Trojan.NSIS.StartPage_8b6da4b161 – Adaware

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1736
GoogleEarthWin.exe:2788

The Trojan injects its code into the following process(es):

dlmgn.exe:892

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process dlmgn.exe:892 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\en[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\iconos-ie6[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\box[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\ender.min[1].js (16478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\810b[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].css (1417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].js (21071 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\en[1] (1558 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\applicationIE6-app.min[1].css (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\GoogleEarthWin.exe (261127 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process %original file name%.exe:1736 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe.config (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe (8776 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (0 bytes)

The process GoogleEarthWin.exe:2788 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Desktop\googleearthinstall.log (781 bytes)

Registry activity

The process dlmgn.exe:892 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 2E E0 C8 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A A3 1E 7B 54 45 27 78 C2 09 6B C3 89 16 05 B2"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 3E 45 52 15"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"B1BC968BD4F49D622AA89A81F2150152A41D829C"
"B94294BF91EA8FB64BE61097C7FB001359B676CB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:1736 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 9C 6D BC 50 AF C7 61 B7 D4 A5 CA 3B 33 40 1C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process GoogleEarthWin.exe:2788 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 90 EF 8B 9E 45 83 8D EB B0 2C 00 2C 41 D8 81"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

MD5	File path
f8a7093ec1b8a8e28e5856197bbaf54f	c:\Documents and Settings\"%CurrentUserName%"\Desktop\GoogleEarthWin.exe
3c8fcdd5824e8194f999e9ca50c3c751	c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\dlmgn.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1736
GoogleEarthWin.exe:2788
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\en[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\iconos-ie6[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\box[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\ender.min[1].js (16478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\810b[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].css (1417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].js (21071 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\en[1] (1558 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\applicationIE6-app.min[1].css (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\GoogleEarthWin.exe (261127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe.config (291 bytes)
%Documents and Settings%\%current user%\Desktop\googleearthinstall.log (781 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

No information is available.

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	23628	24064	4.46394	856b32eb77dfd6fb67f21d6543272da5
.rdata	28672	4764	5120	3.4982	dc77f8a1e6985a4361c55642680ddb4f
.data	36864	154712	1024	3.3278	7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata	192512	32768	0	0	d41d8cd98f00b204e9800998ecf8427e
.rsrc	225280	13936	14336	4.05703	1f6cc5aff1c80ee98a4bef7a9c2facd6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt
hxxp://crl.globalsign.net/root.crl	108.162.232.198
hxxp://crl.globalsign.net/gs/gscodesigng2.crl	108.162.232.198
hxxp://os.wosign.awsr53.qihucdn.com/ca1-tsa.cer
hxxp://northstar.393532df4f28.api.socdn.com/installer/4d48823a-b8b4-4f4d-b72e-794a5bc06ebe/1345/config	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/ui/11d/en	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/app.min.css?2015041501	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/ender.min.js	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/applicationIE6-app.min.css?2015041501	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/iconos-ie6.jpg	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/box.jpg	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/app.min.js?2015041501	52.20.122.55
hxxp://wnpcdn.com/icon/810b.png	52.20.26.1
hxxp://dl.l.google.com/earth/client/advanced/current/GoogleEarthWin.exe
hxxp://www.winportal.com/thanks/?q=Google Earth	54.208.39.191
hxxp://www.winportal.com/thanks?q=Google Earth	54.208.39.191
hxxp://www.winportal.com/google-earth/thanks	54.208.39.191
hxxp://googleadapis.l.google.com/css?family=Asap
hxxp://wnpcdn.com/css/ie7.css?v=1	52.20.26.1
hxxp://wnpcdn.com/min/?g=css&14	52.20.26.1
hxxp://gstaticadssl.l.google.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot
hxxp://wnpcdn.com/images/blank.gif	52.20.26.1
hxxp://wnpcdn.com/images/logo-en.png	52.20.26.1
hxxp://dl.l.google.com/ga.js
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js
hxxp://wnpcdn.com/images/grad1.png	52.20.26.1
hxxp://wnpcdn.com/icon/648m/apli-master.png	52.20.26.1
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/afr.php?zoneid=31&cb=5515585
hxxp://wnpcdn.com/images/langs.png	52.20.26.1
hxxp://wnpcdn.com/icon/1195m/petousb.png	52.20.26.1
hxxp://wnpcdn.com/icon/1383m/installshield-2010.png	52.20.26.1
hxxp://wnpcdn.com/icon/892m/stardock-mycolors.png	52.20.26.1
hxxp://dl.l.google.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=www.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/images/de0ae333c183355452cb397cf09eeffb.png
hxxp://wnpcdn.com/icon/875m/animated-inverse-cursor.png	52.20.26.1
hxxp://wnpcdn.com/icon/11653m/idm-scan.png	52.20.26.1
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://www.winportal.com/google-earth/thanks&cb=b54e227aa9
hxxp://wnpcdn.com/icon/752m/pdf-download.png	52.20.26.1
hxxp://wnpcdn.com/icon/9277m/winusb-maker.png	52.20.26.1
hxxp://wnpcdn.com/icon/1412m/stanza-desktop.png	52.20.26.1
hxxp://wnpcdn.com/icon/40m/norton-removal-tool-xp--vista.png	52.20.26.1
hxxp://wnpcdn.com/images/footergrad.png	52.20.26.1
hxxp://wnpcdn.com/images/social-icons.png	52.20.26.1
hxxp://wnpcdn.com/flags/flags.png	52.20.26.1
hxxp://wnpcdn.com/images/buttonbg.png	52.20.26.1
hxxp://wnpcdn.com/min/?g=js&4	52.20.26.1
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js	216.58.209.170
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.174
hxxp://crl.globalsign.com/gs/gscodesigng2.crl	108.162.232.198
hxxp://aia1.wosign.com/ca1-tsa.cer	54.229.101.94
hxxp://www.google-analytics.com/ga.js	216.58.209.206
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	212.30.134.174
hxxp://www.secondofferdelivery.com/www/images/de0ae333c183355452cb397cf09eeffb.png	23.21.214.217
hxxp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot	216.58.209.163
hxxp://www.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585	23.21.214.217
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt	212.30.134.174
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=www.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~	216.58.209.206
hxxp://fonts.googleapis.com/css?family=Asap	64.233.164.95
hxxp://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe	216.58.209.206
hxxp://www.googleadservices.com/pagead/conversion.js	216.58.209.162
hxxp://www.secondofferdelivery.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://www.winportal.com/google-earth/thanks&cb=b54e227aa9	23.21.214.217
www.google.com	216.58.209.196
flex.atdmt.com	131.253.12.190
www.google.com.ua	216.58.209.163
googleads.g.doubleclick.net	216.58.209.162

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /root.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.globalsign.net

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Fri, 25 Sep 2015 03:33:53 GMT

Content-Type: application/pkix-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=d397aa8013c82ce98553480a71ffa202a1443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Tue, 07 Jul 2015 00:00:00 GMT

ETag: "559b1680-289"

CF-Cache-Status: HIT

Expires: Tue, 29 Sep 2015 03:33:53 GMT

Cache-Control: public, max-age=345600

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 22b3ab90de4e0c83-AMS

0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA..150707000000Z..151015000000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......0*........,^.....141125000000Z0.0...U......../0-0...U......10...U.#..0...`{f.E....P/}..4....K0...*.H.............{...........(.'o.../..c. ..,~..m....]yq.6....X..........P...O..!v...b..A.2~..m.O.t....~&\9R7P.V...e..H.[n.0......{.M....~YerR."...0..(......TM...M......@h...Q-u.C...R2f..F.g.tSt.J..P.....<...>....M.'..m7d.6;....u..?..Ch....r.....|...T,I.ex...8...wB...J.u'.HTTP/1.1 200 OK..Date: Fri, 25 Sep 2015 03:33:53 GMT..Content-Type: application/pkix-crl..Content-Length: 649..Connection: keep-alive..Set-Cookie: __cfduid=d397aa8013c82ce98553480a71ffa202a1443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.net; HttpOnly..Last-Modified: Tue, 07 Jul 2015 00:00:00 GMT..ETag: "559b1680-289"..CF-Cache-Status: HIT..Expires: Tue, 29 Sep 2015 03:33:53 GMT..Cache-Control: public, max-age=345600..Accept-Ranges: bytes..Server: cloudflare-nginx..CF-RAY: 22b3ab90de4e0c83-AMS..0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA..150707000000Z..151015000000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......0*........,^.....141125000000Z0.0...U......../0-0...U......10...U.#..0...`

<<< skipped >>>

GET /s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Thu, 28 Aug 2014 20:43:23 GMT

Date: Wed, 19 Aug 2015 05:22:26 GMT

Expires: Thu, 18 Aug 2016 05:22:26 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 9590

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 3190297

..........e.UX......k........S....[......;...EB..)...Z..D<...\...\......r....6.`.....K...(&...... ..?...C.........\.......@...W...j.....p...<.#~..Z.......W.7..?#!.?@...._....PM......l..~.d..&H:.J.Y 6..y.......0..%.Y...U..:r.B.O.WT....g._.......h.4.t.........c...t..a..I..wG.`Y..BwC.&.,4;. .........|7Dn.{.v.......tI....veR...'y8...I.x..^....x4R9....lO.-.5..8Mq.(.c..0.......~.*J.;n....z.......A.)j.d...X...K.S..$f.._h.$.{.W%.&.OK.8.C...]r...w.Sx........y_.YH.5..ISR.a....."..Z.9..7R..-._.'...8............YC.6T...;J...........W..s....A...:^p|yL#.<Z.tx..l.y|....._G..Vkm0...D.UB./..J.>..B..$.....b.q.... ..d..".E ..w.<[.......v....{Zn.....N...8r.q.c..k.....~\...:.*O....T{.v..!v.Q.z../....N..7R..Cf.....i..J.$..0s.F.w'..../T{..Y.:.T...v..GY{:3.hL.......B..W ...LBp~..9>....(..7.Y|....9...Es..........AV.QL.....;z.X}.$..j.;h.........Q.Z...F...?.65..5y..d......W.....@.}m]$.T%Q...F..m$,B...7..W..8y.n2.......n6...T=..`...]......l.xY.Eu.......[<.k...?I.r.G...*/._.......f.O,.8....~.\.w..kh.........//Uf.^...m....b.....e..c.....oG....a.l....X%d.-....pO..1'.... .9..&.c....x5.'....Xg....r..Ov.U...$........2).!....uW.'..}5.l..M......./.r7...&.dGu)......_.#U..n.N._...)....2L....J..q.....%p.....dj.Q....Z...e..JVz.......cf..[.M....q_u..Mgm..Y...ja.K....Vdp/Ws.q....G...d.8.K.I........>..E.%......^Jue.F5..t...... ....@U.5.T.s...T.._......%t..SPI..x.z....Ew..H......u.L..a(-%%)........,..{.y....Q..T0&.O.5.m.*sy..L...a.N.n.....[b..9..Za..X."........Y.....v.u6.y.......XP.B@./...j..* ....8'1gI..s.S=\..%..U W..[.`.*.E_-..

