:41:36 GMT
Connection: keep-alive
0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0.."0...*.H.............0.............lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.......,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.........`.g:........r".................\R<...*s......`.z/...n.&0.....W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U........0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.startcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startcom.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.pdf0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at hXXp://cert.startcom.org/policy.pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 404 Not Found
Date: Fri, 10 Feb 2017 15:42:11 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha
<<< skipped >>>
GET /Big_banner.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: paysell.bz
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 10 Feb 2017 15:41:23 GMT
Content-Type: image/gif
Content-Length: 1439404
Connection: keep-alive
Set-Cookie: __cfduid=d91df4e7668368f826f0a547a006dcf071486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.paysell.bz; HttpOnly
Last-Modified: Tue, 31 Jan 2017 12:42:39 GMT
ETag: "541117-15f6ac-5476344792a8c"
CF-Cache-Status: HIT
Expires: Fri, 10 Feb 2017 19:41:23 GMT
Cache-Control: public, max-age=14400
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 32f0aa40b170599c-VIE
GIF89a..x......V..#pp..(3m.6*.."....%.....`...O....%....o.l...""...M....uP....".#...V#....Pm...........Odqu......Rf.q'f...Lf....WT....3Gp..m..."..h...T.w.T.."t.......i..Vl$l...2H$..........u..%...q...Uz"......s..DO.O.r.....O......jkg....'....kw.3E)F/P T...gr..)$FS..RS.......(.DZP....ig..H&R......1Sc#...w&(mq.s.a_.....I1..gJ..P...o%....w........BW.G.n$..U...2..U....$..#.....K....v..$U..|K...N....}.."....|Q9lNQ..H.....x.....3....."....."..3..f..h~...."..3.....".....3.......m...3........4.."..3..3..3.."..U..D.."..".......""..".....U...."".....3.."....."..V.."....!3.."....""..".."....""....7...U..D.."...."3....."..D..D....."....5"..3..D.....V..".."..3..3.."....".."..:D..3..D..D..3.....U..f..3....;............3....4..73..3.....8.......;:..>....8V..."!...3....................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)" xmpMM:InstanceID="xmp.iid:961A15C7E73B11E6AB398C80DC03CC4C" xmpMM:DocumentID="xmp.did:961A15C8E73B11E6AB398C80DC03CC4C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:961A15C5E73B11E6AB398C80DC03CC4C" stRef:documentID="xmp.did:961A
<<< skipped >>>
GET /clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT
ETag: W/"56fc9198-8f14"
Content-Encoding: gzip
3265.............}k[...... 0{.^2..3.J..'\.......|"D...7A....~....N......k.$}.....[_......q9.......L......z..t...M...=..(.O.\..=...T....7t'.;J=MF.,5.wS.N)U............}v..Gw.[".....-..=Y=7_..zvg.7..S.s....z...w../...m.gW[-..l....#c...Ds...d...z....yp.Gg.....p.`3........;....'O.1 .. Y..Y.....G;7v'w.{.....sU...........co.1r.i.95E..<S......f....}....@.x.A...~a0..w........:s.O.I.l.Z........lV.h.D..o........;wf....t.k. ...dU.......u....M..;.....=..YI.W.......t.4v}.Z.U.. b.;..=0W....H.....<y..>...8.[U^.."V....u.51..L..U...6<.*...T.W.T?....g......Lxp.Iq..>/k.|...#..L.....a.r...N.......y.^...............LA3)A....3.9..0M@m.2...@..). OD....}!I..Q0.....^...-......E....>......;.:..o..Wo.....o..i.8..R...P.....y....t.{..`...b6.Cf...m.......@VsU.....z.9..|x.......g...._.e..]..w...@.t.........w..Sg...,..jP......D..A..9pZ...W.iB{{.w.9.....FK..hz.....Nb-.....A....l!..W>4..M..M,.PR.o......y..F.V..3Ti.]..lt.D.9#.}...W...9O.....D..&...."0..L.|..D.....1....1..1......IR.......B.i.f.s].]...[..".eZ ...$.X..gO....s.]. . .8/.....f.:_...\... ......K......d2.I_...#n..7...y......`.0.H..T..(-.8...H...}c>..g...........1.DW.O..A..@Z.9U)...\B....ze._.N..3I.&...e..Q..:..?.V..5A.%......B.7..{..P)#........{...YB.L%... ....).B...i..R[.<......!......W).x.w] ...#o.......y.....`..;a..^ ....e...^A.>.;.2..y..2 ...<6.....^'dE...1.u^..W..`.iH.C.5.*;'`......l.-5q.....t..U....8b)....... ..Xu..............s..3sS.d8~....Z....H_*V5...$|...t.I.f....A...4...H...'..C2Ot0....Z.._..[...-S.b..(.....{.o}..g.o.K.D`...I.)..*.H....2Z..<
