Gen.Variant.Barys.13489_8af788142e – Adaware

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1908
157.exe:2504
.exe:2996

The Trojan injects its code into the following process(es):

CARDGE~1.EXE:2700
iexplore.exe:1204

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1908 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe (2931 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE (12346 bytes)

The process 157.exe:2504 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (812 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (0 bytes)

The process .exe:2996 makes changes in the file system.

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\x.html (0 bytes)

The process CARDGE~1.EXE:2700 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_important[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MEWP6U2.txt (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400i[1].eot (12626 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_menu[1].js (6412 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (1528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\gradient_tcat[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Big_banner[1].gif (108402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\pid[1] (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\leaksbannerov[1].gif (483124 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\cf.errors.ie[1].css (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (3400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\close[1].gif (428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\51[1].gif (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\larme[1].jpg (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\w3ccss[1].gif (177 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (942 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300[1].eot (5777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\username[1].png (728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HJEFLFIX.txt (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\nav_final[1].gif (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_md5[1].js (213 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\cron[1].htm (3879 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error_icons[1].png (6369 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (3318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav_bg_small[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\gdtmvRl[1].gif (9913 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\cf.errors[1].css (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400[1].eot (9416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\qoEf3sh[1].png (5656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-700[1].eot (4353 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (3346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sa1[1].jpg (5276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head4[1].gif (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (10712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head2[1].gif (2812 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navbits_start[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bg_tile[1].gif (427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\L3Zd0Sx[1].gif (10186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\gradient_thead[1].gif (846 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\cf.common[1].js (1161 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\w3cxhtml[1].gif (175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W2NA5IUV.txt (117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_global[1].js (11653 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\s[1].gif (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\GX1OvJc[1].gif (28385 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (2800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\twitter[1].png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL247F2Y.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jquery.min[1].js (60249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-600[1].eot (8385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\altenen_com[1].htm (4519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head1[1].gif (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\a[1].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\newofurmatn[1].gif (139152 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (1496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yahoo-dom-event[1].js (21224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\connection-min[1].js (7892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head3[1].gif (2338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300i[1].eot (15058 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (624 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P4VFDFXK.txt (246 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1F94CD5CA263ECFB1A4BAB1B832C909 (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navbits_finallink_ltr[1].gif (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\facebook[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\password[1].png (620 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1F94CD5CA263ECFB1A4BAB1B832C909 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F3TFJKIL.txt (279 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (50 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101020161017 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016102820161029 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1908 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"

The process 157.exe:2504 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process .exe:2996 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\XtremeRAT]
"Mutex" = "j0ahKrg"

The process CARDGE~1.EXE:2700 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "CARDGE~1.EXE"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"fdwSupport" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1481593403"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CachePrefix" = ":2017021020170211:"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"ConsoleTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101020161017]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016102820161029]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

MD5	File path
54a47f6b5e09a77e61649109c6a08866	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe
9fdbd7c06b0dbf891f391ae2898f8fe2	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe
ef87d6b587f71d7c2b865fbb27e97fcd	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE
9fdbd7c06b0dbf891f391ae2898f8fe2	c:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe
54a47f6b5e09a77e61649109c6a08866	c:\Windows\System32\InstallDir\svchost.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1908
157.exe:2504
.exe:2996
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe (2931 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE (12346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (812 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_important[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MEWP6U2.txt (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400i[1].eot (12626 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_menu[1].js (6412 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (1528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\gradient_tcat[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Big_banner[1].gif (108402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\pid[1] (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\leaksbannerov[1].gif (483124 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\cf.errors.ie[1].css (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (3400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\close[1].gif (428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\51[1].gif (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\larme[1].jpg (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\w3ccss[1].gif (177 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (942 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300[1].eot (5777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\username[1].png (728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HJEFLFIX.txt (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\nav_final[1].gif (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_md5[1].js (213 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\cron[1].htm (3879 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error_icons[1].png (6369 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (3318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav_bg_small[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\gdtmvRl[1].gif (9913 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\cf.errors[1].css (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400[1].eot (9416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\qoEf3sh[1].png (5656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-700[1].eot (4353 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (3346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sa1[1].jpg (5276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head4[1].gif (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (10712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head2[1].gif (2812 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navbits_start[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bg_tile[1].gif (427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\L3Zd0Sx[1].gif (10186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\gradient_thead[1].gif (846 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\cf.common[1].js (1161 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\w3cxhtml[1].gif (175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W2NA5IUV.txt (117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_global[1].js (11653 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\s[1].gif (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\GX1OvJc[1].gif (28385 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (2800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\twitter[1].png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL247F2Y.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jquery.min[1].js (60249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-600[1].eot (8385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\altenen_com[1].htm (4519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head1[1].gif (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\a[1].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\newofurmatn[1].gif (139152 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (1496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yahoo-dom-event[1].js (21224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\connection-min[1].js (7892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head3[1].gif (2338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300i[1].eot (15058 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (624 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P4VFDFXK.txt (246 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1F94CD5CA263ECFB1A4BAB1B832C909 (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navbits_finallink_ltr[1].gif (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\facebook[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\password[1].png (620 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1F94CD5CA263ECFB1A4BAB1B832C909 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F3TFJKIL.txt (279 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (50 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.16428
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Chinese (Simplified, PRC)

Company Name: Microsoft CorporationProduct Name: Internet ExplorerProduct Version: 11.00.9600.16428Legal Copyright: (c) Microsoft Corporation. All rights reserved.Legal Trademarks: Original Filename: WEXTRACT.EXE .MUIInternal Name: Wextract File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)File Description: Win32 Cabinet Self-Extractor Comments: Language: Chinese (Simplified, PRC)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	26060	26112	4.42567	e9bf1a1e456a9a811b1b86e6602e3636
.data	32768	6796	1024	2.20139	317f8a934ee443eee01c2a315bde9ca1
.idata	40960	4216	4608	3.49941	d8675ba112ef922c6057a02546757a1a
.rsrc	49152	693755	693760	5.50206	38ee6b084cb16031ef7341ab6530e645
.reloc	745472	5038	5120	2.58043	83de2f9b2c95be6fea06bced7e8a058e

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www.altenen.com/	5.254.123.33
hxxp://www.altenen.com/banhammer/pid	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_important.css?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/yui/connection/connection-min.js?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_global.js?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_menu.js?v=389	5.254.123.33
hxxp://leakswith.pro/bannerov/leaksbannerov.gif	104.18.55.132
hxxp://www.altenen.com/images/bluefox/misc/close.gif	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_md5.js?v=389	5.254.123.33
hxxp://www.altenen.com/images/smilies/51.gif	5.254.123.33
hxxp://paysell.bz/Big_banner.gif	104.31.69.21
hxxp://www.altenen.com/images/head1.gif	5.254.123.33
hxxp://www.altenen.com/images/head2.gif	5.254.123.33
hxxp://www.altenen.com/images/head3.gif	5.254.123.33
hxxp://altenens.com/qoEf3sh.png
hxxp://www.altenen.com/images/bluefox/misc/navbits_start.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/navbits_finallink_ltr.gif	5.254.123.33
hxxp://www.altenen.com/images/misc/password.png	5.254.123.33
hxxp://www.altenen.com/jpg/newofurmatn.gif	5.254.123.33
hxxp://www.altenen.com/jpg/GX1OvJc.gif	5.254.123.33
hxxp://www.altenen.com/jpg/L3Zd0Sx.gif	5.254.123.33
hxxp://xslt.alexa.com/site_stats/js/t/a?url=altenen.com	54.192.129.104
hxxp://www.altenen.com/images/bluefox/misc/w3cxhtml.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/w3ccss.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/nav_final.gif	5.254.123.33
hxxp://www.altenen.com/images/misc/username.png	5.254.123.33
hxxp://www.altenen.com/images/head4.gif	5.254.123.33
hxxp://www.altenen.com/jpg/twitter.png	5.254.123.33
hxxp://www.altenen.com/jpg/facebook.png	5.254.123.33
hxxp://www.altenen.com/jpg/sa1.jpg	5.254.123.33
hxxp://www.altenen.com/cron.php?rand=1486741283	5.254.123.33
hxxp://www.altenen.com/jpg/gdtmvRl.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/bg_tile.gif	5.254.123.33
hxxp://www.altenen.com/anger1/head4.gif	5.254.123.33
hxxp://www.altenen.com/danger1/head4.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/nav_bg_small.gif	5.254.123.33
hxxp://www.altenen.com/jpg/larme.jpg	5.254.123.33
hxxp://www.altenen.com/images/bluefox/gradients/gradient_tcat.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/nav.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/gradients/gradient_thead.gif	5.254.123.33
hxxp://xsltcache.alexa.com/site_stats/gif/t/a/YWx0ZW5lbi5jb20=/s.gif	54.164.75.60
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4=
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0=
hxxp://a692.d.akamai.net/certs/ca.crt
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4=
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J
hxxp://altenens.com/register
hxxp://a36.d.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs=
hxxp://a36.d.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://altenens.com/cdn-cgi/styles/cf.errors.css
hxxp://altenens.com/cdn-cgi/styles/cf.errors.ie.css
hxxp://altenens.com/cdn-cgi/scripts/jquery.min.js
hxxp://altenens.com/cdn-cgi/scripts/cf.common.js
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-300.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-400.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-600.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-700.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-400i.eot
hxxp://altenens.com/cdn-cgi/images/error_icons.png
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-300i.eot
hxxp://a767.dspw65.akamai.net/pki/crl/products/WinPCA.crl
hxxp://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J	178.255.83.1
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-700.eot	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/scripts/jquery.min.js	104.27.141.154
hxxp://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg=	212.30.134.177
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-400.eot	104.27.141.154
hxxp://aia.startssl.com/certs/ca.crt	173.223.11.161
hxxp://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4=	178.255.83.1
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.46.123.27
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-600.eot	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/styles/cf.errors.css	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-400i.eot	104.27.141.154
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	80.231.122.161
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	216.58.214.206
hxxp://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs=	212.30.134.177
hxxp://www.altenens.com/qoEf3sh.png	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/images/error_icons.png	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/styles/cf.errors.ie.css	104.27.141.154
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx	104.16.28.216
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-300i.eot	104.27.141.154
hxxp://www.altenens.com/register	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/scripts/cf.common.js	104.27.141.154
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	212.30.134.166
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	216.58.214.206
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-300.eot	104.27.141.154
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0=	178.255.83.1
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4=	178.255.83.1
donald-trump.party	104.24.102.24
s29.postimg.org	163.47.178.206
s11.postimg.org	163.47.178.206
redspider.cc	104.27.144.39
ah-antihacker.ddns.net	177.86.90.37
s24.postimg.org	163.47.178.204
sync.1dmp.io	136.243.44.222
s23.postimg.org	163.47.178.201
s28.postimg.org	163.47.178.204

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 10 Feb 2017 15:42:06 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:36 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: CD4E411028F5966AE35940E7A80D2D957332E76F

Cache-Control: max-age=333546,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 312

Connection: close

Content-Type: application/ocsp-response

0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..20170207123043Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y..[%.i..&Uf.9...T.....20170207123043Z....20170214123043Z0...*.H.=....g.0d.0...`..,3l.s.zT.M...h..&.F........C^..jdu..e..\.G.0H.dD$nk..Z.E.!.b.!.O.2.Y.<......]8M.c.{r.d..-.....

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=df3f71f4af9a46c9174e52993b6138dcb1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6ad28b59b4-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=df3f71f4af9a46c9174e52993b6138dcb1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b32c059b4-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /site_stats/gif/t/a/YWx0ZW5lbi5jb20=/s.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xsltcache.alexa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Age: 69

Cache-Control: public

Content-Type: image/gif

Date: Fri, 10 Feb 2017 15:40:16 GMT

ETag: "10-Feb-17"

Expires: Sat, 11 Feb 2017 15:40:16 GMT

Last-Modified: Fri, 10 Feb 2017 00:00:00 GMT

Server: Apache-Coyote/1.1

Via: 1.0 ip-172-30-44-237 (squid/3.1.23)

X-Cache: HIT from ip-172-30-44-237

X-Cache-Lookup: HIT from ip-172-30-44-237:80

Content-Length: 2860

Connection: keep-alive

GIF89ax.A.....................................................................................................................................{{.{{.zz{............||..........{{{............||.{{|......||......................|||......}}......................||}...}}................}}............................~~.}}}.................................}}~........................~~...............................~~~..................~~..........................................................................................................................................................................................................................................................................................................................................................,....x.A........H......*\.......H.H.....3j.......?..I..I..O.\.........8@&M.....h.....aJ<p......HD.4.N.......d..@/...@...=k..;.)..3.X..UkJ.].|..s.Q.D...9`*A.Du2.H`...f%.U.W.....,h.@.....68.u...s........lQc..`.Q..(&......g#...@...U..................q>.(..D.=.2..u....(.O.>.-W..k.....s..._LLYm..9#oG.9;z...'.T...^j.E..x.%.._I...w.eGT...g........$p V.Bx.k.!..D=...f.< .~rUX.....V....bR#...k...Sa.e..z.........T)vf^.Xf...Zv.%q^.. ..A ..*.Y..h.9.......tny..s..'...........s.*..|.ZgEp..g.......V.i..f.(E......R.i..Z....r.%.........yj..j.f....'....'....*...k...&[^..6....F ...Vk...^ ...v..... ....k.... ......... ....k.... .........,....l.....o..7......p..Wl....T...w... .,..$.l..&.d..,....0.,..4.l..6C...<....@.-..D.m4.:...v.4.t.N?.t......TW....a.