<<< skipped >>>

GET /ca1-tsa.cer HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: aia1.wosign.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/pkix-cert

Date: Fri, 25 Sep 2015 03:33:53 GMT

ETag: "555f0960-57a"

Last-Modified: Fri, 22 May 2015 10:48:00 GMT

Server: nginx/1.5.13

Content-Length: 1402

Connection: keep-alive

0..v0..^.......^h..q.cPV.h.>...0...*.H........0U1.0...U....CN1.0...U....WoSign CA Limited1*0(..U...!Certification Authority of WoSign0...090808010001Z..390808010001Z0U1.0...U....CN1.0...U....WoSign CA Limited1*0(..U...!Certification Authority of WoSign0.."0...*.H.............0...............V.{k\z..k.....#.....1.>..)o.=.k..@_.9..z..MT}."x..........Kt..~......I(D...2.%.S.........q'......gh..]..]p.....SA.....6fz~V.._..h 6..$,,G.Yvf0..........0.....,.....(..T....v..h..Jl.........\..~.2.^..*B..N..Y..z~...Z....i..'.{..T..{..TzQhnw...RJfF..g...Ow..]..V.Crw.....9........./0B7!.0p.....XM..}...7...2..:cq$..7..t.7....F`...?P6..z..bjn..j!Zi....p9...n......;q..R.....w..o.B.mJ..4H......"..1.?.>.. y...dd.1...R..Ei..*.U...FK.J..[9(.......HK&.0L.X..D.O...3..........q).vO.%...../..../'.J....|.E....E...=......B0@0...U...........0...U.......0....0...U.......f.....K.. ........>0...*.H...............r@.v.~{..d.2{.<.]F..,.p]....}...!..Y$.....}.#.4..|r....T..Rp....;.:.2.!9.....Oj...?/|.X...9.>.=Js.@z. a.g..$..mU,Z..%r.....Ub...c.aD#........M..#N!.[9[W./].^.y.|..M......y.3....0.>...C?.Z..D..|.H.3.......>.]q....t.aY...Z..r..]6....<....D&....p.......@Z..l{,.V.G......!..f..%0.\...g..m....O...'........H......>LQ:.......&.:...i...)dQoh....A.........=..h..g..`.U.a.W|...aI:.u....?g...(.1..W...|..~.....6|[~'.z.....R...Tp1.C....>..~0dP....3gMhO..........%:..Y..\F.g,.F..H..[...Q......7"... t.-..k....!..y.D.........

<<< skipped >>>

GET /s/applicationIE6-app.min.css?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 25 Sep 2015 03:33:58 GMT

ETag: "5603ac7a-1633"

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 5683

Connection: keep-alive

div.data{margin:10px 0 0 0!important}#app{position:relative;width:728px;height:428px;margin:0 auto;text-align:center;background:#eee;border:1px #abc4e0 solid}#app div.publisher-logo{background:url(winportal.png) no-repeat 0 0;position:absolute;left:20px;top:10px;width:150px;height:50px}#sidebar{text-align:left;width:160px;height:375px;z-index:100;position:absolute;left:2px;top:0;overflow:hidden;margin-right:0}#sidebar .logo{width:140px;height:40px;padding-top:5px;text-align:center;vertical-align:middle;margin:0 10px;margin-bottom:10px}#footer div.sidebar{float:left;text-align:center;width:160px;position:relative;right:135px;top:0}#footer div.sidebar a{color:#777;font:bold 10px Arial,Helvetica,sans-serif;text-decoration:none;display:block;line-height:10px}#footer div.sidebar a:hover{text-decoration:underline}#abw{background:#ddd;margin:0 12px 10px 12px;padding:10px 10px 7px 10px;text-align:center;border-radius:7px}#abw div.icon{background:#fff;margin-left:4px;margin-top:15px;width:100px}#abw p,#abw a{font-weight:bold;color:#777;line-height:15px;height:27px;overflow:hidden}#abw img{width:64px;height:64px}#topics{margin:0 0 0 5px}#topics ol{list-style-type:decimal;list-style-position:inside}#topics li.active{background:url(iconos-ie6.jpg) -253px -325px no-repeat;border-right:1px solid #f2f8ff;color:#333;font:bold 12px/34px Arial,Helvetica,sans-serif}#topics li{color:#444;font:normal 12px/34px Arial,Helvetica,sans-serif;margin-left:7px;padding-left:10px}div.publisher-link a:hover{text-decoration:underline}#footer{p

<<< skipped >>>

GET /s/iconos-ie6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: image/jpeg

Date: Fri, 25 Sep 2015 03:33:59 GMT

ETag: "5603ac7a-1a3e"

Expires: Sun, 25 Oct 2015 03:33:59 GMT

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 6718

Connection: keep-alive

......Exif..II*.................Ducky.............)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:083E11C9A93A11E38238EC1A77F349F6" xmpMM:DocumentID="xmp.did:083E11CAA93A11E38238EC1A77F349F6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:083E11C7A93A11E38238EC1A77F349F6" stRef:documentID="xmp.did:083E11C8A93A11E38238EC1A77F349F6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDDDDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6 6DDDB5BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD........].."................................................................................R.!Qa.....S....1...A.2r.Td.q.."b.....B3.4.#Cc......................!1A.Qaq...BR.............?...N{..9e..D...'.$*.S.'e..7i.*g.Jl.JJ^.f=..s{...vL...u.'j..{-j5.....g]..?.D..G ..@........................................................................=*_.2..mj='..d..V1...bP..C.......................................................................................................

<<< skipped >>>

GET /min/?g=css&14 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: text/css; charset=utf-8

Content-Length: 5672

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Vary: Accept-Encoding

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

ETag: "pub1435676311;gz"

Cache-Control: max-age=2592000

Content-Encoding: gzip

...........=...6....n.\.g..^%.T.*...>..i_f.R..I.)RKR.n../.-.e.;....n'....bw.............u.......e.=..E..j....D..MYo?.wu..m.........n....z[b..6uwX.p.?t...'....Y..._......Z.......(.?[...5..Z............uY7..8...............v.X....M......#..-.oQ..-n....{. ....:...v.'...ys,...........)....P..;...s.....u...._..P?.R...*.MY..M.?.....oj...n..y..|.........Ay....;..'.:...z~B.{...t:...1f.......?h.y*........n.6...dN...........K....i.....b.........F.....b..a..JT/...U6g.i(;....|.(P.....lP...&X).<00.\s.f..P....!{.w.......p..m.......t..P..r.....!.?.=d......=./p0.....2...7>..TusD%......mF..S.r...u.R:....3.[..1.....@..ab..........P.0..fm.....0.........Ce...H..!Z\.....\S$...-)..L.m.2....bJ....Y..Z.zn.b.l....5eG_....>.}Y..,>.?\...YY.[...W..DxR...ij%....)....e_......^a.O.|m.K..L.w.....Tb....,..D[..P....,.=..~...l>....?.. ......./S..Mt.NGE..l.w'&^z..|!.b...B@,bJ..1 ......^......G.3.e.6%.$..PG.!'"Ft.rCb.....J..M[........>.....8...x....*R...bqAAY.k ..3.>w.U......H./.....t#T...*G..C...Q....j>"..}....\.......ul...<)...:].Alm.%...M;p)[.....a.z{.7=\6.~.2....H..dqr...b...i...Lk...m...?......b..|g....CW.B...}.O...:..<v.s.tOE7.BW.FT...>..>o...].....%..............z!...B..8. *..ah.8`)..!.V.......0j.O...M.L..f.R............0.D..%.fF.R..e......w....x....mON?)..<..c.G.aA..E..t......s..F....T6E.....Z$...{.~..........C.].t 0.....f..r..0....|qx/`W.@....1.E........b....lV..tT...EnFK..j..7!..A~Y.d'.....(2]9..j.....H......1@...CC..P1.>7.9.RE'.Dd.n..&..l.....U...1....*.O.."...t.d....c`.e\...%~j.fM...B.m.#..0

<<< skipped >>>

GET /images/logo-en.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/png

Content-Length: 7622

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-1dc6"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.......<........f....IDATx...y...}.?..^..zUw..Z[............C..0"...8..ll..$3.6....A.L6&6...C..H8........;.$...F.Z..-=...Z..Q.^.W]o.ZZ".wN..Wu.....o..{KH)iP...F......,...\q..i...K..@...F.cH9......?S..P.`..`...|.KC..=..j.......n...zT....H9../.../...A......7..u.m.=.r......2u.4...6...c..5..A...........z.. .......)..........C...........?.._...X".i.Un.H..xy@"..i$..D..i..V.=......Jc..t>....=..(...7-.......g...iL#.{.'.,.w3sg.......x...^r..x..2l....a....E...C.O....5h..p.........N.....7.ri......g<w0VCH..=..e.o.....{...C....C.M.<..'.C8^...... .....%...............t.....7g5.q..c[.%px~.!D. I........=.K{S/......ex.e.F.bh.)Nf...K.Lc.R5W............. 0$....g\/....y.e...p0.._.....pE.A.....J....ON.......kX.y.oYr..2.....e.._.-.`.I,...5..O..........A........F....]..1Mv....u...e..(8.Xf:...tiI....f..7I"......I...9........v...v.}...k.a`.......... ...<.....(.~...`.........8^.U.}.y.W1.=....e`....]...._`q..hI...^..C.......Y.%....\.............. .......7.[f.O.....Q.?.\..j...M.r.>..T.."m.E...4'.....;xm...M?] ..........@...1......8.f......^.....~z.VPt..S.....@...........X..`04.M.y~. .}..wy...1<...lF.D...>.t.r...jY..;.....p\.D........be...^.)K.......q.:G4L..5..p..j.6.~. .../0........./22....TK...Y.... .|..u..GJYv.*I...E.#.;...k...O.u....4.):.|..%..........6>.>...^..q.........dh.gJ#.......}\..E|_.K.L..!....a.8?.s.}..^t....[......^.}....*..(.q..(.\.q.{... ..YK.&....,....;......._..7ie......,%..}..k`R.......{Q.&=.SG....."e..7.z.*./.2.....{..6..l....T.....t.w(.......qt..N..........m....VM..R.....~p

<<< skipped >>>

GET /icon/648m/apli-master.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/png