<<< skipped >>>
GET /images/smilies/51.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 3066
Connection: keep-alive
Last-Modified: Thu, 31 Mar 2016 12:14:06 GMT
ETag: "56fd148e-bfa"
Accept-Ranges: bytes
GIF89a*........... mU.@4.$$$.............. ...eP.........y...................q.ye<ue8.....}.........aaa.i.q]0iL.]H.....................a.......u.............000mL..............}.......qqq.....e....}.......!..NETSCAPE2.0.....!..Built with GIF Movie Gear 4.0.!.!Design by Aiwan (aiwan@yandex.ru).!...d.>.,....*......@.pH,....r.l:...tJ}.....@.*..0..=..hl..N..k.{......~....uUmti.pQ..cS..^............ .k.8*.........,.k........5.............e.3........)4.k.......%..e'..$.....$...1'k.(..........)..(.q/.D(h...)..".X."....<@..@...%(x.......@.`.!... ...H.....B.......8s:...!.....>.,.............p8< .H.b.d..N.0q....!...F.>.,..............@.....P.D2...2.T.4A.!.....>.,....*.....?@.pH,....r.l:...tJ.Z...v..z...xL...h. p^....`.&.}.5C.0..~>oi.\A.!.....>.,...........@.pH$..C#.@l:}....|>....Z.z.\........:w......K`..x*1?.:0.......... .\.8*.........,.\........5.M..>...........C.....3.......)4.............%..B....'..$....$...1'D.....(...........)..(.....x.@....*5P.!.......0.....$(P .B...>. ..E.. XD. .....)..`"...!.d0....L!A..!.....>.,.... ......@.pH$....1Yl:..h.#.>...V.}..[fW..W.....Y.sk..*...x$Q....aC....|>..u....C............. .E....B.8*.......,................5.M....>............C.3.......)4.cB........%...X'..$....$...1'.].P`........ .."B....ay.@.....hh..B.....(...... H.........<..... XD. ....O.f....D..!B\.`...>B...!.....>.,...........@.p.......@l:..A p.,..g.....F....j..o.;...Ot..>..W.P>_..HxyDWRSuW2o...v...VdD|Hu...oe[...N...q....Z>...d..5....S..........FN.3........)
<<< skipped >>>
GET /images/bluefox/misc/navbits_start.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 1073
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT
ETag: "506e8108-431"
Accept-Ranges: bytes
GIF89a................~*#....)#|'". '~)#}(#.,'.($.*$|*#|)#.,(~)$} $. &. &. &.,'./,.0)./*.2,.40q1(.73.60p2)s4,.?8.A;.E@.PF.TJ.SK.\QXG3YH4..|..}......................*(.*(.,,. (.-,. (.0/./../...-.*'.53.0/.... ). ).--.,*.-,./,.11.//.10.2/.>=y5/v4-p4 s5-.A?.FB.EBl?3`B2^K8UN:..........00.54.11.--.?<{61...MN>.........EFB............................................................wwwqqqpppnnnLLLDDDCCCBBBAAA@@@???>>>DDD..............................................................................................................................................................................................................................................................................................................................................................................!.......,........@......$h........P..5."J.......<. #.O.;g..|"a...&..4pDJ.Ap$...fP...e...C...W......@=nf.T.ga..Jg...4...7|h.......P...gf..0...@.B..C..lH%...x.Ta....5n..^3gO........q..u....f.c...Pe..2...!:.. A...e(pP.c.. hd.A[..0[x4y..2...4...".....8)..O..P.dp. F.....Y".O B..M.1BdB...( ...P@.;....
GET /images/misc/password.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/png
Content-Length: 620
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT
ETag: "506e8106-26c"
Accept-Ranges: bytes
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..S=..`.~.VN.......[.A.m.A.N... ..&N..&................<P.Z......I.5.V....M.&._h....|..{......Dp]...|.........Q"..s..^....4}.f ..g2.$....a....e9U.T.9.s.4/}..O..`.>.>..B..l6.f..I..i."....4..(...l.>|.s.....8.a,'.I.j5....h4..PP..r.X|]....L..L.....P*...[r..3?."....`q..:..]..i.... s..N..(.. 0{.{..`ex.....[|....W..~...7......./......l.>..U..m.X<..S....!..u..-4,....Gl...]o...n.%.fM.....C...'........m..... .K.....u....V.}.,.[_6.[. ..F{..c..e...../...#..=.[......?%....D......7....q.F.cf..L......U!......g.pv....G.?...........c.&...m@....IEND.B`.....