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Cache-Control: max-age = 86408

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT

If-None-Match: "8017f9a85f10d21:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.download.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Sat, 12 Nov 2016 01:34:12 GMT

Accept-Ranges: bytes

ETag: "02e4de843cd21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50939

Date: Fri, 10 Feb 2017 15:41:41 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2

MSCF............,...................I.................kI;. .authroot.stl.6....7..CK...<.[.........].y.Q..YKv..%k.....!..H!.Q.-..$tU$.)7k..R.=...n3......}?...3gf......h<.2...4.(q..f......&{.`....02.s...2@`.J.<#..q..0Xy%.4..egd.:M.B....in.([....W....(.|.....|....s!..Mo..@......|"(n;Z..'~DE.}(........Mz:T....x..{..n.`z..-.\.............q....ld2z..N/.b.J...........X.S.:UN.S.v."..'l........:yz.<."!.]O..6.:d.....C.P ....P($.Y.Q y..y..B....u.`...u.00.....|(..A.J.Cp.c...X..g.........}..'........D.QVFf0...D...a6.f.0.....k.*8...<.;..o...(.....f...L.0..C.......I.A!.H.....'._)....Qc.V.....5D..,..d../(..j.F.d.....`..f...$>:_%.W..(....@.r.9..Ob.e.$..m.~.]....g.......%`e_..&Qhp .......ey.c.....H`.%<9.......#.\S...R.5....v.......dWE.....:...../"3.._..l.XiH.J!..............{.5C_...i.U....7....;p....Q.`....L.j........u....b.`:Mk.L.......*..@M^m..Jv...g........<d:l..Kq.X...*y...x1.u....... .....z.....c.(<.b...l.#....,z~..M.Y.]..Z....F..N./..[.#....Ol...f.k........U.rF)D....3..sK...`..W.....5.=.@#a....!./....>...g.(. ..9..>!.K..e..j..{x.0.^,...U9..ru.C......,..q^1.G..A.e.F[...".1..*...^...L..#:,7...:.z.n...fI1.....l..E.q>......E...x n....H....t....5.....\...<.l....7}.`\..~_..#..Bz....i..[{.w.....a...c....E w?..6..l......x8..H....7.e.;.%.:.!.*Q....#..bT.......(....ka.......B..|.........1....t.r...fk....C.t`....@3.P..*t..nmD.....8$.bd..`D...5X.....H..L../1:..Ap...w.\...,..U..../"X......}X...a...G....N.X..<....MG....r..H....._@..Q2..T...Q.....].e.G./.v,.Z5ib..5........9 ............z..!...g

<<< skipped >>>

GET /clientscript/vbulletin_global.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-659e"

Content-Encoding: gzip

1faa.............<kw.F.......F.2.O.`..$`fv..c'.=.p.j.2 .I....t......-...&'c.~TWWW...u.........6......j...U.q.........S.g^x....V....}...Y..O[...i...2.E.Xga..V.]4m........./4.....9..y......-..Z.g...%4..,.'...5.y;..E...p.........O.............|........em....]|.\........<.V........D..9.......E8.QJ..l.(@.E.:.......k..6......R .fs$...aB'..........?.E.....Y.3b....o.]..s.'...$....SX......{.\..,.. ....x..%.?.`..#..%..kVI.<R<a.Q.:N.D .[...!.\.h....FX...kp..F..:."....v.E.....w.>....md. ._.....m...z.F4 ..t.........../?...Q...WAQ.....j..)-`..R.....$.....7. .q?..8..6..vO..?.qF.s?I.k..RV..g4.o..i..e..qBg.ne..._....2..dM;Eo...oc/^..,....57!.].I6F..#.1.......l|....3..=..V...q........Si.e.,~.......i..xE..6......I....o.....M._.Z....0S.@Avc..`0kz... ...G.q;o..*..C...u.H.$_`l.. .....2...N..q....c^.J_U".Z..i.#..^.._..).....X!..8......).p.b..)*.Os. .....P......_.." ..BMeh ......BJ.E.Q...Z.J..(a"e.2...IB.:.U....O.I...`.rN.>.......^...fM.QY...y.ri....f.$.0...._1.0........N.q2L....."cb...a-....2..O_}G..z...8>.NQ^.O.....o4.A..{*.{.....c>..RL9.|.3.1D....=k. .7..k.[...y}......L........aU.HY .T<.e96.y..Y...~..zgn.k4.......^.=.....bF.v ..].l:...?.438..x.^"..h._P|t...9...CoN7...X.... g..........<.".Q|...S..Y...k3)..TtP>.X0W.N.._......*....J..'Y...&....Ey...*.5f..ON.).Yn..o...hL...9.....9Bo......b-..V.........)*[.Hj >...f..s....9.w..p.D(Y(.`D:...g..#.>.......X.&.2l>...0..' `.-....^.~..7."....?M.T.....qm.P...~...........u.6...X..}.\..lL....pw.....0.l...s.$..@?e5.......F.......:r\4K..i6.. ..9..8..s0.`.U.

<<< skipped >>>

GET /clientscript/vbulletin_md5.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

;.C=x.._=#...E..........o.oG........F..0.a.a}X...f.....hX.....?..>d........}.!..v....@.P.....v...)..!~......Zu...E.......V.Y;?.\..'.].g....G.L..'..A=s...?..h.I..{.(?R8.......Uo..}...W..].5...;..e5k...Ry....^..0T.#.:O[Goe...~..).....z...}....O....>.o..EZ..&.ry5.7Q..??..AF..,.........C.....dir..=.A;.i../n..W...B......aX..e......J.U_=.."h..T.6yQ.......&./....n._..`.w....l.e.......b@....._.......o.x.....B.............?...............<..l.....-...].7..>~......ko.h..'. l.x].Q....-.~..[{...U...m..D......."l_..D.x.r*v...._..`........U...zjo....~_..x'.f.........-....bS.4...t$. .`...]{......1...}k.....v.....x..{....D{....l....53../.....-<..._.v...O..[...ZY.7&.;.Q1w............"..b....aC.{@..c...i......jH....!.N;..g...........d.\.?......9./...~..Z./?.oo'.[X....OV..)B..4...y.ZC{..D....,....R....>L.8...o6p.C.7..%..Z...w...!j..7.....?4EwXX.....0....

..

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d88f945ee8f86b78537fbfe644b73f56a1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b10ca5954-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /certs/ca.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: aia.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/x-x509-ca-cert

Content-Length: 1997

Last-Modified: Fri, 18 Dec 2015 11:03:49 GMT

ETag: "5673e815-7cd"

Accept-Ranges: bytes

Date: Fri, 10 Feb 2017 15:41:36 GMT

Connection: keep-alive

0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0.."0...*.H.............0.............lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.......,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.........`.g:........r".................\R<...*s......`.z/...n.&0.....W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U........0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.startcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startcom.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.pdf0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at hXXp://cert.startcom.org/policy.pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[

<<< skipped >>>

GET /site_stats/js/t/a?url=altenen.com HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xslt.alexa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 3153

Connection: keep-alive

Date: Wed, 26 Oct 2016 15:41:31 GMT

Last-Modified: Sat, 11 Dec 2010 00:35:34 GMT

ETag: "f4022b30d2ad8a3755b6e53f31c63252"

x-amz-meta-s3fox-filesize: 3153

x-amz-meta-s3fox-modifiedtime: 1291757166000

Accept-Ranges: bytes

Server: AmazonS3

Age: 4865

X-Cache: Hit from cloudfront

Via: 1.1 c722429a8af7d9f02db581c7256a2bef.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bqeDJQuhbICRtFFNrkOBZXEioTG509zu6NvAyIlPYNwsEInTm2oXKg==

function AlexaSiteStatsWidget(){. var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /=";. var jsUrlRegex = /http:\/\/xslt.alexa.com\/site_stats\/js\/(.)\/(.).*(?:[\?&]|&)url=([^\?&]*)/i;. var jsAmznIdRegex = /http:\/\/xslt.alexa.com\/site_stats\/js\/.*[\?&]amzn_id=([^\?&]*)/i;. var imageSrcPrefix = "http://xsltcache.alexa.com/site_stats/gif/";. var detailURLPrefix = "http://VVV.alexa.com/data/details/main";.. this.replaceScripts = function replaceScripts(){. var scriptElements = document.getElementsByTagName("script");. var thisScript = scriptElements[scriptElements.length - 1];. var scriptSource = thisScript.src;. if(scriptSource != null){. var urlMatched = scriptSource.match(jsUrlRegex);. var decodedURL = decodeURIComponent(urlMatched[3]);. if(urlMatched != null){. var associatedMatched = scriptSource.match(jsAmznIdRegex);. var base64EncodedURL = encode64(decodedURL);. var imageURL = imageSrcPrefix urlMatched[1] "/" urlMatched[2] "/" . base64EncodedURL "/s.gif";. var img = new Image();. var fullURL = getFullURL(decodedURL);. img.src = imageURL;. img.setAttribute('border', '0');. if(urlMatched[1] == "s"). img.alt = "Alexa Certified Traffic Ranking for " decodedURL;. else. img.alt = "Alexa Certi

<<< skipped >>>

GET /qoEf3sh.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:39 GMT

Content-Type: image/png

Content-Length: 26299

Connection: keep-alive

Set-Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.altenens.com; HttpOnly

CF-Cached-On: Tue, 07 Feb 2017 22:28:49 GMT

CF-RAY: 32f0aa40f29759fc-VIE

CF-Cache-Status: STALE

Expires: Fri, 10 Feb 2017 19:41:39 GMT

Cache-Control: public, max-age=14400

Accept-Ranges: bytes

Server: cloudflare-nginx

.PNG........IHDR.......@.....}o......gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs...#...#.x.?v..e.IDATx...w.\e...g.e7....e.HH......A.)^..,..Q..k.z-..r...z.^..E...P:.!,.@H...l......y...df........u^[f..9.y...._........$..@30..e....d.......z...3?k........@....e~..v.......t....,...j.O.2.....(..y....I..,..6.A....:j.t9.".^s..6#rY...^.:..u..1.D.1.D..<j.q$.q,..#.....&$Y...Hb.........@.....K2.CL(..!..........,E.....D.y..J....c...3.V.?&..#..pT.Raf.......#.i.@F3\D0....C.....^...&|..Ã$2../'#).X`.2.....B........$...\B..<AC.C"5..r.p>p*0.p.?..4..<...o............0$.....H.,d\m...E...R..n.nC....X*..P*..D..q..8..4-...Q.AD&..7!......J!&.2."...t.b.eH..U..a.. . ....b[K...J.`..$.....H.W............V.....1.....L.^...yl..}mc.....Y..........D..d.p.".....#\..$.k.w(..Ki..J...d6.Z.2..F..Y.......k.Z..K......2.......\........q..~.r.b.P.....X.h'....A.x1..4R.......\.bB..K.....x;Rub....w..F.,qRb....O.2.....!;I....cD.H.pQ.[.*......k.N.iLFu\.F2............5..z.::6T{..BL(#.Ro.G.....M5..D.L...Y?....3=.O.z..i.I...;=.....o...Y...A=.)..6....f.{.9.....T....w rg.E..".X...,7..H....."..b.I...ZVr ....c'...4.>.Y...#..t..i.j&7...:N..h.Hb..{.9.X?..V...&..:s.........X.*.m@e1w....AFV2...J.X........8L..H!.c/".-ham#C.[...Ax.....%Y. .....NE5ef..wIT.j....#.?..4R.:...9.I.s...H.2~..J...4.o.>....5E....EF...v..(yo3.....t..OC......)LC.1...1.I.^Q.Bb.\.2.G.qW .x.I.[....<r!&..,..'P...j_WH..F..&<..v.5hg.Hc..L.nXK..C..3.Q.E...".hEd.b.W..O#r\..Q...Ad...6&.#.bBa...t...L<6.....B.ZT..a.F..Nd`....

<<< skipped >>>

GET /register HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 522 Origin Connection Time-out

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Frame-Options: SAMEORIGIN

Server: cloudflare-nginx

CF-RAY: 32f0aad1818c59fc-VIE

1734..<!DOCTYPE html>.... <html class="no-js" lang="en-US"> .<head>.<meta http-equiv="refresh" content="0">..<meta http-equiv="set-cookie" content="cf_use_ob=80; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">..<meta http-equiv="set-cookie" content="cf_ob_info=522:32f0aad1818c59fc:VIE; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">...<title>VVV.altenens.com | 522: Connection timed out</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />..<style type="text/css">body{margin:0;padding:0}</style>.<!--[if lte IE 9]><script type="text/javascript"

<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/css

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-6eeb"

Server: cloudflare-nginx

CF-RAY: 32f0ab8da2cb59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

1313.............=k.....E..`...GO...\.r.!....|....D...DE.n.....>$.)...,n.XX|...bU.......?..^.....w......wP...h{.}/...M.......... xj.l.7...Y^...}....d\....jA..q..!.....g...a\......n%t.v.hw_.O..<...w .v_>.r....>..}..;.W|8L........vM..[.}9~$..HK.K..E>.l_...~..V.%..K...s.m....,y.....,Qy..c_...Y.qg.fV......uB..2.......y..7.6...sq;..?.9.gg.m..{.7po.6.mU...s.....p...3.. ]Bg!.... .{/VRx...N~.3.|...!.7..w..u...Wm.....;.2y. .7.2.Xif.....6..a......7rC....r[.r.e/?...\....=..I8..5d.z...Tw.Wr..:(c.!.v....\~.....T.k..y.......Nz.....2........x4m...}#o...J..d...................\Y.tlp_.M])...O.....P).N.....x..L.B.[..Yn.U/5T@.$...3..X^..]..#....{dQjA).oa.1.-A!...@..5...M.....{..,A.]i....^..N..N&{GDPn9)..(Sd....2...R....].T.<G.q.<.q..f..3e...lP.......A.......a..@...p..^ 1e..A...n.ZX.........Af..N..dJ...n..(.F.c.q.Q[....Zji....g..............l.t.e-..^.d..2y.5N. h..l.:..&...Q.d..`..>x....Q%..|...#.}.........$.&....j5n.....t..2.b.S.C......T.7.U9<....O..p.........q....*w...../.x.DCW.. P..G......L...,t.U.O......c2..D.u....dd.<.._...u~.j...'...lK.q..D.f....8\...q<....;.h...(.ha...Q.Y.e..g..U......*........CK.k...4p..#........R..0.>..lR..M..)... =.l.@i...W....k8.....s.D"@....g.....~_.....~....IZ.E..$b..D`.Q..BZ....f.2.....9.^.5.V..r.K.*.}...`yw.l`....#a...;.......>..Q.M.m...... .p..0.;5...g....].....l.i}v..E0....-..t....G..m...n..h=.wjW.Y9./..M^.g..f~...t.L.N..*W.U....6*.N..av...d......w*..g......|..:..-H.d...i;...LZ\..W....f..]M.......]A.i...M).e>....3Vq./.V..k.9.1.>n63.........}..N.5J....M..

<<< skipped >>>

GET /cdn-cgi/scripts/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/javascript

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-17bdc"

Server: cloudflare-nginx

CF-RAY: 32f0ab8de30759fc-VIE

Expires: Sun, 12 Feb 2017 15:42:17 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

500a..............i..F...}~E....b.E.v.1.,.,.m....n..R....Q$...Z.....8'.$@Pr..{..7.*bI....9.OG..........t.l.....b..~Q.......h..o......m... ..^..(.-bH.q..G...E\;.....L/ver...{..T<...>..[..I...DQ....hF.. .....MB.uU._....uU.....W..6...._..ER._....._./...D}[.........s[$"...8#]].} ..z..h..w...Y...Uy*X<=@w.....,b^......aM.,..E"..Oi........|SWy.....k~.....*.....-$.1G..C....j..D1M.i^.5.9..]..........b..b..7..'........arIo.........".YN....i].}...K~..9..dVL.UY..{.QN..G..8..m\.._.....t...EV......U....m....o...=9.L..)..~.....fW<..!...T.........F.M..M'K.......2.I.V.<By;}..J.}.s.... m-............>.7X...Hw|?...3..........hl.s....0..9R......XL.~.}..Se8...A.W..\.....#...&.........F..l....e..L_..._...FWq........ ."9.J3XMs:.r>..=.U..S...=v[<..GZL.C-...JS.Vy..N...*hJ3f:1.....H.lN...n.5...).cQYn./.]3s]..e...*.....m6k.b......H.x.{<..f....er..'.......(O=..<.)...Wr....p.....L.O6b,.....@.?ly^.~.b(.VS~........./b.9M.w..%'..Q..s;/|.x.P<.}.].....we.\.Tm0IL...........I.....{....^O x....Vb........3.8.....O.....p.t.p.$.u\.....G.....w.#.1VLa.1..5>....4..pxs.....:.g..g.O..._|w..U..,RHk.*Ow...?..&{^......^D.. 6.l_...;9..Y...`~q.r....kk..|..A..e0...i..(.......B...I[R].........6r.....;.zc...}...?...S.-...:^{f....P..../.....t...ED.n.S[.{.X.4V.#....;c<.c..Ov..Fk*..A.^.....i_.?.l[F|...o.B#...:..|.E.u=>.."~.W...fqD..T......A b..[.1....B.Sgw.8.......D|.w....#g.......u.My............4a3....\.0V1.j{_.W.".{l.Z..gB.....IT..9..A\......=...BO.o....`...*a{..c#z$.E.FM...V^.qx..l.$..SL..........?...)'..G...e....&...R.k

<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-400.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-4b10"