Content-Length: 2405

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:55 GMT

.PNG........IHDR...0...0.....W......,IDATh.....dU..?.s...]U.=..0..........`4Q....Dw...t. .].n. t..h...AL4.P. `.3...G=....>.V.......%.....{..w~.s....S.*"....W7..x.............._.y._......<S..bZ..U]X....I.n..gj..c..A.Hm..ej.Q...5..i^....R....2......q..(.8..N|.T.%..r..%@...............e...>.T.4...*........CQ.9...Y.5.iZ...t..2.......<P .U..O*7........jx.....U..h.....1...eiK.!s..g[.`aF.yu.5m]NK....7^*g.W."{{.E.."...&h.."L.p.."....n....>.@#.?(s......../......L.V.y........Y.e.t.|..|.{....X}.i..~....H&..f.=.c..wV....HV...J......."..*..$.i..D..YKLfb.K....7I.U...<%Hb.TI...F.!1.U.K..4!v=..u....`p.N.c..JA..`...S"QR.S._AD..C|.<.....uA-V.F..3...A.G......g..A..).M..r....m..3?$....../.Ask.T.;..8...L.}....W^.{..l.....t.^.w...J!.)Qf%Q..!.s.C....7..|..'WIJ..9x.-..k..O.<.8N.@.........B..vj..._.....:...l..k.....[M.x.oc......G....("I....Q(7...O..k..T..-.C...f.......>.. ..Mf,8.>.........S........e.......).......mG%...I........~..s..c...O.~.....h>.0C..V.qDr.*.k.rG..[,N....fj....Jf.K).|..`l,.=_C..PUF.}....D....{.".f3/......=?..k?x*. NHwv.(....ts.:m_.K.y`1Me.E.T3LC....#......8n..D.....>M*........1...\.D.....o.Z...4.N..b.=.4'Y.=G...uafRE..Z.^....2[.N?. ....<......\.....t!6/........F./.p'.....|S.7B......g.8.....".y`.u.....b0w.!<{6...C.^{.....O}......h<.....f9.D....llmc..0t..T"8..q... I.......Z._....T..)2.B*......C....^.d......{;....]0..em<A.}..=.....q.XDqTq....K.9....>...#..A..QD...d....R."........{..,..eFj.a...6P.?I.\.ER.0...>..N."QL.z.F......7I.|.b.{...F.r e.U.....Db...hH3.s....#..}.

<<< skipped >>>

GET /icon/1195m/petousb.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3965

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:30 GMT

.PNG........IHDR...0...0.....W......DIDATh...k.eWU..k.s.}u.~.f.33.L&........A4.B(...B...R..7.R?R~....h>P%.E.P......Bb.L...2a.=.........s.^~...GwO@..]..{.>.......k_Q..B......z..?...@@.=........9....k..b.t......h..A...O....V..{..A....m-U.aTE...ncW...i.|.m..~"....}.w.....J...^.).-...............v....o.J...X...W..W....!...t....7...........N..h......v.S..x.>....G..P....:e....r..)Z..".T..T.0..#S.0.5$.....e...\A...#e..1...G......5.(.......O?...>.j.BT.....:.v....<.....H%......R:.....oa.dbp&...>.^...5........ad[F.K......o....n.Q.<B<8N.%..y..'."..v.5X]P1........i.p'.G..%.>MEAp...../ ....s...\.....ocq. ...\:....'>.^n.7...........=........4..S...g....?.uj..6,lWEp.....?~...>...7.V.D5. ......~.K...9&WOS....x.l$.,.\O.g...]..........{........u.6*.W`n.*O..@i..$.{....X.....2JY.#.Nx.Vv..K....S_...Bz.~ZQ..2....c........2F}....S..e..WXz.<.6W...C.M..3g.....n........... mK<0..T1. F1........M...............C.&.O..qp.E6..$..Gi....6.?.oL=.)F.....d...4..1.i.....n.2..@....M....w..J.[jpx...>.V.S2bJI.....j..m.n.T....Kv..x.....6.:...._cf.....].......w...2.~..o=.......-....r...............~....{6/....P=x..&f.....Q.....1.D...h..H.C.$4.......F...*Ys...}\...d...(..U...@..H..0z......ri..{.C....Nj4}. G,.9.....4e..K..=N4.g.W......(y.W......(0dbP..Z..W..h....X..0..%.bM..2....t.J{....A..=.Mv.I.Z.*v.*.r5...Pk..s/"..AR...n.K.do~...f..[.A,X#X.F..2........>W.jR.."&.`V=../2..?...y.Q..[y..... ....S..P.................*..&.....x..S.N.....g......Q.7.... >..C%..X3. V...b...Dh..i...pWs."..DW.|..:KQ9.....U.?......

<<< skipped >>>

GET /icon/892m/stardock-mycolors.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 4220

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:04 GMT

.PNG........IHDR...0...0.....W......CIDATh...kl\.u..g..}r..(..i.Q.J.....M#W.. -PD..8**.MQ8.. .b.h........u. @........M..).'v.(~..e.....$>.]r..1..w...Cr......sg..3.1g.b....nX.V.% ....,?.......u.......(u"..cj5.....$q.$..L.......%...8.%.....k5.f..6.o.s..3.2SO......W.g.&..C....;w....vt...(.YWR.!.........>.ub......1..s...QJ...k-...&b8mm$..h.s;..}$w..f2....t....L......|.7...C..NL`D..b......y.m{..r...w..M.1@.\&..Q(..}.i .u.d2....L&....Zj6`-.H....)....?......6}.ZC...."......(............B...".r.6H.]"........v...]w....;ikk[ ....Z.j:..5..~....N.R........2......a@....M...L.aK.E..u%.=6.!..<...~.......>:;;._.........)..9L..3XQ...T.Q..JaH5...>A...N...x.uy'.....L.......i..9....I&.k\e3.f;P.....J..u....B..c#..D.....|.p.2..}F..t.....\A.;@.P..G..._.*'O.\....0.bj.....M.F.Rh..k.u[X&_..K.\XZ..2..-...D.T.... ..D...1.|.A^|...m`.^d[.8.f....!.\.Q.......k.N.|.....9......t.K.].fcq|...4....f.|....X,../}...d...F....u..\.:3....F.........1@..X.-.2..|q..F...,....U.....Er..5..5......... .......r...k.vV&....r....5. .........."P5)..../s{{;.g2Lj.xh.6!E..Z...iM&...j...O.`...s..Q.....w...........)...].T.c.;I...._..1d..i.<v.R........ .Fi..B..2..bViW..<...<...tww.K@Im=.)x..6.%...d.0r[X.....#.gS:EW"AZ)..3.....R8J.Zc../...y.X"^...|R...?Z.1eB.0 ../..9}.4.=..Jd_%k....1!..o...>J)B..8.'n.. (........ .._.sq1...S.W4..5"...B.(...3.(.....J.E......<....8p.[n.eMdt..%ZYb....W.}.d..E.....U)1...............Gu\h=c.=.gh....%...\..R...p.....x.j..B.......K,.ql...mC.<.c.........W.@....c...g.............R.!....|.n,!..{.F.Rc..f..1H}.0.3.9.

<<< skipped >>>

GET /icon/11653m/idm-scan.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3759

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Mon, 03 Dec 2012 18:20:31 GMT

.PNG........IHDR...0...0.....W......vIDATh...i.#.q....n4...{j..L..(9..._..P.").;...08.....n4vH...=...@U....Y..\... b.Q.%....@.D....^.....a.(.q...`......).....@..G..^..........H.>h.....|.J.`...Y...`Y.. -......8DM/...|X.9.W*.k/.........nxP..jIQ/.....5.{ZBH.q$IJ.L..9..b......j.7.`....V....a.>.%..G.bW=.....Z...1....6o...:.Ip6%..&...hAj.8;E..*.&..`..y..G.~1..z..........R...;.....#.EU...3.G.`...... ..v.d.`>.$KOqv.....C......Y......_....{Tr..h.....j.h.A.....UPj....&..PGb'...,f/.............sG.z...;=E.4.ix...........f\..3....O.E..P9V....]...)e.#/...%e.CM.....U.&...d.,f..L..L@].Q.F}~....uB..P4 ~z.K..ZRs...o..W.T...*_.....R-Fgd.%......YM..X.......'.....l..]y..r...kNg.p2C...G....Fp.*G..x).[..'G..&.>.Wf.5...?}...@e..1..II.I0..0....p1;.|..u.a..e..H.lA*..R >>mxX.......o.2P.<..h.@.o1}R.(......D.M.X.c.].WK>-..}...fP-...:&..NF.......M..N.Z\p:.G^>..~`W<.. ..V|z../.xy.%V...T.W...z.,!DA 9...*%.0I.8..d...v.W*.B....B.Q.K...e.a.-upsxOUA....l.${..zd..a...j..`U...{^]|Mb......... H....'....d./^. .......*....j.P....'..d....cQ.#..}....V...7L/...w...#..PiY......g.`...z..L$......J.W....Q...J..L...-..za.\s..'......vxt.vx...A.`5c6z...?1...ac....l........"..(.g_/.E..u,...-...-....[@A<..#{....I..4..{...=r...>".....VNxu.5.;...9...........S.a.............XU....l3s......9...^...^`.}.T.|.~Gd.w.b.sy..C.J..z...(......J..l.GT<..b~.j.........0..\....A.........Y{.D..A1.?...Zf.k........).....JH..^Q7y..1.lLQn.....cH..W...1G.#...[...}_U{Oy...E}..]r...1.-.....7q..rB@.......dNS. .......I9..#e.. '~.N.!..Q?..\.......1...`

<<< skipped >>>

GET /icon/9277m/winusb-maker.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3759

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:07 GMT

.PNG........IHDR...0...0.....W......vIDATh...i.#.q....n4...{j..L..(9..._..P.").;...08.....n4vH...=...@U....Y..\... b.Q.%....@.D....^.....a.(.q...`......).....@..G..^..........H.>h.....|.J.`...Y...`Y.. -......8DM/...|X.9.W*.k/.........nxP..jIQ/.....5.{ZBH.q$IJ.L..9..b......j.7.`....V....a.>.%..G.bW=.....Z...1....6o...:.Ip6%..&...hAj.8;E..*.&..`..y..G.~1..z..........R...;.....#.EU...3.G.`...... ..v.d.`>.$KOqv.....C......Y......_....{Tr..h.....j.h.A.....UPj....&..PGb'...,f/.............sG.z...;=E.4.ix...........f\..3....O.E..P9V....]...)e.#/...%e.CM.....U.&...d.,f..L..L@].Q.F}~....uB..P4 ~z.K..ZRs...o..W.T...*_.....R-Fgd.%......YM..X.......'.....l..]y..r...kNg.p2C...G....Fp.*G..x).[..'G..&.>.Wf.5...?}...@e..1..II.I0..0....p1;.|..u.a..e..H.lA*..R >>mxX.......o.2P.<..h.@.o1}R.(......D.M.X.c.].WK>-..}...fP-...:&..NF.......M..N.Z\p:.G^>..~`W<.. ..V|z../.xy.%V...T.W...z.,!DA 9...*%.0I.8..d...v.W*.B....B.Q.K...e.a.-upsxOUA....l.${..zd..a...j..`U...{^]|Mb......... H....'....d./^. .......*....j.P....'..d....cQ.#..}....V...7L/...w...#..PiY......g.`...z..L$......J.W....Q...J..L...-..za.\s..'......vxt.vx...A.`5c6z...?1...ac....l........"..(.g_/.E..u,...-...-....[@A<..#{....I..4..{...=r...>".....VNxu.5.;...9...........S.a.............XU....l3s......9...^...^`.}.T.|.~Gd.w.b.sy..C.J..z...(......J..l.GT<..b~.j.........0..\....A.........Y{.D..A1.?...Zf.k........).....JH..^Q7y..1.lLQn.....cH..W...1G.#...[...}_U{Oy...E}..]r...1.-.....7q..rB@.......dNS. .......I9..#e.. '~.N.!..Q?..\.......1...`