GET /jpg/L3Zd0Sx.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:45 GMT
Content-Type: image/gif
Content-Length: 150541
Connection: keep-alive
Last-Modified: Sat, 27 Aug 2016 06:07:30 GMT
ETag: "57c12e22-24c0d"
Accept-Ranges: bytes
GIF89a..x......7....&......c.....................iE.40!...fW....HA1QI5.di.....x...ulS..............k.........[S-.l.J1....efe.kG.....R...id3.sAlU1.nD.........|}|.}H}U8..X..k...wd8skF.....8../..4..2.....6....u.#..e[E...3%....S8$..........._..m..!........7WI(XQ>.....g."....../.X;..s...../..b.z^.......sK....u}......wg. ... .KB".D..% ...uK3.....g..!...........Y..L.)-.tZ.wXwq5..&...c....fmbM.....7..d..s..!.!%.....u..0z^?....|U..-.|2..~0*...#..t.a@.....X....$.TH....@)........S\."!........&..\.DG=4..<H.....i~tB.....)..d.&........!...o..........6=C.......s*....|..L....zP..$......LC.................._.~I.#&.....u...rrri>,[:(.DJ..).IQ.....$..j.ah....%........k<.......(-.......,$`8(..$...c?*<:(....-4..... .................^....."........ ..q..............&...UN<........1............!..NETSCAPE2.0.....!.......,......x.....Q..H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...Y'....0R.b.4.h.P3....<.w^.@.).M9.i..#....LN.d.PFY..RVi.}T^........`..e.d....f...ph.........t.&g.x....z...c|.)....J....eh..6....F*.m.Vji.^^...rA......i................I.......J.................z.K..s....j*...a:...ZJK..QZ...Hj...Az...:.K..1....*....I....n.K.................b.K..K.....)....9....IL...Y....i....y.....L...................L..............
<<< skipped >>>
GET /images/bluefox/misc/w3ccss.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:46 GMT
Content-Type: image/gif
Content-Length: 177
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT
ETag: "506e8108-b1"
Accept-Ranges: bytes
GIF89aG...... ......:::!.......,....G................0.....f.E.X...(..... ..9..N....pzD.(0..(..N.......j.jXKe.Iy..B.U...{.d..t^.h3]k.o../m.w.vF.S&.v...U.(.."9....I.......iP..;HTTP/1.1 200 OK..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:46 GMT..Content-Type: image/gif..Content-Length: 177..Connection: keep-alive..Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT..ETag: "506e8108-b1"..Accept-Ranges: bytes..GIF89aG...... ......:::!.......,....G................0.....f.E.X...(..... ..9..N....pzD.(0..(..N.......j.jXKe.Iy..B.U...{.d..t^.h3]k.o../m.w.vF.S&.v...U.(.."9....I.......iP..;....
GET /images/misc/username.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:46 GMT
Content-Type: image/png
Content-Length: 728
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT
ETag: "506e8106-2d8"
Accept-Ranges: bytes
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...zIDATx..S_HSQ....{..Y..@...h..2)}..P)l.^zX.P..Q........QA.......jO... .....0.....?.....9..y...w.w..;..;.;. ..`hp..........V.u..wJSU.r.))...z|.S)..3..766.......D..i..E..J.......L...0.f......3....*.Y.UE.K).J.;.T){...`..*|N..N.e^...Q..t...9.; ..n.F...... ..>q......'.{.._....T.f..h.a.o.Z..........oo..........5;n...[](..!q.H..F....g..cy.M...v....;.-...D.......n.m..|.6:....`O......xj.#^L.ccc/..y"...&..z.R..f..8.N..i|$.... T...{9.....E..J..|>....%..Y.....y~..r.... I.......b....6X7...b.e.v.....:...!..........2!....V........Qs..#.!..43{.......t:m..j;..F..`..%..p........:...lo......Ba..e...5.m..c...=2....AxD.<hnOGG'..-...Q..D4...B.........=.........IEND.B`.....
GET /jpg/twitter.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:46 GMT
Content-Type: image/png
Content-Length: 7053
Connection: keep-alive
Last-Modified: Sat, 04 Oct 2014 10:23:20 GMT
ETag: "542fca98-1b8d"
Accept-Ranges: bytes
.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<.../IDATx..[....u...>v....V..Xt#...$$...AT.v.a*Nb.B.p..Rva.C....r..e...(.....0H i...v........3=...3..]..B...z......]....{4.4.e.t|../.....#G....-.....x.AV.i.Hx.w-.L....i...M.u.OGbQ.u.\.....f....S...2.. .#V..\..F.5.#{..s...........j....sND..s.:.h.c"..r..(....x............"...)I..Hk..a(dR<'...x...2GQ....6l...;v...|1!p.....r...B..%.vZ..c^..*..M....~....xn..LqY*........o.i..J.d....t....9u._..h.L|..'U...q?F..phh(..6..Nz8''g%..t$.)..o2.g....C..........p8.{....:QTT.*I.0.Lp8...2`.X`.=.$<... .S.U...v.}M&N9.$..I..*-\.n...x6...R .]..h``...`.....#...H.;QZ>".)........\.^.H.]CZ.....i.....;..2..L<Bb....B...l......_.;.r..WH........o....I '....L...* .T@...L.<.YQQa..$.|>_2.-..f&.....`........q.W..OP.Q........n1..t./,,l.....fRU.r.%..L......'......%%._...f]q..y...N.......m.>...........9...# .....$...yF:....<....n~....(..g.v&......_.b....J.t..(2#.|&GQ@6X..|.s...M..]..YX3...<.P..j..@/*F...............w...9...4.....KJHp.KX...>q.5.9F............3...'9qZ.i.U:.....j.......>[...3V.....P!.....<.fZYY....Mxo.k.8.L.|.P..9.V.h.A_........o~..z.T....K9.opp....!......".c.c;....x-...x....s&....j..1B..-[6.....[o.u3.Z)V....X...'.\R...{<.G..;...G..ztu.`...D,.q.M.`.?....).L..7^.......... V^YQSSs....!:Z[[7....H.........._.9....!......3.=`D...K........{..-...-x.....%.L@.q.x.P.mn..Gu;)...,I.Y.lOC.x..F ....n....P..L.^*[..c..H. P....O3}. e.........TXf..x8...^..I.&....2.....O.}.M7.X.*..].9!ttt.......O.."7.........Ek.....aS.fBd8....A2......c...