Server: cloudflare-nginx

CF-RAY: 32f0ab8ee3c759fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

4980...............P.@..9....>...............<....A.[....H.....wo...........V...... ...... .""<......2...d...O `....d...)..@.c....../..P.x.l.n..@.`.p.x...L....`.....,.^............G......`.p.8..o............A...@...m.;w.4..@.f$}....JV.c.`8.S}..q?.......~i.i..>....!V.7SMV\.O..s.|..p...M.M._.L;. i...Y.|2.2./E[ri].;.^{....&.'b...b.].%....YS~...U....E.}*0"%sZB..0t.:.ZI......h.....^.....^..%R........5..53...%...a...y..P}.}T..'.3.z..X.i:B....{..i.]2K.h.a.NS.n\..@.@A.7........'...a-..].....2[e...,..].`.....vNB.....(,..S.g[..\4_...[....M..f.Ij.Q.....!...G..P.....v..bQ.<.i..U..t.......P!..hP@..E4.$ ..p..D..8...&......!a.8{xk..D-........v.N.........3.!b...31N.....L..S...v.0.p.NR6...D...............7i8o.6....@......V.-)J.h....v.#.O.. ......p4...L/..].....0...!.~..c..F..D-,F..c..:..F..n#..;...Q4..;..|:M.f.-..j..T...s. {W1..'..j>b......,._....b.. T....#_4.....V.=i.i.w%n......op..EfDeQ.^.f...w..t...*.....P.Xuu. t.u...6......... .u|p&... ..]....s..B...}...6....q..#`.....=&..I!G....m..h.ZC.&m...;.....%Y..-.I....Ws]@.....rlmos\s..AN1t..`. ..:3...RCT6lT,....6....Z1.0..q.F..).&2.N0.9......./....*....T...N.<....Y.9.s.\dM;...2..{.&.B...-.....V..B.mBN....x.......d...).u........._....p..j....p"...j.e.fcW.p"..`~.......7IS@l...q..$........;!...d._`..h....(Z....f.$...:tG..Moh.3.&%4....<....>..iq.i...t.{!..A.#'./.l....@.......HZ=..<...M.. ......-....W.:.G...$...=$eZ..f.T...w..(........?..S>......Bj..T..;u..^.8QLV{.L0..|.p...........|.q.n....$..........r..EKS.......w8.u>.(......D...!..f.u..M1.T........%

<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-600.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-4b8b"

Server: cloudflare-nginx

CF-RAY: 32f0ab8f742259fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

4b6f..............SX%...7.......m7....m..lL.....&.....:....97..Y.f...W..2.......... TD.0..........8......kL..`.........`.~f...-@.......(...K. ....-..........6..........|...K.'........O......?{..;......x..............?..v...o.K ...g.,n.bM..A.C..?...' G..I..>.......].t.&B.....j;...F....nX....B.......v..Q...(.7....[..u>.eb.......Y.^...u.@0?.i..9..?.|]...[......9..g...2..l..../!.T......=Cjn..F..S..T....._..^0s.."..I ......x........j...b.X...'....O 8...<....]......]...b*...Zi2[7.....aZ.........?d.jN$.m&...-3.....{..\..R......@...M.u.lO.\....eH.D.r..X.-...(. ..*...P.....A..d...Ak.=4..M.mo....'q...@J;.`b.]N..."C....%...2?'..lDom..z...2Lk..3@.4........Q....Z. .*@B...g9i=K.&.......I.B.NI..@.A..`;.......GD.T..x..........4r..YR...p'0...lq*...k..(..W.j.wR.....&'.G..FJ..p.*e0.5..._.......o...KB.f%......... ..]..4.......`.........`X:ftn..@voR.2.&4.D.Tr......\...J..?7.,Q.*4.@..%..G..V.x.._....D.l.5f........X.......g...Q.....Lj......5.v...."..... ..K..z.W...9?....L}...)aHoZ1.B.F......[f.4.....L.IZW..[... j.N....1.@JO.R<b_E..\.h..K..^j.....8#...5.......zzO...k....Ki0....\.5.!....=....;`t.......`......Gi.n.Dd.....@0...I.Q~*..#.....l.....Q.W.'.)f`q...O.7..1...M@]..n^...$|..,."...4.E....!..f*d@........e.&w......(n...)n...mgq..C.m&.L.k...?.7Y..L...W...a..?...A....s0.u................m.B.'......U{.:t..(f.>a}`.....<U&.$......T..?..T....s_......j....G`.Q.>.>...5...u{7..S..\.c(fAB..S#.../..._..wJ..".....I..Q.Om..|.Nw. .Q.KT.SQ.3..u.:.2A.....e....=.....v[......-... ...y......n..fY,..mO.V.!..._..........M../5....6

<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-400i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-52dc"

Server: cloudflare-nginx

CF-RAY: 32f0ab90148c59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

400a............l.UX...dC.nA.....ww..w.b......;..ww .?..K..~..vw..........u.. ...... .22"....! $#.. .../ `..5......!...w.............-..@...X............X.\...k..@.0.......G......8.<.n..@..Y...>. ....?.......~..(...o.g............Z}Q/v.L~....6......-|*...@~\MA..blu.EV..{.Fc.}.a.....Y7....3(zk.5.Ki.....o2...k.Y..g.A...u[.p%.Y..%...K..x...T...DTM.96j....b.P[`.:..@.K.u...r..R2i...h..Q4.c.kfg].&E.X......K.r&..8X..........-\(.<..?O........!.<.~....x...A..0......h.A.k....hI..'.f....JKWmD......THkHdF5$....sI../..........a..0.!_.f.q.)..B.?...=....g...z......Q.-..0.L....v.R.h.....?...*.%*.di..Z..s........F.{...!5.M.|[...!4 ..:.Ã¶../.)f........9.2B............M.y.g...<%...DF."38..y `<...7.;..yo...S"..c=.........d.I.cY..<......K......[......r.o....H.XB...qSn.s..........!....?@.a....y......D.$.o.d...b..&..Q...k.f...3tda-......%.....em9.J......-&..:..r%.......s.%.....M|....I.!/<'.|=.k.i:Op6W..e.O..x...W...n...%yV.nl..._......U...'~D.....**...PV'*)wL.L.jd..Bh...$...H..':#../rX.*.... ..'...Q..*E...p!2..&..e8..p,..?..`Es|.X........a`..[...7E.....|.A].'xs..E~..5..;9nu/....... {.........;L.=......\.g.o.M.\..Jz.^$i'V....4.........q.I#=a...F..',i...D~.....)..u....f&}..F.T.;?."..g..1)%<.W=.m;....K..........T.1%.G..[I......aBD...%/.P..@.8Z...,".....{..Y.9K#..h5..m....W.o.9.......0.`..0C....o|`';.!z...........5|8../m.Tn. .bQ.X...n..A..........E..............=......)...J...\.t.p...F,.3...23#|...*...*......G..I....:... -....Yd(P......T.a..h.,.R/.!.....).t...^..f'../..._....C..0.L..{....i......b.o.PK..$...p

<<< skipped >>>

GET /register HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 522 Origin Connection Time-out

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Frame-Options: SAMEORIGIN

Server: cloudflare-nginx

CF-RAY: 32f0ab90c51159fc-VIE

1691..<!DOCTYPE html>.... <html class="no-js" lang="en-US"> .<head>...<meta http-equiv="set-cookie" content="cf_use_ob=0; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">...<title>VVV.altenens.com | 522: Connection timed out</title>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1" />.<meta name="robots" content="noindex, nofollow" />.<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection" />..<style type="text/css">body{margin:0;padding:0}</style>..<script type="text/javascript" src="/cdn-cgi/scripts/zepto.min

<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.ie.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-d65"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:17 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-d65"

Server: cloudflare-nginx

CF-RAY: 32f0ab92761f59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/scripts/cf.common.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-1138"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-1138"

Server: cloudflare-nginx

CF-RAY: 32f0ab92a63859fc-VIE

Expires: Sun, 12 Feb 2017 15:42:18 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/styles/fonts/opensans-400.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-4b10"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4b10"

Server: cloudflare-nginx

CF-RAY: 32f0ab93067d59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/styles/fonts/opensans-600.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-4b8b"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4b8b"

Server: cloudflare-nginx

CF-RAY: 32f0ab9376b559fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/styles/fonts/opensans-300i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-53af"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-53af"

Server: cloudflare-nginx

CF-RAY: 32f0ab93c6e059fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/images/error_icons.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: "589b19f3-4177"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4177"

Server: cloudflare-nginx

CF-RAY: 32f0ab94070459fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

HTTP/1.1 304 Not Modified..Date: Fri, 10 Feb 2017 15:42:18 GMT..Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT..Connection: keep-alive..ETag: "589b19f3-4177"..Server: cloudflare-nginx..CF-RAY: 32f0ab94070459fc-VIE..Expires: Fri, 10 Feb 2017 17:42:18 GMT..Cache-Control: public, max-age=7200..X-Frame-Options: SAMEORIGIN..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:36 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: CD4E411028F5966AE35940E7A80D2D957332E76F

Cache-Control: max-age=333546,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 312

Connection: close

Content-Type: application/ocsp-response

0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..20170207123043Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y..[%.i..&Uf.9...T.....20170207123043Z....20170214123043Z0...*.H.=....g.0d.0...`..,3l.s.zT.M...h..&.F........C^..jdu..e..\.G.0H.dD$nk..Z.E.!.b.!.O.2.Y.<......]8M.c.{r.d..-.....

GET / HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: BHC=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT

X-FireWall-Protection: True

Content-Encoding: gzip

1b1.............R...0... .:,...N),]Y)....tais(...{...%W..,%..Q.'..[.0....i..t..y.Q5.....k..U.........Z.c..,../........."...`.h...*.....?x..k.G.u.Vu8...f.....hX.j....%N...D..6.#w1x.6........CGX^..J...2`R.nz.1......M.....\.P.......R0.v.x..P.).TGmy..)j...t...$p~..aX...t6.......T....g.._.....0.(...f.........y.0w....!...V...h.O..5...c~NL)_.....<u.A.We9.... ...\.&..`..H..........<h.kI;....Iz.....KvI.^).U../z......g...%.*.)..}..]._.....d......0......

GET /banhammer/pid HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.altenen.com/

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/octet-stream

Transfer-Encoding: chunked

Connection: keep-alive

2e..JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054...0..HTTP/1.1 200 OK..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:45 GMT..Content-Type: application/octet-stream..Transfer-Encoding: chunked..Connection: keep-alive..2e..JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054...0......

GET / HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: BHC=JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054_

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: text/html; charset=ISO-8859-1

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: BHC=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT

X-Powered-By: PHP/5.6.19

Set-Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; path=/; HttpOnly

Set-Cookie: bblastvisit=1486741283; expires=Sat, 10-Feb-2018 15:41:23 GMT; Max-Age=31536000; path=/

Set-Cookie: bblastactivity=0; expires=Sat, 10-Feb-2018 15:41:23 GMT; Max-Age=31536000; path=/

Cache-Control: private

Pragma: private

X-UA-Compatible: IE=7

Content-Encoding: gzip

ebf.............].w.6.......e..vk.z.......$.7.o....E..)..%.$.G........)J~....s...)`0...3.....G...?...Q6.....oN..Ss.....{t~$........7.y.M.0.......;G8.,......e..]...{..."XM..>.2.f..|g.......8....8....Y..~.t.(K..y.a..&.@...h.d..x...$q/.RG..I.L..3....\...(./.....z-.}.^t.CY.v~=...Yp........$..........N.i.....I.xY.<M../fQ.d.D.....Y......2N|.k/.....^...u....F.#..%H...0......c/....%..._.&.0.....$I..8.R..=....M...$.^..d.N...p./~...pJ.m.....8D.....[.D..8....l.(.:..wA..t7..$. .=F...:.D..w.&m?Mi .<~.....|{.x.K...^/..Y..=y.b.A. .. .../z...o..O.........a..&~..G1.<m....].~6..........0...]1.}?.....s.J5.x.7...e..o$I..|..<.Vv..K.....Y?.........Y,."N0.DS..L$.O.......0.co2...ZpMP6..e.E"...(*_......2....i..z...M3/..):......`@.....DL.. J...PaS!y..<.:..^.1.8.$.c.0..&.p...A~.T...CD..&}.%..`...eA...}{.8..Y2..~.....X.....@....x.C.y.q>.r../y.].8...........P..0...8.....0U...aBbj.G....?...>...../....q."...:..G.d....h0H5.....h.y..`5...$0U....5..?w0......q0....3...k......sM...$....q..:..M ..i`.....zi.`..J........6.O.....yF..`...3#.%...@..A..L.........K5./.O.UG..g......v.5<.Q......[c#.... ......H....O.Smb....X.x......7..O..w.....Y.j.../L..._.cP...40{..kC.q...4..0.P.A...%....K...?.D.h...)hM...8k...`.....Q....Q.r.B..._..k..5]..D.Z....;.z.~... L..G. .\..L..=.5..s-....... .....nK.\...t. ..*C......a*...EL.a.....?c..N ....(..X9....S...W.(.............xY.WM<CQ...*...-.!.........1.......~..{qO.....}.3.....8?.1.$jB...n[..>.........9........\.p........U7=]U...s.Xm`%?..A<.V.k.W. ...=...$(..D....X.2...\|..@..V7..@.!...

<<< skipped >>>

GET /clientscript/vbulletin_important.css?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-68c"

Content-Encoding: gzip

26d.............TMO.0.=._1..R..-*..q.R.J|Hm..TBN2i.u..q.V....r.I)]..V......{~..;......l.....M......h..S.........h..........~..u....^.....J.'0...WB.....`.z....5Ky.....[.T.B..1/..ai0..Q...JC...'<b.@....h}..O....F.......8...h.........>........WU.-..cz..`.....G(..R..wV-.:o..|..;p....6.*.\.....N.t./.A.........yu..B.6...P:...V.S.=I.X.N.4n.........K.%.la.,Q..P.L...d<..6.R..-......c.4.d..E..2.P..).. t..7......q...4...2...T..P.:.4{.6".....%t...P....VUsR''.J.v..^8....`..j(..[.]...(.LJ_K^...$tJrQZf.J....v...s.e^....{."..aN*:...x.2......o<{_...~.....@..U .........UIr;....,..N`..p.4....v~5...4...pj'.1..G..m.......k`...../..).........0......

GET /clientscript/vbulletin_menu.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-24d3"

Content-Encoding: gzip

a58...............r.H.}......H.....4.@.... l....%....F..%.........SB.{.......2.......Y~?|.f...}.....T.f..C.H...................,.L....~......V.^.p.....6.|Ss.P....v.S.lp`...K.js.bm.m..2m....$e.....4@y...A.-%.....EL.......8.e...7....6.....j.W..v..b..s5...p.X|vrr{{knf.^.OW..u.$$>.Rl..*,Q=.^??...|S(.......1.m. ..........K.`...#.....~..:v/.(.q....4j..Gn.p...}.\.{...^.b....Mm.SI...jN.x[....M;...&a3N(.l.c..1.........X>X'X...E~3..L.... .Q..dd..B.^....$4.9.."&..it#.R`y.....x.6.?:.....1.9. s.A.kp.?MA.d..:...I...)..>....A...i.....G. ...z.E'|..:P......~2e.S....`.N"..}T.K.T$n.........1....Xt#..l.b.. ..b.3q7q....N.1!x0..O/.S....m...~A.}~.d.3.Fx/....[....48PW.cb.....=...Q......k.r..J........4..(.D...M.....3.U*UY.......r$..0W...|...c./]:.7..^...... '. n).......{.q..V3<(y. ....E.....X..Tl.!..X.C............Z`y..}..='I..K.....M.y.w.vl4..6.4....Q..w.~."P..s...........;..O.n......k..3....S|..Qp.....y1h/...".50.C....0e@10.=Wl.Vf4. ......b.!x.B..rP.........rr...f....%n..NP..2..NR..1%.DvW..!....vaCcnri..J`W.[.HV.b1......8.=`."p6../.6...%.Rb.R..<._...@>..E$..6..V.``.W...B.;..LUw..j....;...... U.................(.w._..Wa...t..<d....\{&....`Tb........x..8.....=.{>a[({....v...D....6:..eY=.....@....].W5..p\....P...WoP7.........q.`Kk...c..B v.5m..P.../........?....tqc....*...Mc..*a..w:.3.F........:R....|......._. ...~U..fOC.f.....q.=..Rn.de...~....].....kD_.....E....C.....R....@9i.xQ.0.P.%.e.....k...l..Q......"..C..&.....-........6>.@...@.L..n.....\AY.kQ.S.[.!7.....N..o.......7.[..9...O...=9....(....{..)k._.p....