<<< skipped >>>

GET /icon/40m/norton-removal-tool-xp--vista.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3997

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:46 GMT

.PNG........IHDR...0...0.....W......dIDATh....ST...?w........(...T*..r...fav.d..#...&....,R&. .*..T.q.Q)..B.F...64..p.wA=On....{......>...=.{..x..........(......S...uq.....KUUTUE.u..@U..k.=..)....7-..6..<...."%\.%...H$XXX .J.....y....ix........iTVVRSSCkk ....B!TU.g.{..... .y....-.L...3...)))......&....D"....-...r..i..4.....y...9r...h.@*..(....oa...E...y..%...tuu...H ......G ....r.m....011A"......G.R]]..i.......~.Y[[chh...Y..........M.p..B.@...4ML..q............$BkkkLNN.H$.......P($.-..M..............o.&..r..I.......r9...X]]e}}...u...D...h.F(.".....)--.0......KEFGGq]........!.zo..p.EQ......~.......S^^N.P`yy.D"A*.bmm.....~.......f....u......m.x<..........Q.T..[!................G0.$.J............`...-&..d......&..H.V.E...............g.....y.....O?q..YN.8.i.,,,011.....mc.......-.n...............{....:..>.......1.C..u..........p......333<y..d2).........?....r..q<..4M.?.N4.e..=8...8...211... .htg.s..H.L&..................CR.T..~.nw..0dp.D&..u....:::(--..mFGGI.Rh.Fgg'mmmx..eY$..677.t...`P...*..wEQ.m..w.....O.F.4......>...E..w..a.D.Q....F..B!.....m677YYY!.....Fcc#...8.SSS,,,..*.i211.......M....cdd.X,..c..........SSS...SYY......?frrR.._p........P__/.^...PQQAss..D...H&..b1.|..c.&ccc...PSS.............&...(...B......F.477.L&...bxx....,K&.|>O.P..<..;.......x.'.9.,..,....{<z..l6K.P..,....i...._...eY.......S)<.*"....,,,H.K$......f.m[.o.&.e..:......S...8..aQ....?.(......<O.E.,.....&....jiiadd.L&.O......c***.F...i........ ........g) .q.\.%...i.,..;..=..YW...8tvv...[d}..........A..#...i..X..

<<< skipped >>>

GET /images/social-icons.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 2227

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-8b3"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...%.........FI.N....PLTE..........y.Kf..!1-D{d..)...........Xt./-..u..{.*.....lkk......Ts.c........&$%j.R...857.bs..............?AX....fffF^....Ql.'..y.....>........[y....JZ....1...M^333...h......F}...*))h}..........Jc.B........M..Lh. ..Uq....R...y........':...;9:......,..!..xNS2....TSj....0I....u........"!!f.......................*..%...}.........`xoMJ........:.!v..t..C[....<...*A. 3...,........utu......Jc.........tRNS.@..f....bKGD....H....pHYs.................tIME.....3/..(.....IDATh...._.F..S.sE2..=.f..."_.5Eg 2...68.1....m".... .O.s..%....G_.......}.PJj.i^9..D..i.V.{..\Y....K....>.it=Y...`}L.........2..n..F..l....1k.7...8,H....6,;......nY..u..T....v...,8..E%.....K ....X,.5n...V...P<99Y[S.j.[j.......ZD0 .....i...r)n.$.3...U.Ev.....pn.X.n-.|ii......NkIAZjMd....W.....w.#....-....fE7..@Z......x..j......p..Z....Vg=... F`.......|gV~\ j8.WX.k'.........<...Y";....d.!....G.a...=z|z.Gn'........|%....'.F.}.k..w...d.A.i.u{..@..pS".;..Fn....~.....$.:`0....GGGp.M..../(..I.r....%.\rN.......g......n.n.....u....|...nU.. .K.`....[...p ..R...`whU:.....y..p..G...^&.Tn.....$...2].....,..<_...Q.YA.p.......:|.y....Z:...%Q......l...X..*.6...|.O.bq6...........N..-;T...q...oFN.........x.-%......-;..K.. .'.X...Jl/<.`.5G..B8m...7[hnnn.N.Y..W9..Id....$zo<=z|.d...O......N=....SO!jybkk..dqq.=....X.h..-(.rW...w.Z...D.....B...p/f).20...Un..&...*.k...H....b<.sQ......f...%..c.<....3.....R;.x.Q&s....o...U.4Z8.}.....'..........5....{......(...j.5-(];...q........$..NT......2KXw#...%l...}p_.6...N...

<<< skipped >>>

GET /images/buttonbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 127

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-7f"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR................(...FIDAT...........h...........=...=q.... s...'skV..x...!..IKl....4.-3......C ...F....IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Fri, 25 Sep 2015 03:34:04 GMT..Content-Type: image/png..Content-Length: 127..Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT..Connection: keep-alive..ETag: "5592ae97-7f"..Expires: Sun, 25 Oct 2015 03:34:04 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes...PNG........IHDR................(...FIDAT...........h...........=...=q.... s...'skV..x...!..IKl....4.-3......C ...F....IEND.B`...

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 20 Aug 2015 18:11:19 GMT

Accept-Ranges: bytes

ETag: "803dac9c73dbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Fri, 25 Sep 2015 03:33:53 GMT

Connection: keep-alive

X-CCC: AT

X-CID: 2

1401D0DB739CEE64E9....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Thu, 20 Aug 2015 19:08:01 GMT

Accept-Ranges: bytes

ETag: "803e6c887bdbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50006

Date: Fri, 25 Sep 2015 03:33:53 GMT

Connection: keep-alive

X-CCC: AT

X-CID: 2

MSCF....V.......,...................I..................G.` .authroot.stl.W....8..CK...<T.....c.5(..=..!Ev"..d'..c-iTBWI.H%..V.........E.%)...f....uo...~/.3..s..y>...=..l...dbUH4M...1....&J.}<...#.L..\.x!F.t.^......q..l8p.i.J'3.........J.5v....z-...A4U.T.E...h...}$.....5.=.....VnU..E.[.[a(.."..G..P..k.m.3.....EP>.g..?.kY|..L.v...qDz...T.&p.&..:.f....T.b..\...Af\..J..I.....tN09.......|,[r._..x..Y.e.(d..o...`3........(... .$...V..e.y.s$p...u...........W..~...A.B....GoOV.....JT.."VF.<.A....3...r.......addf`.....ph.J:r.E..[\L.X.:....?.. .....b...l....St...U.N;..a.h-W....4.Uqb.MbF=.X.C..DX..............V.U..P.....'........P=.?...s_.j...W_....P...-..t1@....s:...5..j7[.!Yb|.....l...G.F.E..?lg..m-n.(/6I..........._......5........n.t.<.'....Nim..;.!{........N.h...u.....x`... gR..B..V{.'..=}..=|.hg.9.6....j..w.[P`.G.....d..............!..t./..........*.@(8(v1....'..Z. ....R.r....1Jn.j.[p..At..W;F.(..a...N...X....=.[..'.r.....^$B.a...9....,v-...%.2...:...[..6.j...1..!{.....n..={.U....%...y,.....>a`..0..6..SJda.)9x...zqc..X..Vq.1z.....'^.....^sU|$.u...~.Lgf...Y...V..(f.(...m...-..-&,..c&z...-.....fGO..6...N.y<.z..,...g|.....!..$....<....q......q8.<t.k.p.=......z.}.Q.U....&J..-T......[...........}u...T.......>.y.e..CF".VX$;&T.>..].3.H....7k..w.m...(..#c...@...v....[..l..w.e.2..3..(y. ...|K9>...o..Uz.....V..W|.k.|...,..V.xPmV...X......!.........Jj.%.N_.9T.~...v...C.!.4.5a.!...(..../5j...@p.....S...F.jde........PC...MZO..........D~...%y.....i....a.$vu.7...{.6.{Y3....5.YD.d>,.....b...H.

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT

Accept-Ranges: bytes

ETag: "80b4b9e9dc5d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 889

Date: Fri, 25 Sep 2015 03:33:53 GMT

Connection: keep-alive

X-CCC: AT

X-CID: 2

0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0................O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0...O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<......<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...Sn..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0...U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H..............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU.....9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 200 OK..Content-Type: application/x-x509-ca-cert..Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT..Accept-Ranges: bytes..ETag: "80b4b9e9dc5d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 889..Date: Fri, 25 Sep 2015 03:33:53 GMT..Connection: keep-alive..X-CCC: AT..X-CID: 2..0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0................O.~....%k.H..*.......c..gf.....H ....

<<< skipped >>>

GET /thanks/?q=Google Earth HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.winportal.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Content-Type: text/html

Date: Fri, 25 Sep 2015 03:34:02 GMT

Location: hXXp://VVV.winportal.com/thanks?q=Google Earth

Server: nginx

Content-Length: 178

Connection: keep-alive

<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>......

GET /thanks?q=Google Earth HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.winportal.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:34:02 GMT

Location: hXXp://VVV.winportal.com/google-earth/thanks

Server: nginx

Content-Length: 0

Connection: keep-alive

....