<<< skipped >>>
GET /jpg/sa1.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:46 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Sat, 04 Oct 2014 10:40:50 GMT
ETag: W/"542fceb2-927b"
Content-Encoding: gzip
400a..............gTTM.(..!g..$........$9'.0d...(A.P$ 9...."A.dI.D2H.......{.s...u..s-V..U.....{v.}..|. V.W..@h @......K.y.Y...*....6.."..H....@........./..t......^`...\A|(...............=.......KY.-`..[.;...........9[.=..>.^.Q^.Q.../....(./.......m/.~......N.~.&..S...~.........@..g. .._u....O.g..........u...'3.U...@...V..............................%.K.(I.Q..........!.1!!1.!!!.."$.Q..?....@..tQ........$..)dWq...$.Vb.P...`d..10..qp.@.*D..........h.h.X...`|~....~...CJ......|.d.....L.Zo-..\..e......nY..RdV._.}.c%...].....l....A...<...........T../..Y{.&.V..|..V....K..n.]< .......l....D.p....i.].K.|.c..,x......b.5(NF...M`......k....Fd]....r...2.....o....|0.M.@....Sbf%-L...A.JQ-...k..'j.4.i-..mb%[..7.fV.....4k..O....h...a.......>jT".3...&....~..e......u#..Wjt....L(NC..,.^.r..........n_u~.>1h.. ....K.o'PV.O.%.....!d.d..d.eF..7=,f.;.j.A....z4^UL\..`^.a..e...1s...m......{.....-.y...;.G....... F.r.os...g.v.Z.........j.$.X.el.|...*.Jr....4._}.......].E9U.6.<....%nJ.#.............5.wM...2..p...m...i.t....].i...=.B.... ...bF7.~....;x_7L..0..b..q4.....-.OP.&w%.....<....>K.4...D.........WC...{...T.5....B..;.....5.....-9|....p....-..g.C=v./nE..^..b.h..:}..}<..........%g....A.....%C.g...........4...W......a. .UG.Ee.K{.......@..'.....4.6 .x.$......)m].{D..;z2......\.>....:.-|:{.....f{O...j.........1..w..^.5.........y......oy?.....o.c.q.|......{...........Xi....hZ.,;..zu...b..9.'.......GN..E.#.f.......4.5..p.....N`<K......:....E.8...i..b..5........hH......s2.I6/..8.?.|~Z3..a..V..~fs.8.........
<<< skipped >>>
GET /cron.php?rand=1486741283 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:46 GMT
Content-Type: text/html; charset=ISO-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.6.19
Cache-Control: private
Pragma: private
X-UA-Compatible: IE=7
Content-Encoding: gzip
481.............}ks.8....*.......K..wG..8N.sr.....|QQ"%1.D-I......... E..8Sg.^y2.(..h4...n..O/....:=..l...............\........o..f.!..o..Y.O..u..9..e.t.u///...z........jRe...Y5.~.;.O.?.....$.T.i..........DY.....;N0....'@. ......'.{q.:..O.`.u.I.N..j}.GQ|...T .k.?g.E.9..k.......W.Kh....K. .......l...6,..0..........|.EA.ND..S....8.../......^.x.?..x....{........t."L.......K. .{./....I<L..z:.I..,...@@.`..e..q<..../..S.p2......$..`[.9<.'.PEd.@..'..../..:.....g.].....1..$.t...4........I.OS..'..f...%..<.......K.h...O...~.....J.a..^.:......{bszE..t...._..Q.*O.-..o.......f....a/...zO.B..&(.....R.....p{.2..7.$v.>{..|*;r.%b.......i.i.....,...'.G.)..&..'}P..D.E...7.yQt-.&(.f.2."..c......PzI|...H.4..=yL....d......^.x0....ld"..U..V.O.....^^....}/..u.A..1j.^.....O. ..T...CD..&}.%..`...eA...}{.8..Y2..~.....X.....@....x.S.y.q>.r..oy.].8...........P..0...8.....0U...aBbj.G..=.....>...../....q."...:..G.d....h0H5.....h.y..`5...$0U....5...v0......q0....3...k......sM...$....q..:..M ..i`.....zi.`..J........6.O.....yF..`...3#.%...@..A..L.........K5...O.UG..g......v.5<.Q......[c#...Q..GY..f$.^s.'..61.fyG.N..pH.B..N....;.......5....&.../.1...f..=.....8Z.}.NT.^.z.u.z...24f4..0(..R)..O6.../|....Ia...N.q0L..^ATAm.|.....5...#..brMW.....==....^._.}...*.Q0.:W.:. g.z.!.\.......(H.h=....-.i..]..........K@..a...So.|z/...X...H..8*J.:V..%...B..S?.!.d.B.h..zc#.^..U..PT....t.F.o....6.,..zL..!..)..s.^.S./.,z....@.....r.>...?..;V...%./..8..|N/Fq.`.;#.,.4..3.;tF.MOW......V.X...q...U....5H.fC.kE%.....`...V..g."...#P...M.7PcH...