<<< skipped >>>

GET /images/head1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 25780

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-64b4"

Accept-Ranges: bytes

GIF89a...................w...35.PQnAB................%(~-/8..K()..................|.....e...lp.........t.....l.....d..\........T..L.... x..D..h..,$%<..X..4..,..J..$..8........(................,..............................4D4.......................(.....H........................(%.....................)..<............................. ....m.....X.........O......X9...........v....l:..|.:".....l.H#..b...'.H..k.(...O..U.........|....>..0........?.$.....i..|...8.,...U04..X..9/-....#.<...yw....'.D.....T.....L.....|..t..l..d..\...'...............................'......... ..:24...FD..............................|..t..l..d..\..T..L.....D...........<...........4...........,..|..t..l..$..d..\..T.....L.....D..<......*),..W...C@$......>=I.....a/....H44.ccWGG...H??...dYY............!.......,.............aK...9....L...C...>L(.....-ZT...C....#...A.2".[.N.C..GB..1.K..I....`..#}....... u...r!C.7..|:.bS.OaF,x..6h........w...k......L..'........J..G....H(..`.:I.....ch.L..I....A.7v6..5n..c.&......j....T.U'b...'hh....<......QcV........(p4h.T ..n80.....,i.45.....Z...t..x..^.gfr..-....cj.KC.|#q^.7L..^{..ZL..._c`.u^e.=..A.(c./o...7.5..h......agb`M!..m. c.x.qs.W....t..4.m.0.N3.-..l"=w.WC.E.U....F....7&A..H.5..z..D.4....q.4C.F..._.D..../.H..(......3.2.R.\:7.$ZmmZ.SP.6..g..gâ€™`..&GR..A..E.JQ.f.k1..M....RjXb.XhT...7.$.3.qo...6h...@..T.F.5.*f...XF.!F..>.....J......U{..e#8/HvC.:.....@..C.8s.A0.H%AM...u.>...*.f...*.U.^...z.p..1..*./.8...h.Z.^Te.......u...]..qC.N0..U.....TXn......&C..P../.@.//@g.J.Y.lz....S.*

<<< skipped >>>

GET /images/bluefox/misc/navbits_finallink_ltr.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 576

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-240"

Accept-Ranges: bytes

GIF89a................~*#....)#|'"~)#}(#.,'.($.*$|*#|)#.,(.,(~)$} $. &. &.)%. &.,'{/)}/*r1(q3)p2).74r2*s4,.IA_@/XG3YH4TJ5.yi.......*(.*(.,,. (.-,. (.0/./...-.*'.53.10.0/.... ). ).--.,*.33.-,./,.11..,.//.0,~0 .10.0,.2/y5/v4-p4 s5-.PMl?3bG6^K8UN:..|HK=.......00.53.54.53.11.--{61MN>...EFBDDD............................................................................................................!.....[.,........@...[........[...?..&...$.8E..[.,3S1.TR/."..KC7..WL...N .....!Z... 4M.PY9.5...=......>I......#..*(.'.....[.)Q-.H-2U0F.[@.....O.6G.B...\P....;..S.C....-T.b...k...;....

GET /jpg/newofurmatn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 1507947

Connection: keep-alive

Last-Modified: Thu, 09 Feb 2017 19:56:56 GMT

ETag: "589cc988-17026b"

Accept-Ranges: bytes

GIF89a..z..........999...CCC...nnoRRRtttMLM......222........................ddd^^^.........X..s........&&&...............hhh.....................WWW}|};.....# 2.......................H..............................................................................................................922......YWX...LBC.........|}....QLM...*(*vpq...* qqqohi=;=...eee...wwxzz{c_a......s........iii...ljk...`aa...rrrQQQ...HHHllm......rsu}zzVRTzxxbcd...B@A.........PPPTTT.........YYYXXX......fgh866...QRRWTV0,-UVW............gfh...fefZZ\..................cbb...JJJ>>>............FFF...~~~...'""...@@@.........444......666.z|............###!!!, ,.........%..ccc.......................................UUU..................fffkkk.........[[[............ ....................................!..NETSCAPE2.0.....!.......,......z........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..U ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.z4...c..M..]..s.....o.....N..q... _.......K.N..u...k...{.......O.5....._..<.....7.~..... ........._...h.z......R.`..F(ao.Nh....Va..v..d.~(..$..b.(...Z'.."k3. ../..b...3...\...3..#....cl...B.=J...@....1..T.@6...G..$..b.$.V....Z*Ee..q...<...u?B.f.1..e.y.Y&R3@...[....QV..Ou.y..T.y...Vy.R_....2^j..Q....}z:T...Z.w_B...9...........E.'.."...K&...T..#.L..j...Z).k..kR..Jhjn^..P..z&.6..(...J%.2...VX*.).N.Z%P.......KT.K.[.......Ku.'.aA./K...$.7..o.3..p..^[T....Z..M....Z..K.;.../...Ob.......i...|.....s..v*....$m.;

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.trust-provider.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: 5907E30F032C051F75CAAEB6ABD5F2B380B5ACAC

Cache-Control: max-age=333552,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0.........z4.&...&T....$.T...20170207123043Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T...CR.?..........DN....20170207123043Z....20170214123043Z0...*.H...............,.....y...{.J....<ox.*{.`rU....=.1.v]'..Tq.V.....O.2..!....s..!#^..DGC..6.Xo..h...}...>..q...*Z..[[....^r%.1......p~.K...}..<.....H..X"Z..A..&.....x....&..O..uN....4"..l...i.W..? ~.....A?..]..ZX.h.........7..$......tv.N&."_].b".....Qr...........'I.{..m@U..

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:41 GMT

Server: Apache

Last-Modified: Wed, 08 Feb 2017 18:34:57 GMT

Expires: Wed, 15 Feb 2017 18:34:57 GMT

ETag: 35B3F2D38FB07E0E4D1650824751696EF02E7821

Cache-Control: max-age=441795,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 281

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0.....0..0......@.ag...qO...,o.. v=...20170208183457Z0t0r0J0... ..........3.....>v..1.9S......@.ag...qO...,o.. v=..........1....X.K......20170208183457Z....20170215183457Z0...*.H.=....I.0F.!..JB\.1...3....0k.rw.v.......&.7..!..dW..:..S..#.I..I.]".A..a...K.....

GET /clientscript/yui/connection/connection-min.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-2d54"

Content-Encoding: gzip

eda...............r.F.}.B....0.=.f#..@H....f<.IiU.,Z....._J.....4.9......O..s.t.........~IZ.\o.w......e..o....r.....V.3.>...E.nE.....Zy...E...~.Z.|..nI..wx....%k...t[3...9...r.<.w.8..$..............M&fN...'q........Ut.N..0.M.e8O.,Y........52..W.>...G..3.f.-=....p.......U..~.a.6..m..~...u..1.#i..M3._..6..A.O......$]..i..90..Z...f...n...D.>.........i....Dy.d~...8#....%...*..l.g....B"Y.ca........=......Qd..U.O|..:."...Wx...M....6......~..@...?.L....H..."..1......P..v.f..@...c.T.7.BStj....M}...@...d.S......@F.[_.<.i..w..cr....`..v...p..@......}?..n.i4..m.........]NH.#...\.<.q.......3........,...|.2.'.u..8...`z....8.@W..v.[)&y...bX[......5.......^..[....$ 6.!..tc.H"L._....(..s.eo...a....<}....Kr..........y.....o..(.T...<.gV....g..H..`.@T..@.o(.WN4.H...Jp...9...r..$..H...)...A0.p(-.P.........v..z..@...o.2....7.8[.....[.q.s....{ u...j....P.')..$.m...cm1(hm.].D....{.;].UO.}....*.oq.].U .E......G...;..v...8$.@.).^.o?O.O0.5...\F.......X$}.86U.j...5.7sp6=. ....B../5O.....s.Z.I..!z......p.......w~.mw...5...2.... ...a.G..F8........@b.b.S..._....a...X..`....@.\..oo.V.........'..N../%S....I9!..:.}J..=.s!.EbF..qq*<[.N...).k..FO...N....6h..&.6.......^......a.Pa|l).z.y=A?UT.Ef.g.t...."....K....&:L..v8E....C....k%~..7H...O.v......ck.......BC.........Cm.wj.AH..]......c;..e.....v7..v..8_...C..b...#.4. .S..,.#.............IM..........X..b,}_u."}....Bwqp.kH.h.h.w.........1&.rI...~...r^U................L.VQ.......Rk...\..G...Z.q../0......V..2......."..A.W|{Z..6.v.(...\.)....<eF.x.p....F...Wk....a.m...

<<< skipped >>>

GET /images/bluefox/misc/close.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 428

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-1ac"

Accept-Ranges: bytes

GIF89a.....?.....j9......./..<..KJ.zI......zyy....],....PP.......S".6...S.mml]]hff.......N.....nn.SS..........,..D..M1....&.. ...........E..>&.X&.;;.*".K..Q../..``....77..j...qdd.80....?..D.....J..mm......!.....?.,..............f...?.K..!{...sD.V0. !..&"..B..$..G..L.$Y .r.,....z3P...(...\?.,.... .....H#.*. )....NB>.". ..3..Is.......G?.....<!!.%;M.....0.99..../.)%..0!.(1j.:. .... ...8.%.'.....6.....'..G....:,@.`....Fh.`.G..;....

GET /images/head2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 30760

Connection: keep-alive

Last-Modified: Mon, 29 Sep 2014 11:30:44 GMT

ETag: "542942e4-7828"

Accept-Ranges: bytes

GIF89a"....................)..{..........dY....C;...vupw...........7..f..F...#..JCV..'...........................pn....~w.......... %.ZS......*))....jd.zs. ..kd....|y.......sl....QK.un.'#.94....72..........HB...._V.............0*....3,....C=..../ .UO.....................................HGc))............. .gBA.`[. ..(/......................# ......................!....d.....|}{..................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B65E0B12B647E411A4ECB674E47D8C8B" xmpMM:DocumentID="xmp.did:E2D2E1FE47C211E4AE82A20A9E772400" xmpMM:InstanceID="xmp.iid:E2D2E1FD47C211E4AE82A20A9E772400" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B65E0B12B647E411A4ECB674E47D8C8B" stRef:documentID="xmp.did:B65E0B12B647E411A4ECB674E47D8C8B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..................................................................................................................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;

<<< skipped >>>

GET /jpg/GX1OvJc.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 302184

Connection: keep-alive

Last-Modified: Sat, 27 Aug 2016 06:07:26 GMT

ETag: "57c12e1e-49c68"

Accept-Ranges: bytes

GIF89a..x.................K...fRu..YV.3J.........[..s......a,..I....rO..U....)0.l................u.....Klr1Mi...P..l...EiVWX ARvvw......bdew..K.............0...445.....o....J'....O6ACD.{.$%%..6......CWp[.uh..h.....0'.RD.[.u.y.............V.....9i..n..........dT..........wi,.....-S..V...EOl...!....sd.R..... ....Vy....o.u,6.......<..........T....-.."57LF#*........$..............g.>...S..u........vpIQ..............x..cX).....Zp....s.....:0ajDg]..Q.3)...~HTM..'....)....cc...*{.l..s.....FRW.......(::.]f.#.....:...e...lAEHV......D..4.OK.........4;kkm...,..ew|c.....q...y....3Y|../.=3r.7a6.;4.xVl.....E....Ei..A.{.}zc..............@......X{nWCS.............dp..... M..;#9.19a..8i_.\.1).\WA..!JJJ;VO......................................................;......!!=|..@....n...`.......!..NETSCAPE2.0.....!.......,......x........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...Y'....0R.b.4.h.P3....<.w^.@.).M9.i..#....LN.d.PFY..RVi.}T^........`..e.d....f...ph.........t.&g.x....z...c|.)....J....eh..6....F*.m.Vji.^^...rA......i................I.......J.................z.K..s....j*...a:...ZJK..QZ...Hj...Az...:.K..1....*....I....n.K.................b.K..K.....)....9....IL...Y....i....y.....L...................L...................M......

<<< skipped >>>

GET /jpg/gdtmvRl.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 127641

Connection: keep-alive

Last-Modified: Sat, 27 Aug 2016 06:06:42 GMT

ETag: "57c12df2-1f299"

Accept-Ranges: bytes

GIF89a..x.....^........$j..d....%/...ccc6..d...........U[ity..........\\\.......0.....gkg...........RRR................|.MMM...|||......2Ji..@..7...222...qqq....$..............PT ...<<<Vd.AAAo...N.kkk.5.[cu..8...... .t... ..................P......e......Q...-7Q.........e..........H.._..M...v.....;DX............&p.,L.....>X...fhpm.........J_&........Y..BT....Lm.$,3.b....(......s..yk.............(RGLZ.*E>4.'=m..&..).d.679.......$V..Z.............=..............t....H....6cu..)o.3c.2u-./..............:!M.BUf. G...=..........$>`..|.vvw.$....PT_~....... ...S..5".....0]....?m......WWW...&&&..b......D..Xy.EEE....W..<>.....=.v.......ho..... \... .......O.........fX.......TH......................xf...............2.........III....!.xlr..........{....f`v......B{.....&..........!..NETSCAPE2.0.....!.......,......x........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...".....0..@..P.b.8.HY.8.Q....(...1...4.I..L^f..G2.d.TV.L.s......]z.P!...B.. ...V..M.....K..ns8...R.U..~..Kp.g...Dm4F....!.....z.k.B....0i.&.....mM.I.B..r...Xh..r6B93@.s.C...>W....em.[...........V....(....m..#...Z...;......"..NP...{..I.@K..-Ry..F..wk.\.......r..:[_-...F8...s...J.hr..M.A..mi..M~.qU.B.P.:.........M*.2.J)............V.^...3.Y....

<<< skipped >>>

GET /danger1/head4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 404 Not Found

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Content-Encoding: gzip

bb..............1..0..w..pv.i...........9.@.....{.ZA.........6u^.g...R$.<....H.vt.Z..(..d.!.CcZ............F)l.....'{........W...*?.>......c....v.@".....p8........!....}..#.|a...G.:..J..\;.....0......

GET /images/bluefox/gradients/gradient_tcat.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/gif

Content-Length: 1453

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-5ad"

Accept-Ranges: bytes

GIF89aN."..H.^.._..b..c..g..j..k..n..o..s..v..{..~.................................................................................................................................... .$$. .22.44.66.??.BB.DD.II.KK.TT.VV.[[.]].``........................................................................................................................................................................,....N.".....G......F...G....F...E.E........F....ED...C...C.........B.............?.@...........@?.......A.><.==<..................;9..987.......o`.......#a>..#..A....22..xq.F.5B...Q$...7..(2...-m.......7].h.S'N.9}....(..>..=.....F..0..*..)......W.*.n..V...g..M!v.[..iY.`A..\.!@....o...C..<./..!...1........L......X....f..?w.p.4.../.V.!....c...A..../[..A.....C..!.o..../.......?g.\.....g...;o.....O..x...7h`.<.....o..........`A....(....h...*.`..6.....P...Vh...Nh...n.!....a...X..'............".-...........H..?....6..c....@..L29..G....4..#......3r...\....0....6..f.7.0..C..'./.Id.v.y..7..g...H......./2Y....j!.K.8h..R......h...h...z.....:j...*.....@.."......j..F....6._......... ..>.........0....2.^....-..u....Z{-}.P0......u..;.t.B......[..6g...V..... p...;p...,0..(.p.....l...V.j...Y..s..l...A.$.L...i...&....-..2n0....1w.r.,.L.....s.-..X...-4.G..W... ..TW-.a.U...!\-..T_.u.`..u.S.=6.T.`..%.`B.%.M..&.]w.t.mw.r.m7......'....(.....#~.........-...7N.../.....>..x;..d.7^9.y...a}. ;...N8...N...3&.. x..`..V<..#O..%{ <.y1.<.......g.v.....>clk-.....<.j/.}....;..