GET /google-earth/thanks HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.winportal.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:34:03 GMT

Server: nginx

Content-Length: 4931

Connection: keep-alive

...........].r.H..;y.YN.b._.. @.!ec'q6N....n*.....u!.0&.y......oF..-....V... ....7==.=../{.;.....A.......\;...J.0.n..x<.........i.5 Sbe.n.#.B.._y^..d_...y.SJ...k{..-F%.n;4..Q8....u.*u<7.n(.N..D..W....Pd.<'.@....FaOh.Ny....V....H.gkR....D....... ...Y.I...<..................V..Vw.Z..i}.....?..-....n....\...L...-w...nW....\..e.....^....oo..^..W.AjA%......7..EOw,{....a..P...M...a...y..%.......w........_.[(.......R....R.d4x(W".5-.U.....a..".....CJ..I...n..h.F../.Z...~..i.>.......g......m....YQ].Wzt..&.J..y_.BZ..?..O.....X.......9...ax#7,?#...A.Ku.!.....y.;. ...u..eT.b..3....`.o.........G.pe.q..Fo.......oP....A...#....q.C.oS.k..1Y.|N.z.u....."(..z0q.....e..V#......`.LZ..l...1............b..e.....Yy.....9#..nOB..f.z...Q.l,.,G}......S...zh..'..s.T...~.y&.Xn@.p..<.n..g$...ms...b$..S|.ui.3'..O.M.....@..}}8..a7n.eK.Vx.'.#;...d..OX](..z@mj..,....m..m...b., .~. ......Iu.V.........0p9.....O...z.....U1...S.c9.X vA.e.o... 'C......y)e)y......:..i...;.E .:...~,}...|.p.......%/.a..~.4.<bq...}E}Gw.... ...z:.> .>...>[?.@nS.h....\D....#........ .......O..FA.C.y1......#....s.......'P......W...gp(.Hb.r.4c!3...O..U#.B.X..~..vx....|..VI....6..e,?...r=U...."P.D.................5.......*.. L...0..3%..._J.d..8-....t...4..kfd.r5..m!.u.6'.....l....u....N..>..1..?$o...*....]j...$...kF....<aJ.X..LE..tm.............Y.c.~..o...)7..."WV`...'.$..{A..GD<..g{6{.....L..V....e..zCU4...h.2.......R......Q@.............Q....`....R._......TUV.&..}..,Ke..../p.*.^..-3.....Y&.j..a..I.t...$..S....\...r........snr./f.,...

<<< skipped >>>

GET /gs/gscodesigng2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.globalsign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Fri, 25 Sep 2015 03:33:53 GMT

Content-Type: application/pkix-crl

Content-Length: 1802

Connection: keep-alive

Set-Cookie: __cfduid=d228cb2a9e0427670368786a53e6746e51443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: 015432

Expires: Thu, 01 Oct 2015 23:00:00 GMT

Last-Modified: Thu, 24 Sep 2015 23:00:00 GMT

Cache-Control: public, max-age=588367

X-Cache: Hit from cloudfront

Via: 1.1 b47ef3766a859c0c1ae31872e114e497.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jfhWD9UoHBaO17LVteJh2FL9nAdzdBBNmX6Dkfjxca6y3AQCzPp8ag==

CF-Cache-Status: HIT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 22b3ab91b2ec1467-AMS

0...0......0...*.H........0Q1.0...U....BE1.0...U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G2..150924230000Z..151001230000Z0..40#...!...z..g{g.Mt..G...121120180003Z0#...!5....u.H.5.n..K...121121154803Z0#...!a. ..5.Q.....g.Y..121127202406Z0#...!.9...^............130118021202Z0#...!.g.|.d..-,...A....130201163603Z0#...!......R..B.....h..130212223046Z0#...!....oL$Ds.|...IN..130327184808Z0#...!,oYM;.LlE.I..D.k..130328114802Z0#...!Im..y..j.|-.`[....130515143603Z0#...!y......"y/9r.;b...130828141203Z0#...!...r!d....%(...I..131111162403Z0#...!H......w.X8...(...131121104802Z0#...!.........G.5g-....131121104805Z0#...!....d.z% C....(...140117143602Z0#...!z.....V....U..N...140117144802Z0#...!/,.Hr.;...u..0C...140123114803Z0#...!.$u^.......O......140212083602Z0#...!........1..ITc.a..140224104803Z0#...!yx.mo`...L.s.1....140224104805Z0#...!.....u....e..!Kz..140303102402Z0#...!mv\......"........140313101202Z0#...!M......Y.......f..140318134803Z0#...!%.t...Y.w.&e..^M..140326160003Z0#...!..8..Y.j.-.. .G...140610120003Z0#...!.l@q...@....jw._..140831091203Z0#...!..../.....[.dCC...140831100002Z0#...!..d.8...|..x,F....141203205323Z0#...!../..X.js..a......141204022544Z0#...!...r;.'.....'.....141204022710Z0#...!....&h..O.6@..8...150202133603Z0#...!7..]...q.F...6t...150225074259Z0#...!..l.~...&n........150407141403Z0#...!.N0.,.............150422200911Z0#...!w.S......FP.ee....150512133508Z0#...!. D.......*.Y.?"..150616081204Z0#...!.d....C.q.|)..5o..150902182412Z.10/0...U.......T20...U.#..0....n......>..t]..../Pz0...*.H

<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 25 Sep 2015 02:44:58 GMT

Expires: Fri, 25 Sep 2015 04:44:58 GMT

Last-Modified: Thu, 10 Sep 2015 10:52:20 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16022

Cache-Control: public, max-age=7200

Age: 2945

...........}kW....w~........pk..f......ZZ(O.,.!$$!q.....gft...>{....%.G..>..fF~2........;>..i...&.9.....v*.|x.|$....L.....y. 5.....!..R*i..........>..mAf.o..@.0L.....1....w.v<_-.|aa.......F.p,....yA.....Q.{'...kyA....^.S...'o.2......5K..2o'~.....F#....*.7...c.#.l.P. >.L.j.4....h...L~-....JW.Z..bm.I.9....s..;...=..Ue...b....r.................).......dO.c....v.f...^:....=.}.N'.-4.5m|h..tb.6v..W..r$.@.8................v......e...T.t.h.c:..(....~.e0.].....{Y.p.....K.@L..JZ.q.s.8...T...9..1r...u.KS..(xa!..{0!..5.4.^...7..."..........J8... .....O....t...q...|...a......a.V.q.5.e.([2..F[.........E...W.|....5a...0..0...Ma.ML.....d....3.....=/.z`....i....ku#.4.b.Ra.^.:.-.j.*..L.......A.;...Q.{2i.....}l..H.....T...Y._.Q!q ..V.y...9.@.R..8..!x!...p.e4...'$c......x....'..AF&*i.../..@...!..zx..bq.{<..9...~..]...cW.Q....@A...........U..}. .ihA..n..KK0:....b....@.D..U.....b.I>...-=...|..E.._.W.pS..5....4.Ma..|.B......w...b>X. ...a....gV.1...ra!ZX.).,...[..*[.....)s8.. .....X8.c..D6'ai.6..Q.u10..N...p...>V.............!V.......p#.....#.j...b......C....^........#..>E.`.........y.....%..M.D.e...Y.HB.....a.G(.b.P.=.......'...&.T._.B..C......T....8..Ra.5.o.*...!.o..t ....`"@...='..<.Z.n..}`...m...TY...-...&".!.p....j...H....z........|....H.....*...4"...K.0D8..2...`.O..R......../`2.6.F.W..,...2.....I..Y....o...8..yA].....G.....8..8[..U.*x..).]...=.\...0<.pu....7%.e?".P..f../.C??.h..8|Y.....W.j...^.O(.O.....3W\Q....~.N.G.Z.3.OO..W.....7i(....c...!.Az....*...*..pdo.c4.k.%..}.......". ..f...{_.z..

<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=VVV.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 25 Sep 2015 03:34:04 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Fri, 25 Sep 2015 03:34:04 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;..

GET /icon/810b.png HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:33:59 GMT

Content-Type: image/png

Content-Length: 7611

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:33:59 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:00 GMT

.PNG........IHDR...@...@......iq.....IDATx...ip..u...v..;@l... ...(....(J.fi.D.yO..8N..=..C...Bf.&5....8....GN......h.,...............w>..~. ...^.......{..9..Xk.....o"B....<.~.Z.....E.9..k..'...z.T...G..E.U......[kAlHG.q.DF.Xjr..........(P.0>..SE.._btl.B.. .S)...ikn..&Am.....<,j.P.4F..."..E....@.1.b.i..U/.9..TL. ..e|....<GN....3.>?...<.....M`tH..C...TB.....*Vww.i.jzW6.T..&...P.A.X.....}.h..P..K.Mt.[.0X40[..}..:6. ..9|j...".t....mM9.k.Tg}Z.S..*..K.....g|......Cc\..$.I......t...nz......EU..{i........C..TX~..-.6.. Lk...9.|....=...,U5..^......jK.....6Cu.'.C.!..J"....J%.L....4g..9x.<o.......-k..m....M.4'.('..Q.\.o.........r7F.....c...O.._.....32'.....l.\....._.\_E]M..l..].i.I..,E..Z.j.....H8}...(.L.-.........]..JE..m ...jV...Q........&P.W|AY..k. X....[~....}.8G/.P..,....".....X....O ..... ...iK.aU#.o\CwK..g...^..50W.v.=......7........7.{..T.....|(M.cL................<....9..N..$......<......X7.5`u.1(...%.JS......{o....ki.M..M.i` ..|.w......5g.....].......,..~).!....G.j..e......<.......wq.o..M!..{..X/.U>V|D...9'k.F.......S....'.\{E.....m.:i.._.0..mN....'v..3o..g%....|t}3ikY....b..Kz.............?}.....l...V...I....N04>..T."I./.../.h.....1`.;.%'.].. &...2E.......K._K....0..j..al../.?.w.z.e....o....md.../...&-..(.0.X~..a~..;ds9..q-w.p%.... ..T........c..Y......xe...k,.h.......X]..%T(.t.).....?...l......X..U....W....{...../..'?....`d.m..}.{.P.0....3|....mY....m<p.j:.}2X.@.H.Y..Z2l...5... ...4.$..!(......J)D...... ..F<.&..9~...zV..%..0Y._.. ..U7...{y...W.v...:t..B....!o,/....?

<<< skipped >>>

GET /css/ie7.css?v=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: text/css

Content-Length: 165

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-a5"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GET /images/blank.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-2b"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

GIF89a.............!.......,...........D..;....

GET /images/grad1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/png

Content-Length: 221

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-dd"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...............u%....IDAT(.uQ[..!......%....~...n.q|@. ..!."!`N..H.3!..).....B..|'.W.K7yc.L\<.......U............>.......W...K.U..._T.U."......Z7........._.{.......hM.....5..y.".9.~Ya...q8..#......IEND.B`.....

GET /images/langs.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 233

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-e9"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.......(......1......IDATH.c...?.51....3.....N.b.j.(....... Pj.....P6E^.0.....4.....0r...p.....?.;.....:@...u!..........20....(6p.p.5p..Q...8W..D.n...(4.>..4%...I$. p....h.5.6..Q.@.^..~.J..t8j.`2.......N.h....IEND.B`.....