<<< skipped >>>
GET /anger1/head4.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 404 Not Found
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:47 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip
bb..............1..0..w..pv.i...........9.@.....{.ZA.........6u^.g...R$.<....H.vt.Z..(..d.!.CcZ............F)l.....'{........W...*?.>......c....v.@".....p8........!....}..#.|a...G.:..J..\;.....0......
GET /jpg/larme.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:47 GMT
Content-Type: image/jpeg
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 29 Sep 2014 09:09:18 GMT
ETag: W/"542921be-2aee"
Content-Encoding: gzip
2901..............wT.Q..'.....M.UB...... (.H..EA..Di.@.t...H.....W.&.RE.*...}[...{....w..33........f....%...... ...u.....u..|&T.....4.(.BC.....B.aL..0..&..lL.....6v6..$..bb...@r.G...:........@.!.............@b`.?@......v.<........U@T.. i......42.T..........rf..YhX..T!l.v...p...<:...v...wA..{....g..B...".Y..W......x-m.........K.G'g.W7w._?... bD.....1.I.).iO..e...........7465............7>195.~........k...[.{...G?~.........&.K..3.*jj05.?..U...,.4|R.VUCZ;o6~.0:.Zb^m;....w...1.yA.e...h.A......D......,......f.T.....X.._M.Z...-54......i.....RTr..n.. F...D......n..B......f4.M...,1b..k......L..{....Bq."0........z...0....W#.K.....NJ...\|...Z.b...c4]p..(.7?.s...Y......wkY................-g^...d.@.....*5.b4... \eE.jf..3i.E..7.9Z.tc%...efS.*.P[.V^.!>..xv.M..}0.z*.m.CBYDR`6D....,;..L.....pC|..[g^E.. ...[.......F.e%....C....P. ....U./:.D>.K"..!.Xv.[..b6D....3.B#......8.......~..?.2E..qx.Y...hcr#..Q..Q.].s|.!Sk. ...D.......q..FN.D;@.3M..2....0..D...Gq"F/W}..].J..x.8o}.<9.H4.2....%..R.cP...C.c.~.$...n!...N.......`...!.Jki ........A.....k...Lc..7."...Pb.h.Vh2.....M...dK6..........'.......j.F.~X=.el.tY...6.H*6..o..D.t.=N.6...$j=..|4.. hv2.g....*.?...Q...w......f...ng0......%....e..N<(E...>RE...........p.t..F M.)`......[....W..B.tC...U..^q...Tj.T.x..l.@...*8...).d}....Km..1x.-o\I(...D~*4Y.f^.,.....................}...'........G..F...<5u.@Iz._..;a..R.w....w......,JS.. .."k.*...N.)Q..a..)...........FI.....T...b{c...r..e a.S........p3B_.......S*...{.AK...P.W.I....0....*.......W.......%..Z9w..d.l.e<~2.L%
<<< skipped >>>
GET /images/bluefox/gradients/gradient_thead.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.altenen.com/
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.altenen.com
Connection: Keep-Alive
Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0
HTTP/1.1 200 OK
Server: nginx/1.11.5
Date: Fri, 10 Feb 2017 15:45:47 GMT
Content-Type: image/gif
Content-Length: 846
Connection: keep-alive
Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT
ETag: "506e8108-34e"
Accept-Ranges: bytes
GIF89a..'................................................................!!!###&&&))),,,;;;..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,......'... .3`.`......0P..@.....0p.A....0h......$L.I2 .;HTTP/1.1 200 OK..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:47 GMT..Content-Type: image/gif..Content-Length: 846..Connection: keep-alive..Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT..ETag: "506e8108-34e"..Accept-Ranges: bytes..GIF89a..'................................................................!!!###&&&))),,,;;;...........................................................................................................................................................................................................................................................................................................................................................................