<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Dec 2015 18:30:0

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.trust-provider.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:31 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: 5907E30F032C051F75CAAEB6ABD5F2B380B5ACAC

Cache-Control: max-age=333551,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0......0...0.........z4.&...&T....$.T...20170207123043Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T...CR.?..........DN....20170207123043Z....20170214123043Z0...*.H...............,.....y...{.J....<ox.*{.`rU....=.1.v]'..Tq.V.....O.2..!....s..!#^..DGC..6.Xo..h...}...>..q...*Z..[[....^r%.1......p~.K...}..<.....H..X"Z..A..&.....x....&..O..uN....4"..l...i.W..? ~.....A?..]..ZX.h.........7..$......tv.N&."_].b".....Qr...........'I.{..m@U..

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d3c023c39da32b5569398126e9bf47d9d1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6ad45659d8-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d3c023c39da32b5569398126e9bf47d9d1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b549f59d8-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:41 GMT

Server: Apache

Last-Modified: Fri, 10 Feb 2017 05:48:52 GMT

Expires: Fri, 17 Feb 2017 05:48:52 GMT

ETag: CEE8475F3B689BDA381668010AD1794EDB42BD6B

Cache-Control: max-age=568630,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 278

Connection: close

Content-Type: application/ocsp-response

0..........0..... .....0.....0..0......@.ag...qO...,o.. v=...20170210054852Z0s0q0I0... ..........3.....>v..1.9S......@.ag...qO...,o.. v=...E....K.^.......>....20170210054852Z....20170217054852Z0...*.H.=....G.0D. Q....;`...b.A....?.Y.E...v....... =$.w?.....v:..s..m....C.....\..M..

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Cache-Control: max-age = 86408

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT

If-None-Match: "8017f9a85f10d21:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.download.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Sat, 12 Nov 2016 01:34:12 GMT

Accept-Ranges: bytes

ETag: "02e4de843cd21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50939

Date: Fri, 10 Feb 2017 15:41:41 GMT

Connection: keep-alive

X-CCC: FR

X-CID: 2

MSCF............,...................I.................kI;. .authroot.stl.6....7..CK...<.[.........].y.Q..YKv..%k.....!..H!.Q.-..$tU$.)7k..R.=...n3......}?...3gf......h<.2...4.(q..f......&{.`....02.s...2@`.J.<#..q..0Xy%.4..egd.:M.B....in.([....W....(.|.....|....s!..Mo..@......|"(n;Z..'~DE.}(........Mz:T....x..{..n.`z..-.\.............q....ld2z..N/.b.J...........X.S.:UN.S.v."..'l........:yz.<."!.]O..6.:d.....C.P ....P($.Y.Q y..y..B....u.`...u.00.....|(..A.J.Cp.c...X..g.........}..'........D.QVFf0...D...a6.f.0.....k.*8...<.;..o...(.....f...L.0..C.......I.A!.H.....'._)....Qc.V.....5D..,..d../(..j.F.d.....`..f...$>:_%.W..(....@.r.9..Ob.e.$..m.~.]....g.......%`e_..&Qhp .......ey.c.....H`.%<9.......#.\S...R.5....v.......dWE.....:...../"3.._..l.XiH.J!..............{.5C_...i.U....7....;p....Q.`....L.j........u....b.`:Mk.L.......*..@M^m..Jv...g........<d:l..Kq.X...*y...x1.u....... .....z.....c.(<.b...l.#....,z~..M.Y.]..Z....F..N./..[.#....Ol...f.k........U.rF)D....3..sK...`..W.....5.=.@#a....!./....>...g.(. ..9..>!.K..e..j..{x.0.^,...U9..ru.C......,..q^1.G..A.e.F[...".1..*...^...L..#:,7...:.z.n...fI1.....l..E.q>......E...x n....H....t....5.....\...<.l....7}.`\..~_..#..Bz....i..[{.w.....a...c....E w?..6..l......x8..H....7.e.;.%.:.!.*Q....#..bT.......(....ka.......B..|.........1....t.r...fk....C.t`....@3.P..*t..nmD.....8$.bd..`D...5X.....H..L../1:..Ap...w.\...,..U..../"X......}X...a...G....N.X..<....MG....r..H....._@..Q2..T...Q.....].e.G./.v,.Z5ib..5........9 ............z..!...g

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1454

content-transfer-encoding: binary

Cache-Control: max-age=478809, public, no-transform, must-revalidate

Last-Modified: Thu, 9 Feb 2017 04:41:40 GMT

Expires: Thu, 16 Feb 2017 04:41:40 GMT

Date: Fri, 10 Feb 2017 15:42:17 GMT

Connection: keep-alive

0..........0..... .....0......0...0........FC..&..<.0...Y......20170209044140Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20170209044140Z....20170216044140Z0...*.H.............\....4..M&...8#8d.)..F....oe....k.'4.......U...I......j?.....&.'.......:.D.....[.t.~.c.{.g.^...R.?..aU9M$........l2.).gL...*.......t.........E.y...Ff/.3..x.'.b...._....u,....G...].........r{........../...D...'.{v.I.F6]......SW|.C..c.qJHzJ/..&....~..:..........0...0...0..4.......My_e.\....'....j0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...161122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 50.."0...*.H.............0.............4..IP.....B..h.....]..).]w.!"..a..{...="....._...~.s1.E.......;...6&/...\2..A....\..T aH:.8lH^.....l.v.$...K=sZf.*.|.%.Pb.......B..*f.T\w.:.s.... ....9..4..cV...3.qc.c..j<.f.....>1X.I...P%?.........5R-....Ca14..X.U....u.....:.z.\.k..b.E.v..,.J................0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-OFF-470...*.H.............G..\..R.P..e]...N.....m.....4f......b4"8v..b.R....`.Auz..........2=...@..........5..cWh....J......r...g.h......Kw'...j.@...x.....

<<< skipped >>>

GET /bannerov/leaksbannerov.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: leakswith.pro

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:23 GMT

Content-Type: image/gif

Content-Length: 2629427

Connection: keep-alive

Set-Cookie: __cfduid=d537f39d050a94905c11b5e67cb55cfce1486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.leakswith.pro; HttpOnly

Last-Modified: Mon, 06 Feb 2017 17:20:17 GMT

CF-Cache-Status: HIT

Expires: Fri, 10 Feb 2017 17:41:23 GMT

Cache-Control: public, max-age=7200

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 32f0aa4094ea5a20-VIE

GIF89a..x....................................."..'..8..-... ..!.#!.*#.3"...'..!..$..4!.!,.!:.!."$.% .% .$9.*4.-;.(6.-9###*%%&(& )&$&)*')%* 4#%2,,9%'#,3,.1#.92.2$2< 38333;;;76:01.H..X..Q..g..x..q..H."W.#h.#w.#|. G#'V#(N36k(-L!..)G..D.4H.6X.;V..Q'9G9=D%>S0;M.:f.:k..JB>CX=Bn<C.C\.B\(DY3GX4BK.Gh.Ku.Sz.Gs&Jf'Ux5Yw.Pk8a}CCDKJLHEINLQQNRSRTYVZ\Z\WTXQLO]\aHWka^bz\bdbelkmhfjnmqqnrznutru|z}yvzqmrdW^@A>....................".")..........59.=B.[`.JO.<D.X..\..R.%[./]..d..c.7d.&f.6k..g..Y..j..u..m.$l.(s.7v.%w.3v."^.~|.mx.Fy.Fm..{..t.${.,z..{..V..~..|..|..{.7.....`........'..%..7.................'..'..&..2........%..F..G....................................................................................................................................................................|..!..NETSCAPE2.0.....!.......!..Resized with ezgif.com.,......x.....#....#(*((%.%.#...#%.....#....%*.7*..(....17...*44.//*../11.....7..#.'.......*..(...)4564..../41,....6.465..*/6.1...'1............:W#]...Z.......7jH..oX......!.#.P..$x..Z.?.;..hpb>....D).&.....C....?<.UT.!..w...<..F.L.R.3.meIa7;..q.'....I.W.E..b.....-Z..............B. A..Vm....c..w..%.8.......C..^...3U.....'..........4.hR%..5I 0 .....G.......%r..v...}.b..p..q...".xm..l,.W..........f#..P........... ..u...9..z..T...@..0..B.V...B .... %l0.H....H.P. .....#......L.H# ...!....*.`....t....D".n.t.H.-v.....C.1...H..(..!H'.......P..*.M9*...<.<.....iH)..$T.1,....Yw.... .q..DC.Ba..h.L5UE&.d.P..".Q.h..,TJ.bi ...d).5.67.6BK.NV.:..&.r.m.XyO.h.bn...H%.......JZ.ueC

<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.ie.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/css

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-d65"

Server: cloudflare-nginx

CF-RAY: 32f0ab8de6f1595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

31f.............V.n. .}...T..[,...-....8F...\......c...6......p..Dsr.... .9...KaF.*..l.1...,c..G..n...,....KbTrC.>..<j...q;...,.E.....-4.7.f......o...uc.k.Qk.I.B....XG..4.;u....4.@-..T%...$...2^..*.2.$CC.b.)kv(l..;,....2.....U.Ka.a..o.........s.).R..&.^0.;.....j.e.yh...h..XV./..g..S...c...I.....}.....h.QS.!...3..fT.*cFq...\.....9.g*...{.(.?.....v.Ja..L(.&..N].kn.=...6FV.*YE......H.....IC|...m..P...9....y..Ki..!....7O.7...m..*.`..-&..$Lp&..D?.....]JN.-....J..;M^&.u.?..T..5..O..}...p..rjG.... SP..@X......T'..M.i...!5..-.....|T.......h...........J5.0..C.yP....Y...}.f.6....Sr..r.l.LJ..&.Bz..... ......"..a.6._..m.c.......].....}...B#0...hd.>Q......K.U.I..,;......>X...\0..(....T.u.g........!.I.&...t.b...D..1d...a....R.Y..:...r....N.....\...h...}.)..h....g..........~.3...P....FM'..@...;.us....E..e.....0......

GET /cdn-cgi/scripts/cf.common.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/javascript

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-1138"

Server: cloudflare-nginx

CF-RAY: 32f0ab8e171e595a-VIE

Expires: Sun, 12 Feb 2017 15:42:17 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

7c6.............Wms.7..,....j.#z%{.I...K.6..t......P...6E.H..E.......vzs..,A.........h[..h.p.o.riMw0..._...!.......m.......Z.e.'....GJ-Br..g1\./..'.ff&.....`@z.#..\..a....r..S.2`....A(.....;......0...xL...@j...Y.2s..U..r.Ri/@..r..K4.3"."..h0.U..B...%.].."...K....x..).1.l.n@.-Lq...D(.OV...}...a .C...LjL1...v........0..0_H.y....Z}.....iI.A:...'T..........j.1)...h.pv...y...Iq....#M......4.../...r.$.........>X..ML.......X|...E...U........Z.zx..'..*p......d4.n.d8.*-....JQ..4?.d..[.0..v..4.UMa.|.......@.Z.. HC.....)..z...B..z...&n..>.....g?..nX........`...3..1....!.`.Y...^o..<Jg..9......}.u......@FS.}.....'f..h.....|........d.DHV......'...o#...Km......L....'.m.M........M..j...:.(..9......T...I$u....L.p9>q....a*..!.t...r.I.u3~.n.k.wi.2v...}P..YG............X...b<.!]......t.KfK..St"L4.E(.=~....J.$w/.....e......2..OO.:..iX..}...b...J.Nl.....nif..v.h.e.2.q.B..wb.n).K.x.......N....xQ.u..J..w.~...iz.....`/..#Z.N.j...G.....r..V_...a|}9.....~'.B&...U.cm..Z.........4.... e...U...N.....r&..d..[&..3.BA.8&...M.rLXNj92A7.`H.sE_..V.FQ2.T`.....\..?.i[....x.l.....$s%.6.NX...%m.V.~.y..g...Z..ai.R.Y...2W.s...........t...&..(..jn..n...<..'..Ger.(......:.{_.....o.!.6...........=.....j........L..p.....Qs.g...r...8.]...?....X....y.2 ..=..<...i..x....y4.e...8.....~4....K.k.1.....Ia.....0..=...P..U=......z@.\I..R....K......W9..H..X......A...-..t.2.........v..GB........Q..-DQ.Y:.\.......Z..of"\C..G.. ..DQ.}(.&.;.(Cp<*.M.F].=w.<"R...!..c.|@...]9..>B(d..o@yp(.....i...N..b.........;.w...M.X......{...h..&(]=....a..

<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-300.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-48ca"

Server: cloudflare-nginx

CF-RAY: 32f0ab8ef7d0595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

48b7..............SX%...O...m.6'....5...ms..LvM.l...j....w................. ......@d.<.............e.. `... .......(..../....2....`.p.P.....W.'....p.....^................... ...l...O.....Yr............Q.... .%......l..L:..-.......5.I{%w..?*.!...L...-\4.g....;.T.:|.....J.....f)....j.5...I.>zQx.d[.. .(..|.Y.6.....%.....6....g....u7.....2^....a..jP...,........zL......O....Wqr8g.S.\eZ%L<...P."...'..w..Q..!.R..,.....H...e..l....._q...(;..2v.%.:-.d.{. ..{.kY9.[.8...0..!../.V...X..$P...#-A..T.|...r._.h.*.W........Xa..~t%D..x.,&..-.C....&....>.....V..c..<..Li.R...0...V..s...?-T7.^...L`.^....7......7...me,b..m.l.~[....&.^.>......uA...?.B..2.....-]..C......Z........ow..t......a...F.NI.?...n..\.uc.*a.....:f.bW'K.vI6.:P..).)..".e......mp. 4...2.......b.....a....#.t..).>Z.....-....T..P..V.x.(....T...F"R.- .........P..h...[.._...%.5mt.F1...M.......V.../K.C..%..z.b(..|<....n?N|:l..S}.d....4.*9..^=.0AxE<...M.7a....D....MZ..2.o..`>t..G....Y.....`......P..R.... ...$..#...b....8D...7lqy..N'M....'...~/e..HvHE..v.cW. ..JO.P]...... ..TW0X.:j1t...)#j..p.H..l.5"N9.G.D..-Lvk.}..ZW....O........8.......P...~.X&V.'.&k.a.:..33 ....(.\..1.Xu......".g..0f..6Y..V....{}\mk..{<.X[H^w3_6V.A1...\g......7t..4..Ia6~U...dt.@.pL8...Z.l....8.'.(".~...D.8{A.v,=A..A....>W.........p...2..,.......B..@...<....Y.KB.....R.......P6.u0.....2..&.`......m.H1v.P..qV.Y1Q|.5.`....h...E..].....q..I....~..gAsg.9_....:V..}.......C v.]H%y..I.h....i...}Nx....m:{..Ci....<q=.[l.Pt,:.m.."..|.z{.V.2ur.b.NAB.2A.H.,._S...l)...{) .$.