GET /icon/1383m/installshield-2010.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3081

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:31 GMT

.PNG........IHDR...0...0.....W.......IDATh.....T.u.?..73..]X.,,.kvY....qbS..];..X..CM.XQ..JREU........Jv.G. E..FQ..v..6vDc.ZIll.L!...`....b..3..=............^i........{...x#.9..8D....... .-.T.. ..@ .p(."....w....*...f=]ca.....i}`..E...}.|H@......I....W.v.].n.&f.w.....R..m|.R.....q~..^H3..j...`;.).XU.S.l...par....8.......Q*.....m.D.....\......).......t..'.:.O.g..).j......L.h...z>..D.@.4...j.W...KOE.X...{.....F'.%....I..y.....{G^..8...Ap.a...U......_%.<..J...A:Q.y......G.....G..b...cc[S?..#@,..2\..<...p...\...k....w.q,...;0.....5.[4._.$...}k.g.M..s/r..W.m.Nfffq...q.k....^SN...Z......>|..=..r........3Fo.....93~.U.s..1.q.B!u&Rv)WJT...I...`>5......I........J.. ii0h. .%.f.j....e*q...N....T.Yp..m...MkC....V....I..4.h.L.......J..7.0.....Z...3~n.K.....T...h.........p.J.V.SK.]l.Mk.p..l....J......>..0....7....O_.J5`...x.Uq..RS..R..t.a.^..)...`...............j...P.!........y.p....0...5...s...H.S..C..M.......".s,1..>6..wM'.%!...0=s.#4kK.U.....z....`M_'.F6....P. ...U.}.^...o3}.R.[...k.OG..l..R).\.Y.&.ZD.h. .P.4.\.|.......9~..]....`pM/.?{........VQ.7n_..}[...syf. ..H....NV.z..PM@........4dU........t...-...........neg....k.2.../N.i.......].y`..'..5h...H.9s..)>8.......1..>9...^<.*.O.aeO...Ul..b..F............]..>p.e#..c7...Q...@... G.}.....Z.k.!...UX.&.^.3~a..^.....\BL.......<L_W.Pv..eth5.N...y..5.H..i..'..3....B.C$E{........$..m.f..G_`..M..U.........6.E^!,..@[.....L.:b..lZ........Q.)......c.<......{._Qib%B...n....23.l-...eu......i4o$.....Z.8ud..Tb.'...o..o.]....et.0.~........C........N.m.

<<< skipped >>>

GET /icon/875m/animated-inverse-cursor.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3635

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:03 GMT

.PNG........IHDR...0...0.....W.......IDATh...kl\ez.........xb;q. ..VKA.PV*..H....RQ.J...ii..>..*E..vWb.~.Z.R.@D.....Y`!.J..$&...xm.v._...s.......9.[.i.U..h........y.PJ).T. ...P...u.(..T4(./.......!.R..Q..z..S..jPj.Mk:.*.PJ5h..X..._>....6.)..PpE..YC.PeV..o.....- ..Z...5..x.@........R.......\H)|...k..{^..s..q.....~..G.....n.k...q....................!.n........*.p]..]..u...1...I..8r..'O....0.L.../....244T...>G...j..*. .....U....3.G........85.).X^^..g..........<..#hZ....k..>.(....aX.w.m.q.=........k....{..........o..{z..S`....=.o..."........._gdd$n.%..r 9L...m..$J):;;.</2...<.M.H..h.F.T.@......k.....PJQ*..4.)%........y(.1;.#....#........"..0..R.G........155.......F.uD.PP........qH.R...........,.....,.t&..].H.R...`Y.W....:.......].9}.4mmm....H$hkk..<...8w..---..EL.$.H.J........h......6m.....O?.....<...V\.e....0.......... ......v....Z..F............m..,.!.]D4.M.ih..p. ..R^u...T.zeV ...5..q8u..o..6.....p.8.......\..hX`ii.......'N..[o5. fgg9p.@..RJ^}.UVWW...A....q.Zt..2....r..e.o.....%..<...~.ggj.0.....9|.p...|.....4................h.#..X,r..a......Q..R..../...={..y3[.lY7.T....s.......37...5....R,....o.t#T.a.A@..X..0vjj.7..).&...."..A.J%........a``.T*....A.S,..........,..X,F...@......a..8..a.13...p]...H$..aH*....m...V..$.....P(.i.A.......i.W.\aff.D"AP..../.{.n&''...r.<n ......v..?.eY.!p.....J...w.....mr..}}}...088...gI.R,//#.$...L&..m......N>.'.J........J.......5.@=.TSu.SIH....E..0.e.{5.pV?.....s..a...DT.U...aU...qa...h.x.f.K..5p...H..m..}.....0==.......L&....O..O..]\...6..!D...G..3'

<<< skipped >>>

GET /icon/752m/pdf-download.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3738

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:58 GMT

.PNG........IHDR...0...0.....W......aIDATh.....%.].?..z...e.g.,=.Z.!y.!.2.....oDp..........p......`N>.D.........d)..G.f...=....2..!...{...dD.{U......._.xUE.b.*"R.....XS.....YEA...G....J.Q.....R.......?......8D."b...G....{..~.....}I..$.....1..T1w..U.}.......$I.L&.c... HN.A"@...?$b....T.Xd.$...2,G=.(... ]U..j..t.E.....~h.jd..G../..jp.......r/..e..d...Gr...Ge?^...f..........Kx/.".z.B*...R`_..H..d<..7@.X.f..0.L........;P.8............p.D..GbFs.=..b.n.......f...K..!.E4....Adj...;"k...Z\...s.|..2.M..9Y.2.....;...?......Cp..*........>g:.\~...n..=n0.^.c.b.......5$...].{w.t....,^.N=..S...D.)w.s..ts.,.-<..Gl.k..........5.......k .*........_e.;@GS...g...Y;{........;.. .....0....x.J$...ab....[..*....).=y`.E.$5.{)......x.FWu..<...F@.S.......A/......._I_...K...D....v1x.EUs..A.*i..v.u.B...eJ...S.7wpm.rWj$....f..Hyu...J.QUb.....;4K...>...'...c<.V...[....q.3.P.&....R......5..9...T.Z.......E..1....L2.1..z.)..X..'3.w....5.#S2.#yv..'s.w~.....;.......o1.z......]&.....S....\.>g..8...F..Z....3...]..y........N.......v..Ly...o..g=.D.......1..~..>v2....G..F..n^.N..&."...!..Y.....|.ps.........;VUP.[..>...H..m.-.tE........Y./.'|s.C=....{.. ...V.../.hu.F... .. .oS4Mq..... K....M.......S.<..3.drt.\.&....s.N.a.PW...*..3N...g......[@.....*[..C.N...]~....,c....*...t6E.....[.;...*5..E.8B..Q...Y.....(*.6D....6<.a..q..V.....E...1X.C..*..aP7|.7..'...kmo1....?..;._...].......(P..$@... ..T.QV.k..".....c. ..*.9.Z@..W...N .c..F.w.....!...[.f....|}..F...;..oBA"....I...l..PJ....Vm...^...tc.S.7..N...a.``.o.X.e0r.......

<<< skipped >>>

GET /icon/1412m/stanza-desktop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 4103

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:31 GMT

.PNG........IHDR...0...0.....W.......IDATh....o\.u.?wyovr..H...J$%k.#...;Zl...8Q..i.&6.K....h....@.? iQ$..(.4I.....v\[.M J%Q....eI..........f.3..7......}..{.9.{.Ka...B....47!D..F.....lD..X'.-...r.7..?[.x...}......>..g..h.y7;-.!..s.{.......K...x......;..|.....c.;.......u.h.h....v......>-Y..W....Xk. .w.v..i....UFl...E...c,.(..(..... .J.8.RH.....H!At...........t.M!.B..I....-.'...X.1..P).....G..LLL..\..twu...>.....H).B`........i.L.m..N...\...3..J.T.h.g.FI...........L_..w....m[.T*....a..._.......NmW....;.vg.*g...y!.I..Xk..a.a......k..Z>........i|...Y.z..F......={PH.....!O?..2.T...........b.R(,.)5.-aE#..-..1P..F..td .C^{.w.?y./?.$.d.|.....869...W.Z;....@h8{...=.m...A.b.!.MM..A.cBCWW.X,...%]@.._.z(![.A...n......7....H.H.S..]=9v......9~....y....?...F ../~.SO=E,.'.}. @J..W.B...........o.'...B..qZI.....2>..W.x..7...?@..T.e..g?e..i...l...)l.sz..o......d.........`.RJ....|....2.X..4~V..........n..`..X..!....#.*.A./(......x..../..rb...?....L.../.....7........................EJI>.D.RAJI6....-..]d.rPCC!D$...O.o......1...\.a...}..Q.b...<*U..7..5.;...._.H...}......`..&...............b..-.u..o...V...\....;H.S$2i6.......z.GF>E.&c.y.!..p.U.....r.......;.._.X*.U ..Oh.q....x...\.r.m........0..p...(..v....=...u...=$...?y.R..G........................5.T............x~.......78.w?......p...CbP.e~.._....t...>...?....z.5s....B?...i...A... E.....s...<..or..EN...W._......~.q._.....1.......l.....{..E../oEM....[3.........(.........|.!AY.... /s...v...g.}...>........r=Y.6..Jd.X.1...c.X ...g....[..............>

<<< skipped >>>

GET /images/footergrad.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 192

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-c0"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR.......x......Z......IDAT..e.A..!.CK.:.?.....L.....i...[k...[...~.p.}..n.....mI....T.X..2l..G..D...c).,0D.ek..qp.<N......r.`....O...E..r.J~.W...........3.....ll.F.e....IEND.B`.....

GET /flags/flags.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 8050

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-1f72"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes

.PNG........IHDR...`...7.......Ow....bKGD..............pHYs.................tIME....../........IDATx...y.T...?.v..3.....0"...WL.....&......$n...&.E....5.7&.$n?5.Q0... ...$Q.E@.}.g.om..G..ef@.y........t..{..S...S....).Er.x.p(.....q.....r...C.Ge..?......cZ.PJ.i.......".s.Sm.ED.jk-.............'..I.B...L..k...>.9.O... .....8Gv[..l..C...".N...`%......$..../..... .@.....:.~...b...1............K.....~E..E. ......Db.MF.k.......z.u...{..C.Uc-. ,-..P.1.........3..rT.5..U........ ...t*.V..v...h...x..^......".u........AX..16..3...VD...L...C.....X....=.C.._..~C...d-b5._..EkD .(Dk..N..V6.u'..~ .;...b.k.T.e..A....*..).?.....8..../...[........(.p...0.i-;.k@;..z'^...."..\...."..;...W.@.3.g8x.V..h....Y....0<....y$w....s...h.AA.s..:&)..XDt..}Q.h\hGT..l........XZgYl^..Y.(.j.(.....)]P....#...56a.[....F.oQ.... .....PY....K.....81...F.M.`..w.....l..-..2bX..h..9...%....i........ ......7W...<l.....5u.WdT..........{.^.J..6Z..k@..c........9....E)...k.c...Uw...7,.:..s..*.....(]...^.).[.8..=.TN,.@.....3...kD.....'..U.sX.cG.W~_......./....s{.x .....Z:....K._../NCl.4..w....||.K..5-....V.....mgL!.p.a.`.Pm..}.......[.X...k.{.%..........`.3@.......B.M...Ct...........(....^f..I..Dx..,..%.Z.bA.......=........iL.i.3...K..:M.7.X....-Za......SE.K..i..!c.......u|}...^......._.L....alL.mW.;.....e..J..D.. ?=..Z..w.*..........1G.O...m.........uU...s...v.e<......h..zW.&...^$.....K..)i.k'....' qSJ\.1.A.......0..qX..o.0....[0.(.0s....B.`..p.{.. .......4...Q. FA...j.fn/P`....jnz&...Vf...D....z.17e.....c......z.V.-..`...C.Sx.hp..5Do...;.._w.....