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1908:
.text
.text
`.data
`.data
.idata
.idata
@.rsrc
@.rsrc
@.reloc
@.reloc
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
advapi32.dll
advapi32.dll
setupx.dll
setupx.dll
setupapi.dll
setupapi.dll
advpack.dll
advpack.dll
wininit.ini
wininit.ini
Software\Microsoft\Windows\CurrentVersion\App Paths
Software\Microsoft\Windows\CurrentVersion\App Paths
ADMQCMD
ADMQCMD
USRQCMD
USRQCMD
FINISHMSG
FINISHMSG
IXPd.TMP
IXPd.TMP
msdownld.tmp
msdownld.tmp
TMP4351$.TMP
TMP4351$.TMP
wextract.pdb
wextract.pdb
PSSSSSSh
PSSSSSSh
SSSh
SSSh
PSSShp
PSSShp
PSShp
PSShp
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
System\CurrentControlSet\Control\Session Manager\FileRenameOperations
wextract_cleanup%d
wextract_cleanup%d
Command.com /c %s
Command.com /c %s
rundll32.exe %s,InstallHinfSection %s 128 %s
rundll32.exe %s,InstallHinfSection %s 128 %s
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows\CurrentVersion\RunOnce
%s /D:%s
%s /D:%s
PendingFileRenameOperations
PendingFileRenameOperations
SHELL32.DLL
SHELL32.DLL
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\
@Ew.AEw
@Ew.AEw
RegCreateKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyA
RegCloseKey
RegCloseKey
ADVAPI32.dll
ADVAPI32.dll
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
GDI32.dll
GDI32.dll
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
USER32.dll
USER32.dll
_amsg_exit
_amsg_exit
_acmdln
_acmdln
msvcrt.dll
msvcrt.dll
COMCTL32.dll
COMCTL32.dll
Cabinet.dll
Cabinet.dll
VERSION.dll
VERSION.dll
157.exe
157.exe
CARDGE~1.EXE
CARDGE~1.EXE
-p}Pc
-p}Pc
NY.IF
NY.IF
tP:rIAs.Vs!
tP:rIAs.Vs!
@.CV]Q
@.CV]Q
UGA.rK
UGA.rK
-'2_
-'2_
f?%FH
f?%FH
|U.Kz;a
|U.Kz;a
F..YG
F..YG
.hdaou%
.hdaou%
V(8.es[W
V(8.es[W
.AO^l=g
.AO^l=g
6B.vDC>?g
6B.vDC>?g
<.unh>
<.unh>
\.Df]af
\.Df]af
q.tF=
q.tF=
.GTn\
.GTn\
A.bG@
A.bG@
4%Xg3
4%Xg3
.SpCQ
.SpCQ
lOL
lOL
,[P&.nx5
,[P&.nx5
ar,.fu
ar,.fu
}.vZ}
}.vZ}
=VFg.Qo
=VFg.Qo
'^%dr>6
'^%dr>6
=k.rb
=k.rb
%c\ful
%c\ful
4ôz
4ôz
[N%.x
[N%.x
p%Fr5
p%Fr5
'^oZ[%X
'^oZ[%X
%SNku
%SNku
.GIz2
.GIz2
LfuhL%c
LfuhL%c
5.RaUJ
5.RaUJ
.iOJ3
.iOJ3
S.Di?NJ
S.Di?NJ
.TqW)5
.TqW)5
{.OP,
{.OP,
.zhzxaZ
.zhzxaZ
@%cgQk
@%cgQk
rW?%S
rW?%S
f.Nf2
f.Nf2
.NJxg
.NJxg
CRtMH8
CRtMH8
x%s5)VR
x%s5)VR
.tU7e}\gl&
.tU7e}\gl&
&G.SK
&G.SK
t0Up.QU
t0Up.QU
^{X%F
^{X%F
name="Microsoft.Windows.Common-Controls"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
publicKeyToken="6595b64144ccf1df"
Kernel32.dll
Kernel32.dll
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.
CFailed to get disk space information from: %s.
CFailed to get disk space information from: %s.
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?
8Unable to retrieve operating system version information.!Memory allocation request failed.
8Unable to retrieve operating system version information.!Memory allocation request failed.
Filetable full.Ên not change to destination folder.
Filetable full.Ên not change to destination folder.
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.OFalha ao obter informa
Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.OFalha ao obter informa
o em disco de: %s.
o em disco de: %s.
Mensagem do sistema: %s..Um recurso necess
Mensagem do sistema: %s..Um recurso necess
o pode ser encontrado.#Tem certeza de que deseja cancelar?
o pode ser encontrado.#Tem certeza de que deseja cancelar?
o do sistema operacional.'Falha do pedido de aloca
o do sistema operacional.'Falha do pedido de aloca
O arquivo de gabinete (.cab) n
O arquivo de gabinete (.cab) n
vel encontrar uma unidade com %s KB de espa
vel encontrar uma unidade com %s KB de espa
o.NPasta inv
o.NPasta inv
lida. Certifique-se de que a pasta existe e de que permite grava
lida. Certifique-se de que a pasta existe e de que permite grava
o.ZEspecifique uma pasta com um nome de caminho totalmente qualificado ou clique em Cancelar.
o.ZEspecifique uma pasta com um nome de caminho totalmente qualificado ou clique em Cancelar.
!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install
Could not create folder '%s'
Could not create folder '%s'
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.
o da pasta.QN
o da pasta.QN
logo do navegador.RN
logo do navegador.RN
vel carregar Shell32.dll, necess
vel carregar Shell32.dll, necess
)Erro ao criar o processo . Causa: %s7N
)Erro ao criar o processo . Causa: %s7N
suporte para o tamanho do cluster deste sistema..Um recurso necess
suporte para o tamanho do cluster deste sistema..Um recurso necess
rio parece estar corrompido.IA instala
rio parece estar corrompido.IA instala
o requer o Windows 95 ou o Windows NT 4.0 beta 2 ou posterior.
o requer o Windows 95 ou o Windows NT 4.0 beta 2 ou posterior.