<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-700.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-4d50"

Server: cloudflare-nginx

CF-RAY: 32f0ab8f702f595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

4d4e............l.ET....waq[\..../.....I.w. ......;......C_.K_..2...\G]...U....p.....CCF.G.......8...PV...l.A.P....;.....$...........6.W............2@...p.X..."........8...W......p........?\.@RKN...........L........Q...1{%....T:B.,..<....1..........a!...(..4}.^\... n..T].K1J5.V.B...l.yFA?.ZG4M.X.OuDK#U.!-..].."..&^..=..8....|....E.....B...U..2b..|.i ..y...p.......:..j.......E.[..~'.:..~......0...A....L:.%...A.$..M.s.....r]...~j...Q......V.o=......V.g.l.Y....;^...x.....u...&.....v.Y}...OE....6O@s;....<B..}yd...O..&..(.l... ..S<..U.V........f.^.G..-T..Y.hD...P .%...4...........k.....DW..`b..JE....*_...8....YBT<y...}....uU....N..._..EiI..{........q|..5;..."..^`c.._.K./\,...}?@....,.O.?..m....)...(..sP.N...JX.p.....fA.'P..],].. .h..(.F......E...%.:.M'........I.m[.GO..n.Pi.S.8dh=.t...'2.d..=.ZdX.0G,....g..]...E....H..r..4F.'..5...Y"...&6z)\{..2........5V<Y..I.rUP...:<E.OD..bf....#,.[0.\..."...19...#`.. $=... hj.8R..0W..E...H.&.=..`..6*$.p|..... .=.b.jR,.*.B.....L....1z..J..v.....q....ZDL...?.....r...Ni|..!.7..D^$S....u......aB.j|$.......Y.Q..#.S.cT;G..x....&.p....D.....K-.8.n...ql..C.%._6r Oo..y.....Y^.....'..)..c._=C...cQ....... .....n%.A../..N.?..uJ^U.v^...2......b9#c.y..&..<.x.P ..1C..v.8...t....4...T.3..C._..OK...{X....H.$..q.c.5h.g...w.~..4)r......x..;.v..TjM$.........;OO...:g..lk....F.g.U.........p.N.._.._D7Zz.`............ K.GF@.tWbJNc...Zt.5..3......`D..../p...ur...C?.E..X..0.='......ewu.............5.*D.T~(...nn....?.....O-..dT.....g..Z.....9^.h...b.q .......W........|.J...?....*.q ...

<<< skipped >>>

GET /cdn-cgi/images/error_icons.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: image/png

Content-Length: 16759

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4177"

Server: cloudflare-nginx

CF-RAY: 32f0ab90009c595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Accept-Ranges: bytes

.PNG........IHDR.............R ......bKGD..............pHYs.................tIME...../....x.. .IDATx...y|\U...$m.)..;.4..*`A....^....E)..d... .N...z..T.M@6.....HY..(.;.BY...=.?.I..&.....;...........<y..s.y..!..B.!...u.A|t4..........)"...1..k._....p.V..q.....8.{...L...@'0.....b.-E["G%.P`3`.....@...q3.x.x.x.x..X(.U$r9.6...;..._..{t.o......Jl.\*.r.X`.`.`....t...O.....<.\[.....&....9.Xo....:..D.............../p.puk...D.O.=....m.%.....m-..!..).....w.......|...ba.D._.5........BL..............c.h....:/......Jd?....=.XN~........S.9=....`}.X..._....DNN........LF...1...M.9~.....XY...-..............WY8.f..[...H..$^.p>.z. Q,p.pR....<.x<..`.y.....[..7%...n......7...Z...$r....n.v.?^.)...b.:.O..3.W..Hb/Y..CGs....}K...W`59.=W.G.4.....G..!\.)............[.w.K...q......E.hn.....&'2.=..ig...%...[.g....:.[....%.v#.A...\...kCd7..W`y...8...&Dv.A.FCly......s}...vn..T{.....Z,.9...]...u.u..-...#w4...nT............$^.x.M..En..M..W}....n..5.X.B9..#_.V9.:gv4.l...EGs.....Zc'.s....d..$.R.U.X86...b..<`...(..7.&.].7..Ae....,..9.........%.DX.J.'.............}eS.Z}.w-.p.!..O..........4..|n...Ow{..)...tZ.$.;a-.....g.g..Z...K.t..........O..#w4..........Z...J.}i.....Pw....=.c0..`...?...}....;.[V.........J...{.%....gx.?..g.K8G..:...3}.Z...NI.0.....4..N..<.x..$..L..w.........-.{#rGs.......o-.....?.v.T..."q...MX..'.........M.}...../.l..\f..u.{.|.p.g...GsKK."....g.........g...../8..*...R......i...!#....&..Z,.Wa..v.yr.%.!.Q......nnN."........gT..]..)..o'.[Q...X....1..=i.%.o.&rGs...;....b.....[....xL....\'...........T...xU..y..d~1.L

<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-300i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-53af"

Server: cloudflare-nginx

CF-RAY: 32f0ab9050d5595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip

400a..............Ct$..e.b....m....Y.m.c.6:..t:.......?....z..F..`Z....@......"$.$4................C..@....)..@..=L..........`.p.....3.3....(...6.[.'..@...<.f.G..........V.w.......vl.f......0..j......5dT..'H.{..............2....Up...%..wgd..4...FAr.[.Y}......HM*J ..O.o7K..v..(o2.6L3..(.h$[...BEy.;....\..q..O...\q....=*~.`n.@:.5J~ A..`Q.-..t).......r.(0.......m7.I.)...6........{L-..2oF05......O]..8....ZX.............0.i..!.nfA{.1..j<..le&..2...s....C..r.5.V.k).8o...&B...p3W..n]..L.{..>.........2|....g.. ...iC...l0,..........8.!..9I..`...)%..l....j...c.6.G..N5..?...........#.Y...-s.......wr.Ah....!......3...o.......... =#..J.......Qu.G...8...4......'.z'.%sMD.x7...'59..Q..X.w.p.H.~.Pw...V.g..#....-/&.........%f$;!xU.a..&..&..D ...$....(/#.........'..O..!......h.......q .Cr(i....=i...X.n.....tC...."......BX7.H..*.l....=S."..r.>.S...d..7@n:..&.R.B.n.t.z.o...P3G.G..N....<.....[}"..r.-.|....I..G.|...6..........{.^....).}tc*.p.a2......t4.[Z..5. .y.....r....L..K..M....#....T.]..s"I.R .....m.....N.....sC..r......lF...&$.....Bx.Pf....q.(...@D2....`..x0... ..d..7.....}.h.Vp..`.7.NR...-4...FrY.._J.(...x.6!.3p...Xwq.........(..Z.(B...V...0.U....Soo{DL2.....@..!la...;...D(....p.(m]o.[kj2~.......=....{.....&./..j..b\.,.:C.....r$...|x.R.0K...,......E.<._N...{.z_..(^..D....7....Df....L........m;S.\.w.E...<.......{q._.3m..r...6B..C....@C...}.tD....k.2N.w... '..*..":US.....5...1...-%..jx.gYc..&....k.......s.nJqwtc..B.....?k.m..]31G.n^./.'M..n.$(....}...."qA.A......I..Y.j..%a....L....e..$oG.T....Qy.$./....E.tS.

<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-6eeb"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:17 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-6eeb"

Server: cloudflare-nginx

CF-RAY: 32f0ab926228595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/scripts/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-17bdc"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-17bdc"

Server: cloudflare-nginx

CF-RAY: 32f0ab92a250595a-VIE

Expires: Sun, 12 Feb 2017 15:42:18 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/styles/fonts/opensans-300.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-48ca"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-48ca"

Server: cloudflare-nginx

CF-RAY: 32f0ab93028c595a-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/styles/fonts/opensans-700.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-4d50"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4d50"

Server: cloudflare-nginx

CF-RAY: 32f0ab93b2f5595a-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

....

GET /cdn-cgi/styles/fonts/opensans-400i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-52dc"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-52dc"

Server: cloudflare-nginx

CF-RAY: 32f0ab93f32e595a-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

HTTP/1.1 304 Not Modified..Date: Fri, 10 Feb 2017 15:42:18 GMT..Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT..Connection: keep-alive..ETag: "589b19f3-52dc"..Server: cloudflare-nginx..CF-RAY: 32f0ab93f32e595a-VIE..Expires: Fri, 10 Feb 2017 17:42:18 GMT..Cache-Control: public, max-age=7200..X-Frame-Options: SAMEORIGIN..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1769

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:12:37 GMT

ETag: "D897C7E78CB5282B4C0FF19C78568ACE591CC8A7"

Expires: Fri, 10 Feb 2017 15:41:47 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:47 GMT

Connection: keep-alive

0..........0..... .....0......0...0...I0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder..20170209101237Z0s0q0I0... ........As....j....k..b90pi5..N....@[..i.0.4hC.A....j]..;NO.{i....dk....20170209101237Z....20170213102237Z0...*.H.....................h ...._XE.....Z....&.k.$&...R......%.7...%'.}d...N..."..0..q.E......p3.4.w.T.:0u..i.....c.m...O.].."mF.#.....z.3....k./|..m...8I.....p.~.r.2P.|..%.....d..M.Z..P.,X....C...u..=../tB.......|:.w$u,........^(.]%'.......{z,...t..!#.......z..0e1....t..=z....0...0...0..........t.P..M7O.">F.v..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...160920000101Z..170920000101Z0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder0.."0...*.H.............0..........W.-..Z.\.....u..6.F~....~>IXqW..h)..{ .C..k.wL..e..{.k.o........%...l\..=......b...,a....9..4.....6..'.h..ca[....[.>...e.vdpm..)...e..-....6/.e...ay...T.c.}..a25...'A...x.S..<.#... ..xl....D....p..5........L.o. G!....Ld\.!..)o..GK..i.w...b.....p.S.r.............0..0...U........0...U.%..0... .......0...U.......0.0... .....0......0...U......_tY."....!\.n..&..*.0...U.#..0...N....@[..i.0.4hC.A..0...*.H.............-..x5i...H...$Y.....y....2r.!..W]T....z.5..w^...[.1....H`..N...|.3...(d<.8..4..l.*.@...:.GV...........=.n.... ...y.WK.x..~1.%...j....d..../R..p<.mR...Ii.%....d.5.P.Z.s.... ..p.7.W_.9.*.T......... ..l>M.=...w8.K~.).uU...n.Q.@^.cR.a...5X...]'.P.Yf...0V.3. ...h

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1769

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:12:37 GMT

ETag: "D897C7E78CB5282B4C0FF19C78568ACE591CC8A7"

Expires: Fri, 10 Feb 2017 15:41:47 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:47 GMT

Connection: keep-alive

0..........0..... .....0......0...0...I0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder..20170209101237Z0s0q0I0... ........As....j....k..b90pi5..N....@[..i.0.4hC.A....j]..;NO.{i....dk....20170209101237Z....20170213102237Z0...*.H.....................h ...._XE.....Z....&.k.$&...R......%.7...%'.}d...N..."..0..q.E......p3.4.w.T.:0u..i.....c.m...O.].."mF.#.....z.3....k./|..m...8I.....p.~.r.2P.|..%.....d..M.Z..P.,X....C...u..=../tB.......|:.w$u,........^(.]%'.......{z,...t..!#.......z..0e1....t..=z....0...0...0..........t.P..M7O.">F.v..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...160920000101Z..170920000101Z0G1.0...U....IL1.0...U....StartCom Ltd.1 0...U....StartCom OCSP Responder0.."0...*.H.............0..........W.-..Z.\.....u..6.F~....~>IXqW..h)..{ .C..k.wL..e..{.k.o........%...l\..=......b...,a....9..4.....6..'.h..ca[....[.>...e.vdpm..)...e..-....6/.e...ay...T.c.}..a25...'A...x.S..<.#... ..xl....D....p..5........L.o. G!....Ld\.!..)o..GK..i.w...b.....p.S.r.............0..0...U........0...U.%..0... .......0...U.......0.0... .....0......0...U......_tY."....!\.n..&..*.0...U.#..0...N....@[..i.0.4hC.A..0...*.H.............-..x5i...H...$Y.....y....2r.!..W]T....z.5..w^...[.1....H`..N...|.3...(d<.8..4..l.*.@...:.GV...........=.n.... ...y.WK.x..~1.%...j....d..../R..p<.mR...Ii.%....d.5.P.Z.s.... ..p.7.W_.9.*.T......... ..l>M.=...w8.K~.).uU...n.Q.@^.cR.a...5X...]'.P.Yf...0V.3. ...h

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1816

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:43:27 GMT

ETag: "19EA21C5EC4190A4DC16E6AF38C1BC22119AC819"

Expires: Fri, 10 Feb 2017 15:41:52 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:52 GMT

Connection: keep-alive

0..........0..... .....0......0...0......0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder..20170209104327Z0s0q0I0... ........Qh.....:U.`."....0=)....N......g.D..3....... .m..I......i.......20170209104327Z....20170213105327Z0...*.H.............~..Z9..]r.........s..x>.HO......a.KUL`...>.Rn.,.....T&.......>,.}...oo.,...o~ X#N..k.Z...G8..b......d!................6..(.H...62.g.......w.D.r....W./..cy3_..Aa.q....xh.oGI...Sc...%3.....P.8....T.l=l...b,..-X.N...FW)k............;..e^I..f.f.Ok...$."r...|:.....0...0...0..........T...._fA.....v..0...*.H........0x1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1&0$..U....StartCom Class 1 DV Server CA0...161210034431Z..170330034431Z0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder0.."0...*.H.............0.........Y..J.?V..F.r..,.:..{{o@.O....$bC...s7!..J.h..T...jY....V..c.\$.(q.{O..L..u.X89U....{.K.?}..,(.S.>F<`].`...yJ.......2.v...&."><.f.......CK.....}.k.8...[....Rg.t..x...z....(..?..9xT..Z.\|}{........>.........a.2.G.'..h....!I.....:..<..h...5.H$.\.>PI.....JY..........30../0...U...........0...U.%..0... .......0... .....0......0...U.......0.0...U......o...iOM...:...S....T0...U.#..0.....N......g.D..3.....0o.. ........c0a0$.. .....0...hXXp://ocsp.startssl.com09.. .....0..-http://aia.startssl.com/certs/sca.server1.crt08..U...10/0-. .).'http:

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1816

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:43:27 GMT

ETag: "19EA21C5EC4190A4DC16E6AF38C1BC22119AC819"

Expires: Fri, 10 Feb 2017 15:41:52 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:52 GMT

Connection: keep-alive

0..........0..... .....0......0...0......0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder..20170209104327Z0s0q0I0... ........Qh.....:U.`."....0=)....N......g.D..3....... .m..I......i.......20170209104327Z....20170213105327Z0...*.H.............~..Z9..]r.........s..x>.HO......a.KUL`...>.Rn.,.....T&.......>,.}...oo.,...o~ X#N..k.Z...G8..b......d!................6..(.H...62.g.......w.D.r....W./..cy3_..Aa.q....xh.oGI...Sc...%3.....P.8....T.l=l...b,..-X.N...FW)k............;..e^I..f.f.Ok...$."r...|:.....0...0...0..........T...._fA.....v..0...*.H........0x1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1&0$..U....StartCom Class 1 DV Server CA0...161210034431Z..170330034431Z0..1.0...U....IL1.0...U....StartCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom Class 1 DV Server CA OCSP Responder0.."0...*.H.............0.........Y..J.?V..F.r..,.:..{{o@.O....$bC...s7!..J.h..T...jY....V..c.\$.(q.{O..L..u.X89U....{.K.?}..,(.S.>F<`].`...yJ.......2.v...&."><.f.......CK.....}.k.8...[....Rg.t..x...z....(..?..9xT..Z.\|}{........>.........a.2.G.'..h....!I.....:..<..h...5.H$.\.>PI.....JY..........30../0...U...........0...U.%..0... .......0... .....0......0...U.......0.0...U......o...iOM...:...S....T0...U.#..0.....N......g.D..3.....0o.. ........c0a0$.. .....0...hXXp://ocsp.startssl.com09.. .....0..-http://aia.startssl.com/certs/sca.server1.crt08..U...10/0-. .).'http:

<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=dafb21e8c4237f866f7ead9a70dc4bf651486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b12eb59f6-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=dafb21e8c4237f866f7ead9a70dc4bf651486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b632e59f6-VIE

0..........0..... .....0......0...0........>'...;6..9.wS..._...20170210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.61....20170210122132Z....20170214122132Z0...*.H...............o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k......J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...161208000000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0..........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-..g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0...U...........0...U.%..0... .......0...U.......0.0...U........>'...;6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<....e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Filstf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.