<<< skipped >>>

GET /min/?g=js&4 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 6049

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Vary: Accept-Encoding

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

ETag: "pub1435676311;gz"

Cache-Control: max-age=2592000

Content-Encoding: gzip

...........<ks.F... (9.."...K..i.e..[..v..m....@`H...........=......]]U..3===......cE......d6O._.LWYT%y..U.EiX....u7wa. .....].~....K.s2KN.QA.U...yR.4.....n.sp...<.hV...O.....d"...~zX. ....m.W...5..0]Qw.s....0..&.....`.=9Q ...Sk.a......t........8.'.M.7Bf..l..U...$K..|....A..c.aEgy.0.....j..p}.8..$.r...%....'..L...8..YI.....^.h.2O..f....\.`.%.i..........:,.M.Y.~.GI..'...3.-..C...p...b.v..f.IE.4.cG..fp...\* 8..8..............R\....q.6...3m...R6..y..< ..s}>.)_.....a^v...>.<. }......Vv.........4..F..j!.[.3Z.D...L'.=l.>^...f....Cx..B..V..ji.........m..w2....v.y6....=..h.m..~...`X9......F.x...g.MA..q...eo.......sR..>.b-.f4..l...&...x...b...@:.8.B.....?.........[./........Y#.......yA......C.k.............:.z..........5x1.W....VH{. ..\].\...L......6.......#...@....^...VU....F|.>....J......i.p9......g...xb..2...a8....M..F...' .p........u........sy..O}.'Q.O....L..rYe?....eRe}T2...8..Pd..Fq..%}...W.H .|9..B........2/bZ\'.........0t..4...`.U.\....!8.q:$9..B.>..,.x..^.'..L...(.........Q.w.........=Fx...|..5...........F...UX..../...#....'...e....]:]L`..`4..^IS....A.....L&....2.Q..f.. ..<.d............4X..`.u....B...r.*..f...8.z..UU$.:@.....^.|.T). W..i^8(...z.A.(9;;............BwG.y.R....6..B"t.<.".<...3P$.c|.De...zLS.l.@e..1..p.D.H^..]/....,...?<y...f^...)...e..v....a`..,f6....e.........;..{,..<k...B......D. .c @...l* .,...*.(8!g.:..rF....?.Y.$.d/.m.........e....G..u..F......... .^.^.q..F...........a.......pG......CP...c0B...\.....y'a.eV..,..."..4.\...y.sx.$..C..p........[(h.aL.

<<< skipped >>>

GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Thu, 24 Sep 2015 21:50:20 GMT

Expires: Fri, 23 Sep 2016 21:50:20 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 32819

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 20623

............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V........V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g..Q...S_..Y.....G)..T.".......<......&...*..Z.t%..s@it5..y.c.....p.h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;.....3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE..,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q....v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_........j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*........H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v....n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f..........&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3......i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&

<<< skipped >>>

GET /ui/11d/en HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public, s-maxage=900

Content-Encoding: gzip

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:33:58 GMT

Server: nginx

Content-Length: 1558

Connection: keep-alive

...........Wmo.6..._..[.....n.%...I..}.Z..0..%Q...TI..W....f.v..h.4....=..Q.;g........../......S..4}.`..g.3.0....L...aR......d\..._JJ..Xd...m.!.6.M...-3<..Pa......~.aC?...8EEM..&.L..c..%.44.J.....B2Q..."! ..\.d....i2.MK..y...yv.t..zq...3.p:.].....(S.S.7.L\.Z.*..NI...&...O.....G...#Ey..Ys.kJ.F.... .QCKF2L8w...rV..R.G..2...Z..*...8S....P...dI.,.....8....>aC..`.|.6$......?...@.r5_Q^H..!v.R<g...J.C6)N.t.Z.VL.R... ....k.>...xS.g.t.Nj.l2.e.F..0.......H....dT..$.|.&.....y1|Ds.tN.......!F...&.B...-.*.;...J..U..w. ....RS8IA.W...s.....wE,..J..h.......k........c$P.E.Y..1(...h..Z..h.JSg......Em.st....6.D*.lY......,....Ha.....A.................mF.}).LpIJ<9.O.......>w.yj}.$o.v<..Z.-......p.z..q...M .....}C...>.Z0J...yas.Z.^.>&...:.Nf5E./..25..b.e.Wu..k.Yx.f0N!"....o..A..Q&.KA.df.......A.jX.L.<b.......JSuOC..l.H......'..k. .L..; .d.;>.....E.............j..|Ia..q]...c..ax.H.!.YR}.aD..'.(j.!...((..:z.T...D.G.........)...;QR.X9-.:.R.....u.;([%....".j...."*.D."M*..0<.......D.@.......,.A.@....,!|...Od..fU.Q5H.....W._=!. )!e!a.j d........"Xq....f^A...3..9.....Cd.(0.c.C5........h...#...[MsY.;h......s.q\....Z.@.8%...7k.TlI.5...nm..nb.....O...?...T"...t.St..u.Mlg......)....6.:(.......BO.Q.g..pY... .....'.....;2."'.X..........!8.-.t.kjwo....b.........f../.%....[j...._.. l.W..Uu<.R.^}..v.JH..1.......3...x'I......,T].2.dK.....{.....b...@q.D..Y.q.."...Y....Vs,..|w.]...D...E..&.rc..}2*~.CI.E.....f....YAh^t.f....s....7r..pG....m2......6......S...:...6.].~e3T.&:...i<..z...^!.....^....<u..7.....

<<< skipped >>>

GET /s/app.min.css?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 25 Sep 2015 03:33:58 GMT

ETag: "5603ac7a-2aa3"

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 10915

Connection: keep-alive

body,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0}table{border-collapse:collapse;border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn,em,strong,th,var{font-weight:normal;font-style:normal}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-weight:normal;font-size:100%}q:before,q:after{content:''}abbr,acronym{border:0}.cf:before,.cf:after{content:"";display:table}.cf:after{clear:both}.cf{zoom:1}body{background:#eee;color:#333;font:normal 12px/20px Arial,Helvetica,sans-serif}a{color:#11c}a:visited{color:#11c}#app{width:730px;height:430px;margin:0 auto;text-align:center;background:#eee}div.data{height:375px;position:relative;margin:10px 0}#sidebar{text-align:left;width:160px;height:375px;z-index:100;position:absolute;left:2px;top:0;overflow:hidden}#sidebar .logo{width:140px;height:40px;padding-top:5px;text-align:center;vertical-align:middle;margin:0 10px;margin-bottom:10px}#abw{background:#ddd;margin:0 12px 10px 12px;padding:10px 10px 7px 10px;text-align:center;border-radius:7px}#abw div.icon{background:#fff;padding:10px 0 5px;margin-bottom:5px;border-radius:7px}#abw p,#abw a{font-weight:bold;color:#777;line-height:15px;overflow:hidden}#abw img{width:64px;height:64px}#topics{margin:0 0 0 5px}#topics ol{list-style-type:decimal;list-style-position:inside}#topics li.active{background:url(iconos.png) -253px -325px no-repeat;border-right:1px solid #f2f8ff;color:#333;font:bold 12px/34px Arial,Helvetica,sans-serif}#topics li

<<< skipped >>>

GET /s/ender.min.js HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: application/javascript

Date: Fri, 25 Sep 2015 03:33:58 GMT

ETag: "5603ac7a-7a40"

Expires: Sun, 25 Oct 2015 03:33:58 GMT

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 31296

Connection: keep-alive

/*!. * =============================================================. * Ender: open module JavaScript framework (hXXps://ender.no.de). * Build: ender build jeesh scriptjs morpheus. * =============================================================. */.../*!. * Ender-JS: open module JavaScript framework (client-lib). * copyright Dustin Diaz & Jacob Thornton 2011 (@ded @fat). * hXXps://ender.no.de. * License MIT. */.!function(a){function c(a){var c=b[a]||window[a];if(!c)throw new Error("Requested module '" a "' has not been defined.");return c}function d(a,c){return b[a]=c}function e(a,b){for(var c in b)c!="noConflict"&&c!="_VERSION"&&(a[c]=b[c]);return a}function f(a,b,c){return g._select&&(typeof a=="string"||a.nodeName||a.length&&"item"in a||a==window)?(c=g._select(a,b),c.selector=a):c=isFinite(a.length)?a:[a],e(c,f)}function g(a,b){return f(a,b)}a.global=a;var b={};a.provide=d,a.require=c,e(g,{_VERSION:"0.2.5",ender:function(a,b){e(b?f:g,a)},fn:a.$&&a.$.fn||{}}),e(f,{forEach:function(a,b,c){for(c=0,l=this.length;c<l; c)c in this&&a.call(b||this[c],this[c],c,this);return this},$:g});var h=a.$;g.noConflict=function(){return a.$=h,this},typeof module!="undefined"&&module.exports&&(module.exports=g),a.ender=a.$=a.ender||g}(this),!function(){var a={exports:{}},b=a.exports;./*!. * $script.js Async loader & dependency manager. * hXXps://github.com/ded/script.js. * (c) Dustin Diaz, Jacob Thornton 2011. * License: MIT. */.!function(b,c){typeof define=="function"?define(c):typeof a!="undefined

<<< skipped >>>

GET /s/box.jpg HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: image/jpeg

Date: Fri, 25 Sep 2015 03:33:59 GMT

ETag: "5603ac7a-1cef"

Expires: Sun, 25 Oct 2015 03:33:59 GMT

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 7407

Connection: keep-alive

......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....*.. .j....<...Eg.......u^......:..FG.U ..6.h..e..?:C".xUm.l......R....U..6P..z..i...4..l.....)....I.............{...F..a.S.f......Rm.e.69..RG.Z.Eq._J....9..j.......w.Z.Z.......&..Wk..A...98.x.:1.:V......&._OZ..A ...t4..m.mg.W.,%f..x..V...~....6..in.)..C..P .v.....?...4.........h.*.f=I.....t.....4....U...d....)...MW...9.vO..go............_.......e.A.... .k....\..B...jT%Q.cV.i.M}g....(......s...e..[.{Vy...JxhAZ..S.Rn...M.f&...A.^)..c.1....d.|...o...D.`. ...,K.....#O...v5...7>...".V..........8.......3Eo.?yX~.".@....eQS......F.u..4...,./.v.CI. ..4VR.N.....V.A..O..^.....U5.O.B>."........c.E.).4m....I.8....:.iY..q.._W..R..M......g.,...%Gy;...1fb.I'.=.....fp.................PE....4gc......k.......%.......|P......GE.. 0v7........y......VQ..iZVGS..e.Y....Eoo..o|(...*..G.6...t...m....h...u...^..b..@.w...G._.y.r........pKf[.........e...,L.}..m<.Ud.....S.h=(....by...5.....z....b...PY..I...k..W9.wc

<<< skipped >>>

GET /s/app.min.js?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Fri, 25 Sep 2015 03:33:59 GMT

ETag: "5603ac7a-a450"

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 42064

Connection: keep-alive

<<< skipped >>>

GET /installer/4d48823a-b8b4-4f4d-b72e-794a5bc06ebe/1345/config HTTP/1.1

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Accept-Language: en-US

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, private

Content-Type: application/json

Date: Fri, 25 Sep 2015 03:33:57 GMT

Server: nginx

Content-Length: 3832

Connection: keep-alive

{"Target":{"name":"Google Earth","url":"hXXp://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe","icon":"hXXp://VVV.winportal.com/images/files/icons/810-64x64.jpg","uuid":"4d48823a-b8b4-4f4d-b72e-794a5bc06ebe","checksum":null,"fileName":"","types":[],"args":null},"SuggestedApps":[],"Config":{"id":1345,"maxsuggestedapps":4,"strings":{"setupWillClose":"The setup will close. Do you want to exit the application?","stillDownloads-close":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Close?","stillDownloads":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Continue?","stillDownloadsUninstaller-close":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Close anyway?","stillDownloadsUninstaller":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Continue with the downloads?","downloadError":"The file was not downloaded successfully. It is recommended that you close the aplicaci\u00f3ny to retry the download.<br>Attempt to execute all forms?","connectionError":"The connection failed. If you do not have Internet access at this time, try to complete the installation later. If connections are available, it is possible that this product has expired.","noSauc

<<< skipped >>>

GET //www/delivery/afr.php?zoneid=31&cb=5515585 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secondofferdelivery.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:34:03 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Pragma: no-cache

Server: nginx

Set-Cookie: OAGEO=UA||||||||||; path=/

Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:03 GMT; path=/

Content-Length: 1096

Connection: keep-alive

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>.<html xmlns='hXXp://VVV.w3.org/1999/xhtml' xml:lang='en' lang='en'>.<head>.<title>Advertisement</title>.<style type='text/css'>.body {margin:0; height:100%; background-color:transparent; width:100%; text-align:center;}.</style>.</head>.<body>.<a href='hXXp://VVV.secondofferdelivery.com//www/delivery/ck.php?oaparams=2__bannerid=97__zoneid=31__cb=b54e227aa9__oadest=http://lp.ilividnewtab.com/?sysid=533&appid=1079' target='_blank'><img src='hXXp://VVV.secondofferdelivery.com/www/images/de0ae333c183355452cb397cf09eeffb.png' width='728' height='90' alt='' title='' border='0' /></a><div id='beacon_b54e227aa9' style='position: absolute; left: 0px; top: 0px; visibility: hidden;'><img src='http://VVV.secondofferdelivery.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://VVV.winportal.com/google-earth/thanks&cb=b54e227aa9' width='0' height='0' alt='' style='width: 0px; height: 0px;' /></div>.</body>.</html>.....

<<< skipped >>>

GET /www/images/de0ae333c183355452cb397cf09eeffb.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secondofferdelivery.com

Connection: Keep-Alive

Cookie: OAGEO=UA||||||||||; OAID=acfd61925510fa466d97ba8f6dfd29f2

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 25 Sep 2015 03:34:04 GMT

Last-Modified: Tue, 22 Sep 2015 08:00:46 GMT

Server: nginx

Content-Length: 22030

Connection: keep-alive

.PNG........IHDR.......Z......4!.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 9955484316556696860

Date: Fri, 25 Sep 2015 03:34:05 GMT

Expires: Fri, 25 Sep 2015 03:34:05 GMT

Cache-Control: private, max-age=86400

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4389

X-XSS-Protection: 1; mode=block

...........Z{s..........&(......c*q..l.8.g....k$.@AH.$.$..o.H...}N.[..5.==.~.z...B'..P.?.<nMY:..._g..q..]....u.."L..$.....I...m.......In.Skj$.I....X..X.G,.U..X..o.b`.3.uE88....E..xp..k_l./.#nl.=..?......K.S..qc.}o...I.Lv..^.k....V.....PK=...SA..L..3FS...t:..?..V.1-{./k.C...v..B.).....5... ..a..R.f.uY......]..]....(Y...C...l#..h-.V.H.....a.....Q..Y.....r:......l.......%...k....j.........<.p..|...L...............aw.&p.. .W......... .......S.Y.mdDZdR.......f...3..X...|.Ho.o.I.e..Q.].c...M.1.."N.....:......:..V_.#w.n.sw../i....&h/.....%G..A#3...;B..5.'.{..tw..O..N......R....ss./..9.gS.Z| ..;..!_.S.F..6.=3.W...JD.r....W......X.9l.~...ty.=7.lk....o<...>q...H......P.6.!......y{.=..F.r......7..G....e.4..6"....h)....|n... ...Y>.K..............x$.. .....6.kL.I.jc..h....A...)W..r..Fcwl.lM.R..mm8.E..5..Z.Gu.A.Y..Oa..SP?.RQ......j...Z.m) .$.h.#W.2......A.w:S.]1O.<.(,'.k.' m...B..N....i.:../..... ....a.5`...9..2._.$p.Q....9:.|..4.4..a?..o.......O..c.........R#YBn...q...:G..<...~..F .i:.......[}..N.;....f.2g...`R......}.....F...}.G:~....La..O0-7.jSv.gg;.W..J.7.W.eF.jt4-.]:.O..w:.^.m*..e..L.T...r..BBB.n....6..r..>.t...^ESJ [G".of~ ..M.xb.......V.U....N.r....i.....2Z,yJ.{k8..-wXL.W......,..w....;k.. s.g.wH}...;..9.................0...e..<I.y...1.6.M,........x*W...`......4.0*.#{2......>Q...q...1.An.0)...`A2..Y.....1.,..q......"pN..zf..S......B8r..2.Z:.,j.6.t.p.h.eJ..<.4/p..L0....PlZ.....H..."?......@.(...`..].....\.@.-..<7.......1.E,....."...!../.R ........'/..o5..vs..2...H?K...`%.-...0...gg.?

<<< skipped >>>

GET /css?family=Asap HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Fri, 25 Sep 2015 03:34:03 GMT

Date: Fri, 25 Sep 2015 03:34:03 GMT

Cache-Control: private, max-age=86400

Content-Length: 155

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..Expires: Fri, 25 Sep 2015 03:34:03 GMT..Date: Fri, 25 Sep 2015 03:34:03 GMT..Cache-Control: private, max-age=86400..Content-Length: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot);.}...

GET /earth/client/advanced/current/GoogleEarthWin.exe HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Host: dl.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 36182856

Content-Type: application/x-msdos-program

Etag: "55021"

Last-Modified: Thu, 21 May 2015 22:00:00 GMT

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 25 Sep 2015 03:34:00 GMT

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.................@......_]......_i.......P.............._h. ...._Y......_^.....Rich............PE..L....(]U.........."...........&......a....... ....@..........................`(......s(...@..................................S............&...........(.H.....'. ...."...............................H..@............ ..T............................text............................... ..`.rdata...@... ...B..................@..@.data....3...p.......J..............@....rsrc.....&.......&..`..............@..@.reloc........'......h'.............@..B................................................................................................................................................................................................................................................................................................................................................................U..QV.M..V....M..B....M....G.....^.....A...u..@#A...8.A.VW3...;.t.V..Y.....P.WWWWW.ER.._^3.PPPPP.7R....D$..V....4#A.t.V..P..Y..^....|$..v..L$..D$.f..f;.u........L$.u.3.....f;......@..D$...P.t$..t$..6R.......D$...P.t$..t$...U......3..|$.....j....j.j.H........P..H A...D$..A..D$. .j....Q...D$..A...A...X A.P..T A.3.@...V...>.u..B.......t..t$....t$......^...........D$..V....h#A.t.V..O..Y..^...V.t$...t .Q....r.......;.r....r........I...H;.v.....2.^...U..QQ.M.3...t)......w....P.[X..Y..u..e...M..E.X#A..;........

<<< skipped >>>

GET //www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://VVV.winportal.com/google-earth/thanks&cb=b54e227aa9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secondofferdelivery.com

Connection: Keep-Alive

Cookie: OAGEO=UA||||||||||; OAID=acfd61925510fa466d97ba8f6dfd29f2

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Type: image/gif

Date: Fri, 25 Sep 2015 03:34:04 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Pragma: no-cache

Server: nginx

Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:04 GMT; path=/

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Control: private, max-age=0, no-cache..Content-Type: image/gif..Date: Fri, 25 Sep 2015 03:34:04 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..P3P: CP="CUR ADM OUR NOR STA NID"..Pragma: no-cache..Server: nginx..Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:04 GMT; path=/..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1736:

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe "c:\%original file name%.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp

dlmgn.exe.config

&hXXps://VVV.globalsign.com/repository/03

"hXXp://crl.globalsign.net/root.crl0

&hXXps://VVV.globalsign.com/repository/0

-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0

4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt04

(hXXp://ocsp2.globalsign.com/gscodesigng20

!Certification Authority of WoSign0

hXXp://crls1.wosign.com/ca1.crl0g

hXXp://ocsp1.wosign.com/ca10.

"hXXp://aia1.wosign.com/ca1-tsa.cer0

!Certification Authority of WoSign

$000214F9-0000-0000-C000-000000000046

$0000010c-0000-0000-c000-000000000046

$0000010b-0000-0000-C000-000000000046

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

$07D66D3B-4491-43B6-81C0-88141A95FB9F

3.1.50

_CorExeMain

mscoree.dll

&?4?)?3?'

nst2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe

c:\%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

Nullsoft Install System v2.46

imgr.exe

3.1.50.0

"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2#

PublicKeyToken=

publickeytoken=

dynamic method does not support fault clause

unexpected OperandType

dlmgn.exe_892_rwx_003C0000_0001C000:

S.HW#r'

dlmgn.exe_892_rwx_03710000_0000A000:

$.wv^

iexplore.exe_2116:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.fg>

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

dlmgn.exe_892_rwx_675A6000_00003000:

.Qg

*Rg`.Rg|)RgL Rg

dlmgn.exe_892_rwx_6D739000_00001000:

/hmh.hm

.hmh/hm0.hmH/hm

Summary

Dynamic Analysis

Removals

Static Analysis

Network Activity

Map

Strings from Dumps