Erro ao carregar %smFalha de GetProcAddress() na fun
Erro ao carregar %smFalha de GetProcAddress() na fun
o '%s'. Poss
o '%s'. Poss
o incorreta de advpack.dll est
o incorreta de advpack.dll est
sendo usada.>O Windows 95 ou o Windows NT
sendo usada.>O Windows 95 ou o Windows NT
vel criar a pasta '%s'
vel criar a pasta '%s'
precisa de %s KB de espa
precisa de %s KB de espa
o livre na unidade %s.
o livre na unidade %s.
Error retrieving Windows folder
Error retrieving Windows folder
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.
$Erro ao recuperar a pasta do Windows
$Erro ao recuperar a pasta do Windows
*Desligamento do NT: erro OpenProcessToken./Desligamento do NT: erro AdjustTokenPrivileges.'Desligamento do NT: erro ExitWindowsEx.
*Desligamento do NT: erro OpenProcessToken./Desligamento do NT: erro AdjustTokenPrivileges.'Desligamento do NT: erro ExitWindowsEx.
o em disco insuficiente para arquivo de permuta) ou arquivo de gabinete (.cab) corrompido._As informa
o em disco insuficiente para arquivo de permuta) ou arquivo de gabinete (.cab) corrompido._As informa
es de volume da unidade (%s) n
es de volume da unidade (%s) n
Mensagem do sistema: %s.
Mensagem do sistema: %s.
o e tente novamente.pO programa de instala
o e tente novamente.pO programa de instala
/C: -- Override Install Command defined by author.
/C: -- Override Install Command defined by author.
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?
Could not find the file: %s.
Could not find the file: %s.
pia do pacote '%s' j
pia do pacote '%s' j
sendo executada no sistema. Deseja executar outra c
sendo executada no sistema. Deseja executar outra c
vel encontrar o arquivo: %s.
vel encontrar o arquivo: %s.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.
xito quando executadas por um administrador.
xito quando executadas por um administrador.
(A pasta '%s' n
(A pasta '%s' n
sendo executada no sistema. Apenas uma c
sendo executada no sistema. Apenas uma c
pia pode ser executada de cada vez.PO pacote '%s' n
pia pode ser executada de cada vez.PO pacote '%s' n
o do Windows que est
o do Windows que est
sendo executada.FO pacote '%s' n
sendo executada.FO pacote '%s' n
o do arquivo: %s do sistema.
o do arquivo: %s do sistema.
11.00.9600.16428 (winblue_gdr.131013-1700)
11.00.9600.16428 (winblue_gdr.131013-1700)
WEXTRACT.EXE .MUI
WEXTRACT.EXE .MUI
11.00.9600.16428
11.00.9600.16428
iexplore.exe_1204:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
Bv9.jk
Bv9.jk
Bv.TBv
Bv.TBv
>.uzf
>.uzf
.us;}
.us;}
IEFRAME.dll
IEFRAME.dll
MLANG.dll
MLANG.dll
iertutil.dll
iertutil.dll
urlmon.dll
urlmon.dll
ole32.dll
ole32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
msvcrt.dll
msvcrt.dll
USER32.dll
USER32.dll
KERNEL32.dll
KERNEL32.dll
ADVAPI32.dll
ADVAPI32.dll
RegOpenKeyExW
RegOpenKeyExW
RegCloseKey
RegCloseKey
GetWindowsDirectoryW
GetWindowsDirectoryW
_amsg_exit
_amsg_exit
_wcmdln
_wcmdln
UrlApplySchemeW
UrlApplySchemeW
PathIsURLW
PathIsURLW
UrlCanonicalizeW
UrlCanonicalizeW
UrlCreateFromPathW
UrlCreateFromPathW
iexplore.pdb
iexplore.pdb
KEYW
KEYW
KEYWh
KEYWh
KEYWD
KEYWD
.ENNNG.
.ENNNG.
a.ry.v
a.ry.v
l.igM4
l.igM4
?1%SGf
?1%SGf
xh.JW^
xh.JW^
.97777"7" " " !
.97777"7" " " !
3.... ))
3.... ))
8888888888888
8888888888888
8888888888
8888888888
.lPV)
.lPV)
úW1
úW1
.ApX/
.ApX/
H.ZAf
H.ZAf
ð[U
ð[U
%s!FK
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
888777777
Y.hilkRROMLK=C,
Y.hilkRROMLK=C,
..(((($$
..(((($$
3...((((%
3...((((%
3....(.''$
3....(.''$
3.2...((((%
3.2...((((%
33.2....(,'
33.2....(,'
55323222...
55323222...
(%&'00443445?
(%&'00443445?
00.,,,4(
00.,,,4(
000.,,9(
000.,,9(
0020..9(
0020..9(
003200;(
003200;(
(#'( (''''!'!
(#'( (''''!'!