<<< skipped >>>

GET /certs/ca.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: aia.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/x-x509-ca-cert

Content-Length: 1997

Last-Modified: Fri, 18 Dec 2015 11:03:49 GMT

ETag: "5673e815-7cd"

Accept-Ranges: bytes

Date: Fri, 10 Feb 2017 15:41:36 GMT

Connection: keep-alive

0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certification Authority0.."0...*.H.............0.............lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.......,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.........`.g:........r".................\R<...*s......`.z/...n.&0.....W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U........0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.startcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startcom.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.pdf0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited Liability, read the section *Legal Limitations* of the StartCom Certification Authority Policy available at hXXp://cert.startcom.org/policy.pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 10 Feb 2017 15:42:11 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha

<<< skipped >>>

GET /Big_banner.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: paysell.bz

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:23 GMT

Content-Type: image/gif

Content-Length: 1439404

Connection: keep-alive

Set-Cookie: __cfduid=d91df4e7668368f826f0a547a006dcf071486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.paysell.bz; HttpOnly

Last-Modified: Tue, 31 Jan 2017 12:42:39 GMT

ETag: "541117-15f6ac-5476344792a8c"

CF-Cache-Status: HIT

Expires: Fri, 10 Feb 2017 19:41:23 GMT

Cache-Control: public, max-age=14400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 32f0aa40b170599c-VIE

GIF89a..x......V..#pp..(3m.6*.."....%.....`...O....%....o.l...""...M....uP....".#...V#....Pm...........Odqu......Rf.q'f...Lf....WT....3Gp..m..."..h...T.w.T.."t.......i..Vl$l...2H$..........u..%...q...Uz"......s..DO.O.r.....O......jkg....'....kw.3E)F/P T...gr..)$FS..RS.......(.DZP....ig..H&R......1Sc#...w&(mq.s.a_.....I1..gJ..P...o%....w........BW.G.n$..U...2..U....$..#.....K....v..$U..|K...N....}.."....|Q9lNQ..H.....x.....3....."....."..3..f..h~...."..3.....".....3.......m...3........4.."..3..3..3.."..U..D.."..".......""..".....U...."".....3.."....."..V.."....!3.."....""..".."....""....7...U..D.."...."3....."..D..D....."....5"..3..D.....V..".."..3..3.."....".."..:D..3..D..D..3.....U..f..3....;............3....4..73..3.....8.......;:..>....8V..."!...3....................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)" xmpMM:InstanceID="xmp.iid:961A15C7E73B11E6AB398C80DC03CC4C" xmpMM:DocumentID="xmp.did:961A15C8E73B11E6AB398C80DC03CC4C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:961A15C5E73B11E6AB398C80DC03CC4C" stRef:documentID="xmp.did:961A

<<< skipped >>>

GET /clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-8f14"

Content-Encoding: gzip

3265.............}k[...... 0{.^2..3.J..'\.......|"D...7A....~....N......k.$}.....[_......q9.......L......z..t...M...=..(.O.\..=...T....7t'.;J=MF.,5.wS.N)U............}v..Gw.[".....-..=Y=7_..zvg.7..S.s....z...w../...m.gW[-..l....#c...Ds...d...z....yp.Gg.....p.`3........;....'O.1 .. Y..Y.....G;7v'w.{.....sU...........co.1r.i.95E..<S......f....}....@.x.A...~a0..w........:s.O.I.l.Z........lV.h.D..o........;wf....t.k. ...dU.......u....M..;.....=..YI.W.......t.4v}.Z.U.. b.;..=0W....H.....<y..>...8.[U^.."V....u.51..L..U...6<.*...T.W.T?....g......Lxp.Iq..>/k.|...#..L.....a.r...N.......y.^...............LA3)A....3.9..0M@m.2...@..). OD....}!I..Q0.....^...-......E....>......;.:..o..Wo.....o..i.8..R...P.....y....t.{..`...b6.Cf...m.......@VsU.....z.9..|x.......g...._.e..]..w...@.t.........w..Sg...,..jP......D..A..9pZ...W.iB{{.w.9.....FK..hz.....Nb-.....A....l!..W>4..M..M,.PR.o......y..F.V..3Ti.]..lt.D.9#.}...W...9O.....D..&...."0..L.|..D.....1....1..1......IR.......B.i.f.s].]...[..".eZ ...$.X..gO....s.]. . .8/.....f.:_...\... ......K......d2.I_...#n..7...y......`.0.H..T..(-.8...H...}c>..g...........1.DW.O..A..@Z.9U)...\B....ze._.N..3I.&...e..Q..:..?.V..5A.%......B.7..{..P)#........{...YB.L%... ....).B...i..R[.<......!......W).x.w] ...#o.......y.....`..;a..^ ....e...^A.>.;.2..y..2 ...<6.....^'dE...1.u^..W..`.iH.C.5.*;'`......l.-5q.....t..U....8b)....... ..Xu..............s..3sS.d8~....Z....H_*V5...$|...t.I.f....A...4...H...'..C2Ot0....Z.._..[...-S.b..(.....{.o}..g.o.K.D`...I.)..*.H....2Z..&lt

<<< skipped >>>

GET /images/smilies/51.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 3066

Connection: keep-alive

Last-Modified: Thu, 31 Mar 2016 12:14:06 GMT

ETag: "56fd148e-bfa"

Accept-Ranges: bytes

GIF89a*........... mU.@4.$$$.............. ...eP.........y...................q.ye<ue8.....}.........aaa.i.q]0iL.]H.....................a.......u.............000mL..............}.......qqq.....e....}.......!..NETSCAPE2.0.....!..Built with GIF Movie Gear 4.0.!.!Design by Aiwan (aiwan@yandex.ru).!...d.>.,....*......@.pH,....r.l:...tJ}.....@.*..0..=..hl..N..k.{......~....uUmti.pQ..cS..^............ .k.8*.........,.k........5.............e.3........)4.k.......%..e'..$.....$...1'k.(..........)..(.q/.D(h...)..".X."....<@..@...%(x.......@.`.!... ...H.....B.......8s:...!.....>.,.............p8< .H.b.d..N.0q....!...F.>.,..............@.....P.D2...2.T.4A.!.....>.,....*.....?@.pH,....r.l:...tJ.Z...v..z...xL...h. p^....`.&.}.5C.0..~>oi.\A.!.....>.,...........@.pH$..C#.@l:}....|>....Z.z.\........:w......K`..x*1?.:0.......... .\.8*.........,.\........5.M..>...........C.....3.......)4.............%..B....'..$....$...1'D.....(...........)..(.....x.@....*5P.!.......0.....$(P .B...>. ..E.. XD. .....)..`"...!.d0....L!A..!.....>.,.... ......@.pH$....1Yl:..h.#.>...V.}..[fW..W.....Y.sk..*...x$Q....aC....|>..u....C............. .E....B.8*.......,................5.M....>............C.3.......)4.cB........%...X'..$....$...1'.].P`........ .."B....ay.@.....hh..B.....(...... H.........<..... XD. ....O.f....D..!B\.`...>B...!.....>.,...........@.p.......@l:..A p.,..g.....F....j..o.;...Ot..>..W.P>_..HxyDWRSuW2o...v...VdD|Hu...oe[...N...q....Z>...d..5....S..........FN.3........)

<<< skipped >>>

GET /images/bluefox/misc/navbits_start.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 1073

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-431"

Accept-Ranges: bytes

GIF89a................~*#....)#|'". '~)#}(#.,'.($.*$|*#|)#.,(~)$} $. &. &. &.,'./,.0)./*.2,.40q1(.73.60p2)s4,.?8.A;.E@.PF.TJ.SK.\QXG3YH4..|..}......................*(.*(.,,. (.-,. (.0/./../...-.*'.53.0/.... ). ).--.,*.-,./,.11.//.10.2/.>=y5/v4-p4 s5-.A?.FB.EBl?3`B2^K8UN:..........00.54.11.--.?<{61...MN>.........EFB............................................................wwwqqqpppnnnLLLDDDCCCBBBAAA@@@???>>>DDD..............................................................................................................................................................................................................................................................................................................................................................................!.......,........@......$h........P..5."J.......<. #.O.;g..|"a...&..4pDJ.Ap$...fP...e...C...W......@=nf.T.ga..Jg...4...7|h.......P...gf..0...@.B..C..lH%...x.Ta....5n..^3gO........q..u....f.c...Pe..2...!:.. A...e(pP.c.. hd.A[..0[x4y..2...4...".....8)..O..P.dp. F.....Y".O B..M.1BdB...( ...P@.;....

GET /images/misc/password.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/png

Content-Length: 620

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-26c"

Accept-Ranges: bytes

.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..S=..`.~.VN.......[.A.m.A.N... ..&N..&................<P.Z......I.5.V....M.&._h....|..{......Dp]...|.........Q"..s..^....4}.f ..g2.$....a....e9U.T.9.s.4/}..O..`.>.>..B..l6.f..I..i."....4..(...l.>|.s.....8.a,'.I.j5....h4..PP..r.X|]....L..L.....P*...[r..3?."....`q..:..]..i.... s..N..(.. 0{.{..`ex.....[|....W..~...7......./......l.>..U..m.X<..S....!..u..-4,....Gl...]o...n.%.fM.....C...'........m..... .K.....u....V.}.,.[_6.[. ..F{..c..e...../...#..=.[......?%....D......7....q.F.cf..L......U!......g.pv....G.?...........c.&...m@....IEND.B`.....

GET /jpg/L3Zd0Sx.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 150541

Connection: keep-alive

Last-Modified: Sat, 27 Aug 2016 06:07:30 GMT

ETag: "57c12e22-24c0d"

Accept-Ranges: bytes

GIF89a..x......7....&......c.....................iE.40!...fW....HA1QI5.di.....x...ulS..............k.........[S-.l.J1....efe.kG.....R...id3.sAlU1.nD.........|}|.}H}U8..X..k...wd8skF.....8../..4..2.....6....u.#..e[E...3%....S8$..........._..m..!........7WI(XQ>.....g."....../.X;..s...../..b.z^.......sK....u}......wg. ... .KB".D..% ...uK3.....g..!...........Y..L.)-.tZ.wXwq5..&...c....fmbM.....7..d..s..!.!%.....u..0z^?....|U..-.|2..~0*...#..t.a@.....X....$.TH....@)........S\."!........&..\.DG=4..<H.....i~tB.....)..d.&........!...o..........6=C.......s*....|..L....zP..$......LC.................._.~I.#&.....u...rrri>,[:(.DJ..).IQ.....$..j.ah....%........k<.......(-.......,$`8(..$...c?*<:(....-4..... .................^....."........ ..q..............&...UN<........1............!..NETSCAPE2.0.....!.......,......x.....Q..H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...Y'....0R.b.4.h.P3....<.w^.@.).M9.i..#....LN.d.PFY..RVi.}T^........`..e.d....f...ph.........t.&g.x....z...c|.)....J....eh..6....F*.m.Vji.^^...rA......i................I.......J.................z.K..s....j*...a:...ZJK..QZ...Hj...Az...:.K..1....*....I....n.K.................b.K..K.....)....9....IL...Y....i....y.....L...................L..............

<<< skipped >>>

GET /images/bluefox/misc/w3ccss.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 177

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-b1"

Accept-Ranges: bytes

GIF89aG...... ......:::!.......,....G................0.....f.E.X...(..... ..9..N....pzD.(0..(..N.......j.jXKe.Iy..B.U...{.d..t^.h3]k.o../m.w.vF.S&.v...U.(.."9....I.......iP..;HTTP/1.1 200 OK..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:46 GMT..Content-Type: image/gif..Content-Length: 177..Connection: keep-alive..Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT..ETag: "506e8108-b1"..Accept-Ranges: bytes..GIF89aG...... ......:::!.......,....G................0.....f.E.X...(..... ..9..N....pzD.(0..(..N.......j.jXKe.Iy..B.U...{.d..t^.h3]k.o../m.w.vF.S&.v...U.(.."9....I.......iP..;....

GET /images/misc/username.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/png

Content-Length: 728

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-2d8"

Accept-Ranges: bytes

.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e<...zIDATx..S_HSQ....{..Y..@...h..2)}..P)l.^zX.P..Q........QA.......jO... .....0.....?.....9..y...w.w..;..;.;. ..`hp..........V.u..wJSU.r.))...z|.S)..3..766.......D..i..E..J.......L...0.f......3....*.Y.UE.K).J.;.T){...`..*|N..N.e^...Q..t...9.; ..n.F...... ..>q......'.{.._....T.f..h.a.o.Z..........oo..........5;n...[](..!q.H..F....g..cy.M...v....;.-...D.......n.m..|.6:....`O......xj.#^L.ccc/..y"...&..z.R..f..8.N..i|$.... T...{9.....E..J..|>....%..Y.....y~..r.... I.......b....6X7...b.e.v.....:...!..........2!....V........Qs..#.!..43{.......t:m..j;..F..`..%..p........:...lo......Ba..e...5.m..c...=2....AxD.<hnOGG'..-...Q..D4...B.........=.........IEND.B`.....

GET /jpg/twitter.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/png

Content-Length: 7053

Connection: keep-alive

Last-Modified: Sat, 04 Oct 2014 10:23:20 GMT

ETag: "542fca98-1b8d"

Accept-Ranges: bytes

.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<.../IDATx..[....u...>v....V..Xt#...$$...AT.v.a*Nb.B.p..Rva.C....r..e...(.....0H i...v........3=...3..]..B...z......]....{4.4.e.t|../.....#G....-.....x.AV.i.Hx.w-.L....i...M.u.OGbQ.u.\.....f....S...2.. .#V..\..F.5.#{..s...........j....sND..s.:.h.c"..r..(....x............"...)I..Hk..a(dR<'...x...2GQ....6l...;v...|1!p.....r...B..%.vZ..c^..*..M....~....xn..LqY*........o.i..J.d....t....9u._..h.L|..'U...q?F..phh(..6..Nz8''g%..t$.)..o2.g....C..........p8.{....:QTT.*I.0.Lp8...2`.X`.=.$<... .S.U...v.}M&N9.$..I..*-\.n...x6...R .]..h``...`.....#...H.;QZ>".)........\.^.H.]CZ.....i.....;..2..L<Bb....B...l......_.;.r..WH........o....I '....L...* .T@...L.<.YQQa..$.|>_2.-..f&.....`........q.W..OP.Q........n1..t./,,l.....fRU.r.%..L......'......%%._...f]q..y...N.......m.>...........9...# .....$...yF:....<....n~....(..g.v&......_.b....J.t..(2#.|&GQ@6X..|.s...M..]..YX3...<.P..j..@/*F...............w...9...4.....KJHp.KX...>q.5.9F............3...'9qZ.i.U:.....j.......>[...3V.....P!.....<.fZYY....Mxo.k.8.L.|.P..9.V.h.A_........o~..z.T....K9.opp....!......".c.c;....x-...x....s&....j..1B..-[6.....[o.u3.Z)V....X...'.\R...{<.G..;...G..ztu.`...D,.q.M.`.?....).L..7^.......... V^YQSSs....!:Z[[7....H.........._.9....!......3.=`D...K........{..-...-x.....%.L@.q.x.P.mn..Gu;)...,I.Y.lOC.x..F ....n....P..L.^*[..c..H. P....O3}. e.........TXf..x8...^..I.&....2.....O.}.M7.X.*..].9!ttt.......O.."7.........Ek.....aS.fBd8....A2......c...