Microsoft.InternetExplorer.Default
Microsoft.InternetExplorer.Default
user32.dll
user32.dll
Kernel32.DLL
Kernel32.DLL
xfire.exe
xfire.exe
wlmail.exe
wlmail.exe
winamp.exe
winamp.exe
waol.exe
waol.exe
sidebar.exe
sidebar.exe
psocdesigner.exe
psocdesigner.exe
np.exe
np.exe
netscape.exe
netscape.exe
netcaptor.exe
netcaptor.exe
neoplanet.exe
neoplanet.exe
msn.exe
msn.exe
mshtmpad.exe
mshtmpad.exe
mshta.exe
mshta.exe
loader42.exe
loader42.exe
infopath.exe
infopath.exe
iexplore.exe
iexplore.exe
iepreview.exe
iepreview.exe
groove.exe
groove.exe
explorer.exe
explorer.exe
dreamweaver.exe
dreamweaver.exe
contribute.exe
contribute.exe
aol.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
"%s" %s
Kernel32.dll
Kernel32.dll
\AppPatch\sysmain.sdb
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
kernel32.dll
{00000000-0000-0000-0000-000000000000}
{00000000-0000-0000-0000-000000000000}
\\?\Volume
\\?\Volume
shell:%s
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Frame_URLEntered
Imaging_CreateWebPagePreview
Imaging_CreateWebPagePreview
WS_ExecuteQuery
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
IEXPLORE.EXE
Windows
Windows
9.00.8112.16421
9.00.8112.16421
svchost.exe_560:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
msvcrt.dll
msvcrt.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-Core-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
RPCRT4.dll
RPCRT4.dll
ole32.dll
ole32.dll
ntdll.dll
ntdll.dll
_amsg_exit
_amsg_exit
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
GetProcessHeap
GetProcessHeap
svchost.pdb
svchost.pdb
version="5.1.0.0"
version="5.1.0.0"
name="Microsoft.Windows.Services.SvcHost"
name="Microsoft.Windows.Services.SvcHost"
Host Process for Windows Services
Host Process for Windows Services
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\Svchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost
\PIPE\
\PIPE\
Host Process for Windows Services
Host Process for Windows Services
6.1.7600.16385 (win7_rtm.090713-1255)
6.1.7600.16385 (win7_rtm.090713-1255)
svchost.exe
svchost.exe
Windows
Windows
Operating System
Operating System
6.1.7600.16385
6.1.7600.16385
iexplore.exe_1204_rwx_10000000_0004D000:
`.rsrc
`.rsrc
ServerKeyloggerU
ServerKeyloggerU
789:;
789:;
%SERVER%
%SERVER%
URLMON.DLL
URLMON.DLL
shell32.dll
shell32.dll
hXXp://
hXXp://
advapi32.dll
advapi32.dll
kernel32.dll
kernel32.dll
mpr.dll
mpr.dll
version.dll
version.dll
comctl32.dll
comctl32.dll
gdi32.dll
gdi32.dll
opengl32.dll
opengl32.dll
user32.dll
user32.dll
wintrust.dll
wintrust.dll
msimg32.dll
msimg32.dll
3Bv9.jkb
3Bv9.jkb
KWindows
KWindows
TServerKeylogger
TServerKeylogger
??
??
GetWindowsDirectoryW
GetWindowsDirectoryW
RegOpenKeyExW
RegOpenKeyExW
RegCreateKeyW
RegCreateKeyW
RegCloseKey
RegCloseKey
RegOpenKeyExA
RegOpenKeyExA
FindExecutableW
FindExecutableW
ShellExecuteW
ShellExecuteW
SHDeleteKeyW
SHDeleteKeyW
URLDownloadToCacheFileW
URLDownloadToCacheFileW
UnhookWindowsHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SetWindowsHookExW
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardLayout
GetKeyboardLayout
GetKeyState
GetKeyState
GetKeyboardType
GetKeyboardType
GetKeyboardState
GetKeyboardState
FtpPutFileW
FtpPutFileW
FtpSetCurrentDirectoryW
FtpSetCurrentDirectoryW
.idata
.idata
.rdata
.rdata
P.reloc
P.reloc
P.rsrc
P.rsrc
URLDb
URLDb
KERNEL32.DLL
KERNEL32.DLL
ntdll.dll
ntdll.dll
oleaut32.dll
oleaut32.dll
shlwapi.dll
shlwapi.dll
wininet.dll
wininet.dll
x.html
x.html
HKEY_CLASSES_ROOT
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_USERS
HKEY_CURRENT_CONFIG
HKEY_CURRENT_CONFIG
[Execute]
[Execute]
KeyDelBackspace
KeyDelBackspace
.html
.html
XtremeKeylogger
XtremeKeylogger
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
.functions
.functions
icon=shell32.dll,4
icon=shell32.dll,4
shellexecute=
shellexecute=
autorun.inf
autorun.inf
\Microsoft\Windows\
\Microsoft\Windows\
ÞFAULTBROWSER%
ÞFAULTBROWSER%
svchost.exe
svchost.exe
ah-antihacker.ddns.net
ah-antihacker.ddns.net
ftpuser
ftpuser
{OK6VX55B-F46L-LH7W-2D8X-0J27M274717H}
{OK6VX55B-F46L-LH7W-2D8X-0J27M274717H}
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PTF.ftpserver.com
PTF.ftpserver.com
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe
%Program Files%\Internet Explorer\iexplore.exe
%Program Files%\Internet Explorer\iexplore.exe