<<< skipped >>>

GET /jpg/sa1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Sat, 04 Oct 2014 10:40:50 GMT

ETag: W/"542fceb2-927b"

Content-Encoding: gzip

400a..............gTTM.(..!g..$........$9'.0d...(A.P$ 9...."A.dI.D2H.......{.s...u..s-V..U.....{v.}..|. V.W..@h @......K.y.Y...*....6.."..H....@........./..t......^`...\A|(...............=.......KY.-`..[.;...........9[.=..>.^.Q^.Q.../....(./.......m/.~......N.~.&..S...~.........@..g. .._u....O.g..........u...'3.U...@...V..............................%.K.(I.Q..........!.1!!1.!!!.."$.Q..?....@..tQ........$..)dWq...$.Vb.P...`d..10..qp.@.*D..........h.h.X...`|~....~...CJ......|.d.....L.Zo-..\..e......nY..RdV._.}.c%...].....l....A...<...........T../..Y{.&.V..|..V....K..n.]< .......l....D.p....i.].K.|.c..,x......b.5(NF...M`......k....Fd]....r...2.....o....|0.M.@....Sbf%-L...A.JQ-...k..'j.4.i-..mb%[..7.fV.....4k..O....h...a.......>jT".3...&....~..e......u#..Wjt....L(NC..,.^.r..........n_u~.>1h.. ....K.o'PV.O.%.....!d.d..d.eF..7=,f.;.j.A....z4^UL\..`^.a..e...1s...m......{.....-.y...;.G....... F.r.os...g.v.Z.........j.$.X.el.|...*.Jr....4._}.......].E9U.6.<....%nJ.#.............5.wM...2..p...m...i.t....].i...=.B.... ...bF7.~....;x_7L..0..b..q4.....-.OP.&w%.....<....>K.4...D.........WC...{...T.5....B..;.....5.....-9|....p....-..g.C=v./nE..^..b.h..:}..}<..........%g....A.....%C.g...........4...W......a. .UG.Ee.K{.......@..'.....4.6 .x.$......)m].{D..;z2......\.>....:.-|:{.....f{O...j.........1..w..^.5.........y......oy?.....o.c.q.|......{...........Xi....hZ.,;..zu...b..9.'.......GN..E.#.f.......4.5..p.....N`<K......:....E.8...i..b..5........hH......s2.I6/..8.?.|~Z3..a..V..~fs.8.........

<<< skipped >>>

GET /cron.php?rand=1486741283 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: text/html; charset=ISO-8859-1

Transfer-Encoding: chunked

Connection: keep-alive

X-Powered-By: PHP/5.6.19

Cache-Control: private

Pragma: private

X-UA-Compatible: IE=7

Content-Encoding: gzip

481.............}ks.8....*.......K..wG..8N.sr.....|QQ"%1.D-I......... E..8Sg.^y2.(..h4...n..O/....:=..l...............\........o..f.!..o..Y.O..u..9..e.t.u///...z........jRe...Y5.~.;.O.?.....$.T.i..........DY.....;N0....'@. ......'.{q.:..O.`.u.I.N..j}.GQ|...T .k.?g.E.9..k.......W.Kh....K. .......l...6,..0..........|.EA.ND..S....8.../......^.x.?..x....{........t."L.......K. .{./....I<L..z:.I..,...@@.`..e..q<..../..S.p2......$..`[.9<.'.PEd.@..'..../..:.....g.].....1..$.t...4........I.OS..'..f...%..<.......K.h...O...~.....J.a..^.:......{bszE..t...._..Q.*O.-..o.......f....a/...zO.B..&(.....R.....p{.2..7.$v.>{..|*;r.%b.......i.i.....,...'.G.)..&..'}P..D.E...7.yQt-.&(.f.2."..c......PzI|...H.4..=yL....d......^.x0....ld"..U..V.O.....^^....}/..u.A..1j.^.....O. ..T...CD..&}.%..`...eA...}{.8..Y2..~.....X.....@....x.S.y.q>.r..oy.].8...........P..0...8.....0U...aBbj.G..=.....>...../....q."...:..G.d....h0H5.....h.y..`5...$0U....5...v0......q0....3...k......sM...$....q..:..M ..i`.....zi.`..J........6.O.....yF..`...3#.%...@..A..L.........K5...O.UG..g......v.5<.Q......[c#...Q..GY..f$.^s.'..61.fyG.N..pH.B..N....;.......5....&.../.1...f..=.....8Z.}.NT.^.z.u.z...24f4..0(..R)..O6.../|....Ia...N.q0L..^ATAm.|.....5...#..brMW.....==....^._.}...*.Q0.:W.:. g.z.!.\.......(H.h=....-.i..]..........K@..a...So.|z/...X...H..8*J.:V..%...B..S?.!.d.B.h..zc#.^..U..PT....t.F.o....6.,..zL..!..)..s.^.S./.,z....@.....r.>...?..;V...%./..8..|N/Fq.`.;#.,.4..3.;tF.MOW......V.X...q...U....5H.fC.kE%.....`...V..g."...#P...M.7PcH...

<<< skipped >>>

GET /anger1/head4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 404 Not Found

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Content-Encoding: gzip

bb..............1..0..w..pv.i...........9.@.....{.ZA.........6u^.g...R$.<....H.vt.Z..(..d.!.CcZ............F)l.....'{........W...*?.>......c....v.@".....p8........!....}..#.|a...G.:..J..\;.....0......

GET /jpg/larme.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Mon, 29 Sep 2014 09:09:18 GMT

ETag: W/"542921be-2aee"

Content-Encoding: gzip

2901..............wT.Q..'.....M.UB...... (.H..EA..Di.@.t...H.....W.&.RE.*...}[...{....w..33........f....%...... ...u.....u..|&T.....4.(.BC.....B.aL..0..&..lL.....6v6..$..bb...@r.G...:........@.!.............@b`.?@......v.<........U@T.. i......42.T..........rf..YhX..T!l.v...p...<:...v...wA..{....g..B...".Y..W......x-m.........K.G'g.W7w._?... bD.....1.I.).iO..e...........7465............7>195.~........k...[.{...G?~.........&.K..3.*jj05.?..U...,.4|R.VUCZ;o6~.0:.Zb^m;....w...1.yA.e...h.A......D......,......f.T.....X.._M.Z...-54......i.....RTr..n.. F...D......n..B......f4.M...,1b..k......L..{....Bq."0........z...0....W#.K.....NJ...\|...Z.b...c4]p..(.7?.s...Y......wkY................-g^...d.@.....*5.b4... \eE.jf..3i.E..7.9Z.tc%...efS.*.P[.V^.!>..xv.M..}0.z*.m.CBYDR`6D....,;..L.....pC|..[g^E.. ...[.......F.e%....C....P. ....U./:.D>.K"..!.Xv.[..b6D....3.B#......8.......~..?.2E..qx.Y...hcr#..Q..Q.].s|.!Sk. ...D.......q..FN.D;@.3M..2....0..D...Gq"F/W}..].J..x.8o}.<9.H4.2....%..R.cP...C.c.~.$...n!...N.......`...!.Jki ........A.....k...Lc..7."...Pb.h.Vh2.....M...dK6..........'.......j.F.~X=.el.tY...6.H*6..o..D.t.=N.6...$j=..|4.. hv2.g....*.?...Q...w......f...ng0......%....e..N<(E...>RE...........p.t..F M.)`......[....W..B.tC...U..^q...Tj.T.x..l.@...*8...).d}....Km..1x.-o\I(...D~*4Y.f^.,.....................}...'........G..F...<5u.@Iz._..;a..R.w....w......,JS.. .."k.*...N.)Q..a..)...........FI.....T...b{c...r..e a.S........p3B_.......S*...{.AK...P.W.I....0....*.......W.......%..Z9w..d.l.e<~2.L%

<<< skipped >>>

GET /images/bluefox/gradients/gradient_thead.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/gif

Content-Length: 846

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-34e"

Accept-Ranges: bytes

GIF89a..'................................................................!!!###&&&))),,,;;;..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,......'... .3`.`......0P..@.....0p.A....0h......$L.I2 .;HTTP/1.1 200 OK..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:47 GMT..Content-Type: image/gif..Content-Length: 846..Connection: keep-alive..Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT..ETag: "506e8108-34e"..Accept-Ranges: bytes..GIF89a..'................................................................!!!###&&&))),,,;;;...........................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1908:

.text

`.data

.idata

@.rsrc

@.reloc

Invalid parameter passed to C runtime function.

advapi32.dll

setupx.dll

setupapi.dll

advpack.dll

wininit.ini

Software\Microsoft\Windows\CurrentVersion\App Paths

ADMQCMD

USRQCMD

FINISHMSG

IXPd.TMP

msdownld.tmp

TMP4351$.TMP

wextract.pdb

PSSSSSSh

SSSh

PSSShp

PSShp

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"

System\CurrentControlSet\Control\Session Manager\FileRenameOperations

wextract_cleanup%d

Command.com /c %s

rundll32.exe %s,InstallHinfSection %s 128 %s

Software\Microsoft\Windows\CurrentVersion\RunOnce

%s /D:%s

PendingFileRenameOperations

SHELL32.DLL

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\

@Ew.AEw

RegCreateKeyExA

RegOpenKeyExA

RegQueryInfoKeyA

RegCloseKey

ADVAPI32.dll

GetWindowsDirectoryA

KERNEL32.dll

GDI32.dll

ExitWindowsEx

MsgWaitForMultipleObjects

USER32.dll

_amsg_exit

_acmdln

msvcrt.dll

COMCTL32.dll

Cabinet.dll

VERSION.dll

157.exe

CARDGE~1.EXE

-p}Pc

NY.IF

tP:rIAs.Vs!

@.CV]Q

UGA.rK

-'2_

f?%FH

|U.Kz;a

F..YG

.hdaou%

V(8.es[W

.AO^l=g

6B.vDC>?g

<.unh>

\.Df]af

q.tF=

.GTn\

A.bG@

4%Xg3

.SpCQ

lOL

,[P&.nx5

ar,.fu

}.vZ}

=VFg.Qo

'^%dr>6

=k.rb

%c\ful

4Ã´z

[N%.x

p%Fr5

'^oZ[%X

%SNku

.GIz2

LfuhL%c

5.RaUJ

.iOJ3

S.Di?NJ

.TqW)5

{.OP,

.zhzxaZ

@%cgQk

rW?%S

f.Nf2

.NJxg

CRtMH8

x%s5)VR

.tU7e}\gl&

&G.SK

t0Up.QU

^{X%F

name="Microsoft.Windows.Common-Controls"

version="6.0.0.0"

publicKeyToken="6595b64144ccf1df"

Kernel32.dll

Please read the following license agreement. Press the PAGE DOWN key to see the rest of the agreement.

CFailed to get disk space information from: %s.

System Message: %s.&A required resource cannot be located. Are you sure you want to cancel?

8Unable to retrieve operating system version information.!Memory allocation request failed.

Filetable full.ÃŠn not change to destination folder.

Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.KThat folder is invalid. Please make sure the folder exists and is writable.IYou must specify a folder with fully qualified pathname or choose Cancel.OFalha ao obter informa

o em disco de: %s.

Mensagem do sistema: %s..Um recurso necess

o pode ser encontrado.#Tem certeza de que deseja cancelar?

o do sistema operacional.'Falha do pedido de aloca

O arquivo de gabinete (.cab) n

vel encontrar uma unidade com %s KB de espa

o.NPasta inv

lida. Certifique-se de que a pasta existe e de que permite grava

o.ZEspecifique uma pasta com um nome de caminho totalmente qualificado ou clique em Cancelar.

!Could not update folder edit box.5Could not load functions required for browser dialog.7Could not load Shell32.dll required for browser dialog.

(Error creating process . Reason: %s1The cluster size in this system is not supported.,A required resource appears to be corrupted.QWindows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.

Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install

Could not create folder '%s'

To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue.

o da pasta.QN

logo do navegador.RN

vel carregar Shell32.dll, necess

)Erro ao criar o processo . Causa: %s7N

suporte para o tamanho do cluster deste sistema..Um recurso necess

rio parece estar corrompido.IA instala

o requer o Windows 95 ou o Windows NT 4.0 beta 2 ou posterior.

Erro ao carregar %smFalha de GetProcAddress() na fun

o '%s'. Poss

o incorreta de advpack.dll est

sendo usada.>O Windows 95 ou o Windows NT

vel criar a pasta '%s'

precisa de %s KB de espa

o livre na unidade %s.

Error retrieving Windows folder

$NT Shutdown: OpenProcessToken error.)NT Shutdown: AdjustTokenPrivileges error.!NT Shutdown: ExitWindowsEx error.}Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.aThe setup program could not retrieve the volume information for drive (%s) .

System message: %s.xSetup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.eThe installation program appears to be damaged or corrupted. Contact the vendor of this application.

$Erro ao recuperar a pasta do Windows

*Desligamento do NT: erro OpenProcessToken./Desligamento do NT: erro AdjustTokenPrivileges.'Desligamento do NT: erro ExitWindowsEx.

o em disco insuficiente para arquivo de permuta) ou arquivo de gabinete (.cab) corrompido._As informa

es de volume da unidade (%s) n

Mensagem do sistema: %s.

o e tente novamente.pO programa de instala

/C: -- Override Install Command defined by author.

eAnother copy of the '%s' package is already running on your system. Do you want to run another copy?

Could not find the file: %s.

pia do pacote '%s' j

sendo executada no sistema. Deseja executar outra c

vel encontrar o arquivo: %s.

:The folder '%s' does not exist. Do you want to create it?hAnother copy of the '%s' package is already running on your system. You can only run one copy at a time.OThe '%s' package is not compatible with the version of Windows you are running.SThe '%s' package is not compatible with the version of the file: %s on your system.

xito quando executadas por um administrador.

(A pasta '%s' n

sendo executada no sistema. Apenas uma c

pia pode ser executada de cada vez.PO pacote '%s' n

o do Windows que est

sendo executada.FO pacote '%s' n

o do arquivo: %s do sistema.

11.00.9600.16428 (winblue_gdr.131013-1700)

WEXTRACT.EXE .MUI

11.00.9600.16428

iexplore.exe_1204:

.text

`.data

.rsrc

@.reloc

Bv9.jk

Bv.TBv

>.uzf

.us;}

IEFRAME.dll

MLANG.dll

iertutil.dll

urlmon.dll

ole32.dll

SHELL32.dll

SHLWAPI.dll

msvcrt.dll

USER32.dll

KERNEL32.dll

ADVAPI32.dll

RegOpenKeyExW

RegCloseKey

GetWindowsDirectoryW

_amsg_exit

_wcmdln

UrlApplySchemeW

PathIsURLW

UrlCanonicalizeW

UrlCreateFromPathW

iexplore.pdb

KEYW

KEYWh

KEYWD

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

ÃºW1

.ApX/

H.ZAf

Ã°[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

user32.dll

Kernel32.DLL

xfire.exe

wlmail.exe

winamp.exe

waol.exe

sidebar.exe

psocdesigner.exe

np.exe

netscape.exe

netcaptor.exe

neoplanet.exe

msn.exe

mshtmpad.exe

mshta.exe

loader42.exe

infopath.exe

iexplore.exe

iepreview.exe

groove.exe

explorer.exe

dreamweaver.exe

contribute.exe

aol.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

DShell32.dll

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}

"%s" %s

Kernel32.dll

\AppPatch\sysmain.sdb

-extoff go.microsoft.com/fwlink/?LinkId=106323

-extoff go.microsoft.com/fwlink/?LinkId=106322

-extoff go.microsoft.com/fwlink/?LinkId=106320

kernel32.dll

{00000000-0000-0000-0000-000000000000}

\\?\Volume

shell:%s

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)

IEXPLORE.EXE

Windows

9.00.8112.16421

svchost.exe_560:

.text

`.data

.rsrc

@.reloc

msvcrt.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

KERNEL32.dll

NTDLL.DLL

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

RPCRT4.dll

ole32.dll

ntdll.dll

_amsg_exit

RegCloseKey

RegOpenKeyExW

GetProcessHeap

svchost.pdb

version="5.1.0.0"

name="Microsoft.Windows.Services.SvcHost"

Host Process for Windows Services

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

\PIPE\

Host Process for Windows Services

6.1.7600.16385 (win7_rtm.090713-1255)

svchost.exe

Windows

Operating System

6.1.7600.16385

iexplore.exe_1204_rwx_10000000_0004D000:

`.rsrc

ServerKeyloggerU

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps