not-a-virus:AdWare.MSIL.Agent.ztr (Kaspersky), Trojan.NSIS.StartPage.FD, Trojan.Win32.Alureon.FD, Trojan.Win32.IEDummy.FD, mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Trojan, Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 8b6da4b1611c108ce3bf9a5ac119552b
SHA1: cfd5c3350dd9a1c31507d28f1cb56301902a65e8
SHA256: 878b5d3009f9ee5e973e74a24ae1f00ac54eb27b12367231fe8bf5a4dcce7ebe
SSDeep: 6144:We34y2pbTh 3pwLpAKKi8A//t4V1TLAo/o5b77ClFxo:kvh 3KaltAnIhLB/m4o
Size: 217928 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
%original file name%.exe:1736
GoogleEarthWin.exe:2788
The Trojan injects its code into the following process(es):
dlmgn.exe:892
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process dlmgn.exe:892 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\en[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\iconos-ie6[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\box[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\ender.min[1].js (16478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\810b[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].css (1417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].js (21071 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\en[1] (1558 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\applicationIE6-app.min[1].css (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\GoogleEarthWin.exe (261127 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)
The process %original file name%.exe:1736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe.config (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe (8776 bytes)
The Trojan deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (0 bytes)
The process GoogleEarthWin.exe:2788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Desktop\googleearthinstall.log (781 bytes)
Registry activity
The process dlmgn.exe:892 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 2E E0 C8 90"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level" = ""
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A A3 1E 7B 54 45 27 78 C2 09 6B C3 89 16 05 B2"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 3E 45 52 15"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Trojan deletes the following value(s) in system registry:
[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"B1BC968BD4F49D622AA89A81F2150152A41D829C"
"B94294BF91EA8FB64BE61097C7FB001359B676CB"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
The process %original file name%.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 9C 6D BC 50 AF C7 61 B7 D4 A5 CA 3B 33 40 1C"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process GoogleEarthWin.exe:2788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 90 EF 8B 9E 45 83 8D EB B0 2C 00 2C 41 D8 81"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
Dropped PE files
MD5 | File path |
---|---|
f8a7093ec1b8a8e28e5856197bbaf54f | c:\Documents and Settings\"%CurrentUserName%"\Desktop\GoogleEarthWin.exe |
3c8fcdd5824e8194f999e9ca50c3c751 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nst2.tmp\dlmgn.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
%original file name%.exe:1736
GoogleEarthWin.exe:2788 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\en[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\iconos-ie6[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\box[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\ender.min[1].js (16478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\810b[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].css (1417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].js (21071 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\en[1] (1558 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\applicationIE6-app.min[1].css (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\GoogleEarthWin.exe (261127 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe.config (291 bytes)
%Documents and Settings%\%current user%\Desktop\googleearthinstall.log (781 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 32768 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 225280 | 13936 | 14336 | 4.05703 | 1f6cc5aff1c80ee98a4bef7a9c2facd6 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt | |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab | |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt | |
hxxp://crl.globalsign.net/root.crl | 108.162.232.198 |
hxxp://crl.globalsign.net/gs/gscodesigng2.crl | 108.162.232.198 |
hxxp://os.wosign.awsr53.qihucdn.com/ca1-tsa.cer | |
hxxp://northstar.393532df4f28.api.socdn.com/installer/4d48823a-b8b4-4f4d-b72e-794a5bc06ebe/1345/config | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/ui/11d/en | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/s/app.min.css?2015041501 | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/s/ender.min.js | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/s/applicationIE6-app.min.css?2015041501 | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/s/iconos-ie6.jpg | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/s/box.jpg | 52.20.122.55 |
hxxp://northstar.393532df4f28.api.socdn.com/s/app.min.js?2015041501 | 52.20.122.55 |
hxxp://wnpcdn.com/icon/810b.png | 52.20.26.1 |
hxxp://dl.l.google.com/earth/client/advanced/current/GoogleEarthWin.exe | |
hxxp://www.winportal.com/thanks/?q=Google Earth | 54.208.39.191 |
hxxp://www.winportal.com/thanks?q=Google Earth | 54.208.39.191 |
hxxp://www.winportal.com/google-earth/thanks | 54.208.39.191 |
hxxp://googleadapis.l.google.com/css?family=Asap | |
hxxp://wnpcdn.com/css/ie7.css?v=1 | 52.20.26.1 |
hxxp://wnpcdn.com/min/?g=css&14 | 52.20.26.1 |
hxxp://gstaticadssl.l.google.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot | |
hxxp://wnpcdn.com/images/blank.gif | 52.20.26.1 |
hxxp://wnpcdn.com/images/logo-en.png | 52.20.26.1 |
hxxp://dl.l.google.com/ga.js | |
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js | |
hxxp://wnpcdn.com/images/grad1.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/648m/apli-master.png | 52.20.26.1 |
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/afr.php?zoneid=31&cb=5515585 | |
hxxp://wnpcdn.com/images/langs.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/1195m/petousb.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/1383m/installshield-2010.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/892m/stardock-mycolors.png | 52.20.26.1 |
hxxp://dl.l.google.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=www.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~ | |
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/images/de0ae333c183355452cb397cf09eeffb.png | |
hxxp://wnpcdn.com/icon/875m/animated-inverse-cursor.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/11653m/idm-scan.png | 52.20.26.1 |
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://www.winportal.com/google-earth/thanks&cb=b54e227aa9 | |
hxxp://wnpcdn.com/icon/752m/pdf-download.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/9277m/winusb-maker.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/1412m/stanza-desktop.png | 52.20.26.1 |
hxxp://wnpcdn.com/icon/40m/norton-removal-tool-xp--vista.png | 52.20.26.1 |
hxxp://wnpcdn.com/images/footergrad.png | 52.20.26.1 |
hxxp://wnpcdn.com/images/social-icons.png | 52.20.26.1 |
hxxp://wnpcdn.com/flags/flags.png | 52.20.26.1 |
hxxp://wnpcdn.com/images/buttonbg.png | 52.20.26.1 |
hxxp://wnpcdn.com/min/?g=js&4 | 52.20.26.1 |
hxxp://pagead.l.doubleclick.net/pagead/conversion.js | |
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js | 216.58.209.170 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | 212.30.134.174 |
hxxp://crl.globalsign.com/gs/gscodesigng2.crl | 108.162.232.198 |
hxxp://aia1.wosign.com/ca1-tsa.cer | 54.229.101.94 |
hxxp://www.google-analytics.com/ga.js | 216.58.209.206 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt | 212.30.134.174 |
hxxp://www.secondofferdelivery.com/www/images/de0ae333c183355452cb397cf09eeffb.png | 23.21.214.217 |
hxxp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot | 216.58.209.163 |
hxxp://www.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585 | 23.21.214.217 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt | 212.30.134.174 |
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=www.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~ | 216.58.209.206 |
hxxp://fonts.googleapis.com/css?family=Asap | 64.233.164.95 |
hxxp://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe | 216.58.209.206 |
hxxp://www.googleadservices.com/pagead/conversion.js | 216.58.209.162 |
hxxp://www.secondofferdelivery.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://www.winportal.com/google-earth/thanks&cb=b54e227aa9 | 23.21.214.217 |
www.google.com | 216.58.209.196 |
flex.atdmt.com | 131.253.12.190 |
www.google.com.ua | 216.58.209.163 |
googleads.g.doubleclick.net | 216.58.209.162 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /root.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.globalsign.net
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Sep 2015 03:33:53 GMT
Content-Type: application/pkix-crl
Content-Length: 649
Connection: keep-alive
Set-Cookie: __cfduid=d397aa8013c82ce98553480a71ffa202a1443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.net; HttpOnly
Last-Modified: Tue, 07 Jul 2015 00:00:00 GMT
ETag: "559b1680-289"
CF-Cache-Status: HIT
Expires: Tue, 29 Sep 2015 03:33:53 GMT
Cache-Control: public, max-age=345600
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 22b3ab90de4e0c83-AMS
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA..150707000000Z..151015000000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......0*........,^.....141125000000Z0.0...U......../0-0...U......10...U.#..0...`{f.E....P/}..4....K0...*.H.............{...........(.'o.../..c. ..,~..m....]yq.6....X..........P...O..!v...b..A.2~..m.O.t....~&\9R7P.V...e..H.[n.0......{.M....~YerR."...0..(......TM...M......@h...Q-u.C...R2f..F.g.tSt.J..P.....<...>....M.'..m7d.6;....u..?..Ch....r.....|...T,I.ex...8...wB...J.u'.HTTP/1.1 200 OK..Date: Fri, 25 Sep 2015 03:33:53 GMT..Content-Type: application/pkix-crl..Content-Length: 649..Connection: keep-alive..Set-Cookie: __cfduid=d397aa8013c82ce98553480a71ffa202a1443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.net; HttpOnly..Last-Modified: Tue, 07 Jul 2015 00:00:00 GMT..ETag: "559b1680-289"..CF-Cache-Status: HIT..Expires: Tue, 29 Sep 2015 03:33:53 GMT..Cache-Control: public, max-age=345600..Accept-Ranges: bytes..Server: cloudflare-nginx..CF-RAY: 22b3ab90de4e0c83-AMS..0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA..150707000000Z..151015000000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....141125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......0*........,^.....141125000000Z0.0...U......../0-0...U......10...U.#..0...`
<<< skipped >>>
GET /s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: fonts.gstatic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: font/eot
Last-Modified: Thu, 28 Aug 2014 20:43:23 GMT
Date: Wed, 19 Aug 2015 05:22:26 GMT
Expires: Thu, 18 Aug 2016 05:22:26 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: sffe
Content-Length: 9590
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 3190297
..........e.UX......k........S....[......;...EB..)...Z..D<...\...\......r....6.`.....K...(&...... ..?...C.........\.......@...W...j.....p...<.#~..Z.......W.7..?#!.?@...._....PM......l..~.d..&H:.J.Y 6..y.......0..%.Y...U..:r.B.O.WT....g._.......h.4.t.........c...t..a..I..wG.`Y..BwC.&.,4;. .........|7Dn.{.v.......tI....veR...'y8...I.x..^....x4R9....lO.-.5..8Mq.(.c..0.......~.*J.;n....z.......A.)j.d...X...K.S..$f.._h.$.{.W%.&.OK.8.C...]r...w.Sx........y_.YH.5..ISR.a....."..Z.9..7R..-._.'...8............YC.6T...;J...........W..s....A...:^p|yL#.<Z.tx..l.y|....._G..Vkm0...D.UB./..J.>..B..$.....b.q.... ..d..".E ..w.<[.......v....{Zn.....N...8r.q.c..k.....~\...:.*O....T{.v..!v.Q.z../....N..7R..Cf.....i..J.$..0s.F.w'..../T{..Y.:.T...v..GY{:3.hL.......B..W ...LBp~..9>....(..7.Y|....9...Es..........AV.QL.....;z.X}.$..j.;h.........Q.Z...F...?.65..5y..d......W.....@.}m]$.T%Q...F..m$,B...7..W..8y.n2.......n6...T=..`...]......l.xY.Eu.......[<.k...?I.r.G...*/._.......f.O,.8....~.\.w..kh.........//Uf.^...m....b.....e..c.....oG....a.l....X%d.-....pO..1'.... .9..&.c....x5.'....Xg....r..Ov.U...$........2).!....uW.'..}5.l..M......./.r7...&.dGu)......_.#U..n.N._...)....2L....J..q.....%p.....dj.Q....Z...e..JVz.......cf..[.M....q_u..Mgm..Y...ja.K....Vdp/Ws.q....G...d.8.K.I........>..E.%......^Jue.F5..t...... ....@U.5.T.s...T.._......%t..SPI..x.z....Ew..H......u.L..a(-%%)........,..{.y....Q..T0&.O.5.m.*sy..L...a.N.n.....[b..9..Za..X."........Y.....v.u6.y.......XP.B@./...j..* ....8'1gI..s.S=\..%..U W..[.`.*.E_-..
<<< skipped >>>
GET /ca1-tsa.cer HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: aia1.wosign.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/pkix-cert
Date: Fri, 25 Sep 2015 03:33:53 GMT
ETag: "555f0960-57a"
Last-Modified: Fri, 22 May 2015 10:48:00 GMT
Server: nginx/1.5.13
Content-Length: 1402
Connection: keep-alive
0..v0..^.......^h..q.cPV.h.>...0...*.H........0U1.0...U....CN1.0...U....WoSign CA Limited1*0(..U...!Certification Authority of WoSign0...090808010001Z..390808010001Z0U1.0...U....CN1.0...U....WoSign CA Limited1*0(..U...!Certification Authority of WoSign0.."0...*.H.............0...............V.{k\z..k.....#.....1.>..)o.=.k..@_.9..z..MT}."x..........Kt..~......I(D...2.%.S.........q'......gh..]..]p.....SA.....6fz~V.._..h 6..$,,G.Yvf0..........0.....,.....(..T....v..h..Jl.........\..~.2.^..*B..N..Y..z~...Z....i..'.{..T..{..TzQhnw...RJfF..g...Ow..]..V.Crw.....9........./0B7!.0p.....XM..}...7...2..:cq$..7..t.7....F`...?P6..z..bjn..j!Zi....p9...n......;q..R.....w..o.B.mJ..4H......"..1.?.>.. y...dd.1...R..Ei..*.U...FK.J..[9(.......HK&.0L.X..D.O...3..........q).vO.%...../..../'.J....|.E....E...=......B0@0...U...........0...U.......0....0...U.......f.....K.. ........>0...*.H...............r@.v.~{..d.2{.<.]F..,.p]....}...!..Y$.....}.#.4..|r....T..Rp....;.:.2.!9.....Oj...?/|.X...9.>.=Js.@z. a.g..$..mU,Z..%r.....Ub...c.aD#........M..#N!.[9[W./].^.y.|..M......y.3....0.>...C?.Z..D..|.H.3.......>.]q....t.aY...Z..r..]6....<....D&....p.......@Z..l{,.V.G......!..f..%0.\...g..m....O...'........H......>LQ:.......&.:...i...)dQoh....A.........=..h..g..`.U.a.W|...aI:.u....?g...(.1..W...|..~.....6|[~'.z.....R...Tp1.C....>..~0dP....3gMhO..........%:..Y..\F.g,.F..H..[...Q......7"... t.-..k....!..y.D.........
<<< skipped >>>
GET /s/applicationIE6-app.min.css?2015041501 HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Fri, 25 Sep 2015 03:33:58 GMT
ETag: "5603ac7a-1633"
Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT
Server: nginx
Content-Length: 5683
Connection: keep-alive
div.data{margin:10px 0 0 0!important}#app{position:relative;width:728px;height:428px;margin:0 auto;text-align:center;background:#eee;border:1px #abc4e0 solid}#app div.publisher-logo{background:url(winportal.png) no-repeat 0 0;position:absolute;left:20px;top:10px;width:150px;height:50px}#sidebar{text-align:left;width:160px;height:375px;z-index:100;position:absolute;left:2px;top:0;overflow:hidden;margin-right:0}#sidebar .logo{width:140px;height:40px;padding-top:5px;text-align:center;vertical-align:middle;margin:0 10px;margin-bottom:10px}#footer div.sidebar{float:left;text-align:center;width:160px;position:relative;right:135px;top:0}#footer div.sidebar a{color:#777;font:bold 10px Arial,Helvetica,sans-serif;text-decoration:none;display:block;line-height:10px}#footer div.sidebar a:hover{text-decoration:underline}#abw{background:#ddd;margin:0 12px 10px 12px;padding:10px 10px 7px 10px;text-align:center;border-radius:7px}#abw div.icon{background:#fff;margin-left:4px;margin-top:15px;width:100px}#abw p,#abw a{font-weight:bold;color:#777;line-height:15px;height:27px;overflow:hidden}#abw img{width:64px;height:64px}#topics{margin:0 0 0 5px}#topics ol{list-style-type:decimal;list-style-position:inside}#topics li.active{background:url(iconos-ie6.jpg) -253px -325px no-repeat;border-right:1px solid #f2f8ff;color:#333;font:bold 12px/34px Arial,Helvetica,sans-serif}#topics li{color:#444;font:normal 12px/34px Arial,Helvetica,sans-serif;margin-left:7px;padding-left:10px}div.publisher-link a:hover{text-decoration:underline}#footer{p
<<< skipped >>>
GET /s/iconos-ie6.jpg HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Content-Type: image/jpeg
Date: Fri, 25 Sep 2015 03:33:59 GMT
ETag: "5603ac7a-1a3e"
Expires: Sun, 25 Oct 2015 03:33:59 GMT
Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT
Server: nginx
Content-Length: 6718
Connection: keep-alive
......Exif..II*.................Ducky.............)hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:083E11C9A93A11E38238EC1A77F349F6" xmpMM:DocumentID="xmp.did:083E11CAA93A11E38238EC1A77F349F6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:083E11C7A93A11E38238EC1A77F349F6" stRef:documentID="xmp.did:083E11C8A93A11E38238EC1A77F349F6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDDDDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6 6DDDB5BDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD........].."................................................................................R.!Qa.....S....1...A.2r.Td.q.."b.....B3.4.#Cc......................!1A.Qaq...BR.............?...N{..9e..D...'.$*.S.'e..7i.*g.Jl.JJ^.f=..s{...vL...u.'j..{-j5.....g]..?.D..G ..@........................................................................=*_.2..mj='..d..V1...bP..C.......................................................................................................
<<< skipped >>>
GET /min/?g=css&14 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:03 GMT
Content-Type: text/css; charset=utf-8
Content-Length: 5672
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Expires: Sun, 25 Oct 2015 03:34:03 GMT
Vary: Accept-Encoding
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
ETag: "pub1435676311;gz"
Cache-Control: max-age=2592000
Content-Encoding: gzip
...........=...6....n.\.g..^%.T.*...>..i_f.R..I.)RKR.n../.-.e.;....n'....bw.............u.......e.=..E..j....D..MYo?.wu..m.........n....z[b..6uwX.p.?t...'....Y..._......Z.......(.?[...5..Z............uY7..8...............v.X....M......#..-.oQ..-n....{. ....:...v.'...ys,...........)....P..;...s.....u...._..P?.R...*.MY..M.?.....oj...n..y..|.........Ay....;..'.:...z~B.{...t:...1f.......?h.y*........n.6...dN...........K....i.....b.........F.....b..a..JT/...U6g.i(;....|.(P.....lP...&X).<00.\s.f..P....!{.w.......p..m.......t..P..r.....!.?.=d......=./p0.....2...7>..TusD%......mF..S.r...u.R:....3.[..1.....@..ab..........P.0..fm.....0.........Ce...H..!Z\.....\S$...-)..L.m.2....bJ....Y..Z.zn.b.l....5eG_....>.}Y..,>.?\...YY.[...W..DxR...ij%....)....e_......^a.O.|m.K..L.w.....Tb....,..D[..P....,.=..~...l>....?.. ......./S..Mt.NGE..l.w'&^z..|!.b...B@,bJ..1 ......^......G.3.e.6%.$..PG.!'"Ft.rCb.....J..M[........>.....8...x....*R...bqAAY.k ..3.>w.U......H./.....t#T...*G..C...Q....j>"..}....\.......ul...<)...:].Alm.%...M;p)[.....a.z{.7=\6.~.2....H..dqr...b...i...Lk...m...?......b..|g....CW.B...}.O...:..<v.s.tOE7.BW.FT...>..>o...].....%..............z!...B..8. *..ah.8`)..!.V.......0j.O...M.L..f.R............0.D..%.fF.R..e......w....x....mON?)..<..c.G.aA..E..t......s..F....T6E.....Z$...{.~..........C.].t 0.....f..r..0....|qx/`W.@....1.E........b....lV..tT...EnFK..j..7!..A~Y.d'.....(2]9..j.....H......1@...CC..P1.>7.9.RE'.Dd.n..&..l.....U...1....*.O.."...t.d....c`.e\...%~j.fM...B.m.#..0
<<< skipped >>>
GET /images/logo-en.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:03 GMT
Content-Type: image/png
Content-Length: 7622
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-1dc6"
Expires: Sun, 25 Oct 2015 03:34:03 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR.......<........f....IDATx...y...}.?..^..zUw..Z[............C..0"...8..ll..$3.6....A.L6&6...C..H8........;.$...F.Z..-=...Z..Q.^.W]o.ZZ".wN..Wu.....o..{KH)iP...F......,...\q..i...K..@...F.cH9......?S..P.`..`...|.KC..=..j.......n...zT....H9../.../...A......7..u.m.=.r......2u.4...6...c..5..A...........z.. .......)..........C...........?.._...X".i.Un.H..xy@"..i$..D..i..V.=......Jc..t>....=..(...7-.......g...iL#.{.'.,.w3sg.......x...^r..x..2l....a....E...C.O....5h..p.........N.....7.ri......g<w0VCH..=..e.o.....{...C....C.M.<..'.C8^...... .....%...............t.....7g5.q..c[.%px~.!D. I........=.K{S/......ex.e.F.bh.)Nf...K.Lc.R5W............. 0$....g\/....y.e...p0.._.....pE.A.....J....ON.......kX.y.oYr..2.....e.._.-.`.I,...5..O..........A........F....]..1Mv....u...e..(8.Xf:...tiI....f..7I"......I...9........v...v.}...k.a`.......... ...<.....(.~...`.........8^.U.}.y.W1.=....e`....]...._`q..hI...^..C.......Y.%....\.............. .......7.[f.O.....Q.?.\..j...M.r.>..T.."m.E...4'.....;xm...M?] ..........@...1......8.f......^.....~z.VPt..S.....@...........X..`04.M.y~. .}..wy...1<...lF.D...>.t.r...jY..;.....p\.D........be...^.)K.......q.:G4L..5..p..j.6.~. .../0........./22....TK...Y.... .|..u..GJYv.*I...E.#.;...k...O.u....4.):.|..%..........6>.>...^..q.........dh.gJ#.......}\..E|_.K.L..!....a.8?.s.}..^t....[......^.}....*..(.q..(.\.q.{... ..YK.&....,....;......._..7ie......,%..}..k`R.......{Q.&=.SG....."e..7.z.*./.2.....{..6..l....T.....t.w(.......qt..N..........m....VM..R.....~p
<<< skipped >>>
GET /icon/648m/apli-master.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:03 GMT
Content-Type: image/png
Content-Length: 2405
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:03 GMT
Last-Modified: Tue, 03 Jul 2012 15:38:55 GMT
.PNG........IHDR...0...0.....W......,IDATh.....dU..?.s...]U.=..0..........`4Q....Dw...t. .].n. t..h...AL4.P. `.3...G=....>.V.......%.....{..w~.s....S.*"....W7..x.............._.y._......<S..bZ..U]X....I.n..gj..c..A.Hm..ej.Q...5..i^....R....2......q..(.8..N|.T.%..r..%@...............e...>.T.4...*........CQ.9...Y.5.iZ...t..2.......<P .U..O*7........jx.....U..h.....1...eiK.!s..g[.`aF.yu.5m]NK....7^*g.W."{{.E.."...&h.."L.p.."....n....>.@#.?(s......../......L.V.y........Y.e.t.|..|.{....X}.i..~....H&..f.=.c..wV....HV...J......."..*..$.i..D..YKLfb.K....7I.U...<%Hb.TI...F.!1.U.K..4!v=..u....`p.N.c..JA..`...S"QR.S._AD..C|.<.....uA-V.F..3...A.G......g..A..).M..r....m..3?$....../.Ask.T.;..8...L.}....W^.{..l.....t.^.w...J!.)Qf%Q..!.s.C....7..|..'WIJ..9x.-..k..O.<.8N.@.........B..vj..._.....:...l..k.....[M.x.oc......G....("I....Q(7...O..k..T..-.C...f.......>.. ..Mf,8.>.........S........e.......).......mG%...I........~..s..c...O.~.....h>.0C..V.qDr.*.k.rG..[,N....fj....Jf.K).|..`l,.=_C..PUF.}....D....{.".f3/......=?..k?x*. NHwv.(....ts.:m_.K.y`1Me.E.T3LC....#......8n..D.....>M*........1...\.D.....o.Z...4.N..b.=.4'Y.=G...uafRE..Z.^....2[.N?. ....<......\.....t!6/........F./.p'.....|S.7B......g.8.....".y`.u.....b0w.!<{6...C.^{.....O}......h<.....f9.D....llmc..0t..T"8..q... I.......Z._....T..)2.B*......C....^.d......{;....]0..em<A.}..=.....q.XDqTq....K.9....>...#..A..QD...d....R."........{..,..eFj.a...6P.?I.\.ER.0...>..N."QL.z.F......7I.|.b.{...F.r e.U.....Db...hH3.s....#..}.
<<< skipped >>>
GET /icon/1195m/petousb.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3965
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:38:30 GMT
.PNG........IHDR...0...0.....W......DIDATh...k.eWU..k.s.}u.~.f.33.L&........A4.B(...B...R..7.R?R~....h>P%.E.P......Bb.L...2a.=.........s.^~...GwO@..]..{.>.......k_Q..B......z..?...@@.=........9....k..b.t......h..A...O....V..{..A....m-U.aTE...ncW...i.|.m..~"....}.w.....J...^.).-...............v....o.J...X...W..W....!...t....7...........N..h......v.S..x.>....G..P....:e....r..)Z..".T..T.0..#S.0.5$.....e...\A...#e..1...G......5.(.......O?...>.j.BT.....:.v....<.....H%......R:.....oa.dbp&...>.^...5........ad[F.K......o....n.Q.<B<8N.%..y..'."..v.5X]P1........i.p'.G..%.>MEAp...../ ....s...\.....ocq. ...\:....'>.^n.7...........=........4..S...g....?.uj..6,lWEp.....?~...>...7.V.D5. ......~.K...9&WOS....x.l$.,.\O.g...]..........{........u.6*.W`n.*O..@i..$.{....X.....2JY.#.Nx.Vv..K....S_...Bz.~ZQ..2....c........2F}....S..e..WXz.<.6W...C.M..3g.....n........... mK<0..T1. F1........M...............C.&.O..qp.E6..$..Gi....6.?.oL=.)F.....d...4..1.i.....n.2..@....M....w..J.[jpx...>.V.S2bJI.....j..m.n.T....Kv..x.....6.:...._cf.....].......w...2.~..o=.......-....r...............~....{6/....P=x..&f.....Q.....1.D...h..H.C.$4.......F...*Ys...}\...d...(..U...@..H..0z......ri..{.C....Nj4}. G,.9.....4e..K..=N4.g.W......(y.W......(0dbP..Z..W..h....X..0..%.bM..2....t.J{....A..=.Mv.I.Z.*v.*.r5...Pk..s/"..AR...n.K.do~...f..[.A,X#X.F..2........>W.jR.."&.`V=../2..?...y.Q..[y..... ....S..P.................*..&.....x..S.N.....g......Q.7.... >..C%..X3. V...b...Dh..i...pWs."..DW.|..:KQ9.....U.?......
<<< skipped >>>
GET /icon/892m/stardock-mycolors.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 4220
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:39:04 GMT
.PNG........IHDR...0...0.....W......CIDATh...kl\.u..g..}r..(..i.Q.J.....M#W.. -PD..8**.MQ8.. .b.h........u. @........M..).'v.(~..e.....$>.]r..1..w...Cr......sg..3.1g.b....nX.V.% ....,?.......u.......(u"..cj5.....$q.$..L.......%...8.%.....k5.f..6.o.s..3.2SO......W.g.&..C....;w....vt...(.YWR.!.........>.ub......1..s...QJ...k-...&b8mm$..h.s;..}$w..f2....t....L......|.7...C..NL`D..b......y.m{..r...w..M.1@.\&..Q(..}.i .u.d2....L&....Zj6`-.H....)....?......6}.ZC...."......(............B...".r.6H.]"........v...]w....;ikk[ ....Z.j:..5..~....N.R........2......a@....M...L.aK.E..u%.=6.!..<...~.......>:;;._.........)..9L..3XQ...T.Q..JaH5...>A...N...x.uy'.....L.......i..9....I&.k\e3.f;P.....J..u....B..c#..D.....|.p.2..}F..t.....\A.;@.P..G..._.*'O.\....0.bj.....M.F.Rh..k.u[X&_..K.\XZ..2..-...D.T.... ..D...1.|.A^|...m`.^d[.8.f....!.\.Q.......k.N.|.....9......t.K.].fcq|...4....f.|....X,../}...d...F....u..\.:3....F.........1@..X.-.2..|q..F...,....U.....Er..5..5......... .......r...k.vV&....r....5. .........."P5)..../s{{;.g2Lj.xh.6!E..Z...iM&...j...O.`...s..Q.....w...........)...].T.c.;I...._..1d..i.<v.R........ .Fi..B..2..bViW..<...<...tww.K@Im=.)x..6.%...d.0r[X.....#.gS:EW"AZ)..3.....R8J.Zc../...y.X"^...|R...?Z.1eB.0 ../..9}.4.=..Jd_%k....1!..o...>J)B..8.'n.. (........ .._.sq1...S.W4..5"...B.(...3.(.....J.E......<....8p.[n.eMdt..%ZYb....W.}.d..E.....U)1...............Gu\h=c.=.gh....%...\..R...p.....x.j..B.......K,.ql...mC.<.c.........W.@....c...g.............R.!....|.n,!..{.F.Rc..f..1H}.0.3.9.
<<< skipped >>>
GET /icon/11653m/idm-scan.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3759
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Mon, 03 Dec 2012 18:20:31 GMT
.PNG........IHDR...0...0.....W......vIDATh...i.#.q....n4...{j..L..(9..._..P.").;...08.....n4vH...=...@U....Y..\... b.Q.%....@.D....^.....a.(.q...`......).....@..G..^..........H.>h.....|.J.`...Y...`Y.. -......8DM/...|X.9.W*.k/.........nxP..jIQ/.....5.{ZBH.q$IJ.L..9..b......j.7.`....V....a.>.%..G.bW=.....Z...1....6o...:.Ip6%..&...hAj.8;E..*.&..`..y..G.~1..z..........R...;.....#.EU...3.G.`...... ..v.d.`>.$KOqv.....C......Y......_....{Tr..h.....j.h.A.....UPj....&..PGb'...,f/.............sG.z...;=E.4.ix...........f\..3....O.E..P9V....]...)e.#/...%e.CM.....U.&...d.,f..L..L@].Q.F}~....uB..P4 ~z.K..ZRs...o..W.T...*_.....R-Fgd.%......YM..X.......'.....l..]y..r...kNg.p2C...G....Fp.*G..x).[..'G..&.>.Wf.5...?}...@e..1..II.I0..0....p1;.|..u.a..e..H.lA*..R >>mxX.......o.2P.<..h.@.o1}R.(......D.M.X.c.].WK>-..}...fP-...:&..NF.......M..N.Z\p:.G^>..~`W<.. ..V|z../.xy.%V...T.W...z.,!DA 9...*%.0I.8..d...v.W*.B....B.Q.K...e.a.-upsxOUA....l.${..zd..a...j..`U...{^]|Mb......... H....'....d./^. .......*....j.P....'..d....cQ.#..}....V...7L/...w...#..PiY......g.`...z..L$......J.W....Q...J..L...-..za.\s..'......vxt.vx...A.`5c6z...?1...ac....l........"..(.g_/.E..u,...-...-....[@A<..#{....I..4..{...=r...>".....VNxu.5.;...9...........S.a.............XU....l3s......9...^...^`.}.T.|.~Gd.w.b.sy..C.J..z...(......J..l.GT<..b~.j.........0..\....A.........Y{.D..A1.?...Zf.k........).....JH..^Q7y..1.lLQn.....cH..W...1G.#...[...}_U{Oy...E}..]r...1.-.....7q..rB@.......dNS. .......I9..#e.. '~.N.!..Q?..\.......1...`
<<< skipped >>>
GET /icon/9277m/winusb-maker.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3759
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:39:07 GMT
.PNG........IHDR...0...0.....W......vIDATh...i.#.q....n4...{j..L..(9..._..P.").;...08.....n4vH...=...@U....Y..\... b.Q.%....@.D....^.....a.(.q...`......).....@..G..^..........H.>h.....|.J.`...Y...`Y.. -......8DM/...|X.9.W*.k/.........nxP..jIQ/.....5.{ZBH.q$IJ.L..9..b......j.7.`....V....a.>.%..G.bW=.....Z...1....6o...:.Ip6%..&...hAj.8;E..*.&..`..y..G.~1..z..........R...;.....#.EU...3.G.`...... ..v.d.`>.$KOqv.....C......Y......_....{Tr..h.....j.h.A.....UPj....&..PGb'...,f/.............sG.z...;=E.4.ix...........f\..3....O.E..P9V....]...)e.#/...%e.CM.....U.&...d.,f..L..L@].Q.F}~....uB..P4 ~z.K..ZRs...o..W.T...*_.....R-Fgd.%......YM..X.......'.....l..]y..r...kNg.p2C...G....Fp.*G..x).[..'G..&.>.Wf.5...?}...@e..1..II.I0..0....p1;.|..u.a..e..H.lA*..R >>mxX.......o.2P.<..h.@.o1}R.(......D.M.X.c.].WK>-..}...fP-...:&..NF.......M..N.Z\p:.G^>..~`W<.. ..V|z../.xy.%V...T.W...z.,!DA 9...*%.0I.8..d...v.W*.B....B.Q.K...e.a.-upsxOUA....l.${..zd..a...j..`U...{^]|Mb......... H....'....d./^. .......*....j.P....'..d....cQ.#..}....V...7L/...w...#..PiY......g.`...z..L$......J.W....Q...J..L...-..za.\s..'......vxt.vx...A.`5c6z...?1...ac....l........"..(.g_/.E..u,...-...-....[@A<..#{....I..4..{...=r...>".....VNxu.5.;...9...........S.a.............XU....l3s......9...^...^`.}.T.|.~Gd.w.b.sy..C.J..z...(......J..l.GT<..b~.j.........0..\....A.........Y{.D..A1.?...Zf.k........).....JH..^Q7y..1.lLQn.....cH..W...1G.#...[...}_U{Oy...E}..]r...1.-.....7q..rB@.......dNS. .......I9..#e.. '~.N.!..Q?..\.......1...`
<<< skipped >>>
GET /icon/40m/norton-removal-tool-xp--vista.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3997
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:38:46 GMT
.PNG........IHDR...0...0.....W......dIDATh....ST...?w........(...T*..r...fav.d..#...&....,R&. .*..T.q.Q)..B.F...64..p.wA=On....{......>...=.{..x..........(......S...uq.....KUUTUE.u..@U..k.=..)....7-..6..<...."%\.%...H$XXX .J.....y....ix........iTVVRSSCkk ....B!TU.g.{..... .y....-.L...3...)))......&....D"....-...r..i..4.....y...9r...h.@*..(....oa...E...y..%...tuu...H ......G ....r.m....011A"......G.R]]..i.......~.Y[[chh...Y..........M.p..B.@...4ML..q............$BkkkLNN.H$.......P($.-..M..............o.&..r..I.......r9...X]]e}}...u...D...h.F(.".....)--.0......KEFGGq]........!.zo..p.EQ......~.......S^^N.P`yy.D"A*.bmm.....~.......f....u......m.x<..........Q.T..[!................G0.$.J............`...-&..d......&..H.V.E...............g.....y.....O?q..YN.8.i.,,,011.....mc.......-.n...............{....:..>.......1.C..u..........p......333<y..d2).........?....r..q<..4M.?.N4.e..=8...8...211... .htg.s..H.L&..................CR.T..~.nw..0dp.D&..u....:::(--..mFGGI.Rh.Fgg'mmmx..eY$..677.t...`P...*..wEQ.m..w.....O.F.4......>...E..w..a.D.Q....F..B!.....m677YYY!.....Fcc#...8.SSS,,,..*.i211.......M....cdd.X,..c..........SSS...SYY......?frrR.._p........P__/.^...PQQAss..D...H&..b1.|..c.&ccc...PSS.............&...(...B......F.477.L&...bxx....,K&.|>O.P..<..;.......x.'.9.,..,....{<z..l6K.P..,....i...._...eY.......S)<.*"....,,,H.K$......f.m[.o.&.e..:......S...8..aQ....?.(......<O.E.,.....&....jiiadd.L&.O......c***.F...i........ ........g) .q.\.%...i.,..;..=..YW...8tvv...[d}..........A..#...i..X..
<<< skipped >>>
GET /images/social-icons.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 2227
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-8b3"
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...%.........FI.N....PLTE..........y.Kf..!1-D{d..)...........Xt./-..u..{.*.....lkk......Ts.c........&$%j.R...857.bs..............?AX....fffF^....Ql.'..y.....>........[y....JZ....1...M^333...h......F}...*))h}..........Jc.B........M..Lh. ..Uq....R...y........':...;9:......,..!..xNS2....TSj....0I....u........"!!f.......................*..%...}.........`xoMJ........:.!v..t..C[....<...*A. 3...,........utu......Jc.........tRNS.@..f....bKGD....H....pHYs.................tIME.....3/..(.....IDATh...._.F..S.sE2..=.f..."_.5Eg 2...68.1....m".... .O.s..%....G_.......}.PJj.i^9..D..i.V.{..\Y....K....>.it=Y...`}L.........2..n..F..l....1k.7...8,H....6,;......nY..u..T....v...,8..E%.....K ....X,.5n...V...P<99Y[S.j.[j.......ZD0 .....i...r)n.$.3...U.Ev.....pn.X.n-.|ii......NkIAZjMd....W.....w.#....-....fE7..@Z......x..j......p..Z....Vg=... F`.......|gV~\ j8.WX.k'.........<...Y";....d.!....G.a...=z|z.Gn'........|%....'.F.}.k..w...d.A.i.u{..@..pS".;..Fn....~.....$.:`0....GGGp.M..../(..I.r....%.\rN.......g......n.n.....u....|...nU.. .K.`....[...p ..R...`whU:.....y..p..G...^&.Tn.....$...2].....,..<_...Q.YA.p.......:|.y....Z:...%Q......l...X..*.6...|.O.bq6...........N..-;T...q...oFN.........x.-%......-;..K.. .'.X...Jl/<.`.5G..B8m...7[hnnn.N.Y..W9..Id....$zo<=z|.d...O......N=....SO!jybkk..dqq.=....X.h..-(.rW...w.Z...D.....B...p/f).20...Un..&...*.k...H....b<.sQ......f...%..c.<....3.....R;.x.Q&s....o...U.4Z8.}.....'..........5....{......(...j.5-(];...q........$..NT......2KXw#...%l...}p_.6...N...
<<< skipped >>>
GET /images/buttonbg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 127
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-7f"
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR................(...FIDAT...........h...........=...=q.... s...'skV..x...!..IKl....4.-3......C ...F....IEND.B`.HTTP/1.1 200 OK..Server: nginx..Date: Fri, 25 Sep 2015 03:34:04 GMT..Content-Type: image/png..Content-Length: 127..Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT..Connection: keep-alive..ETag: "5592ae97-7f"..Expires: Sun, 25 Oct 2015 03:34:04 GMT..Cache-Control: max-age=2592000..Accept-Ranges: bytes...PNG........IHDR................(...FIDAT...........h...........=...=q.... s...'skV..x...!..IKl....4.-3......C ...F....IEND.B`...
GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: text/plain
Last-Modified: Thu, 20 Aug 2015 18:11:19 GMT
Accept-Ranges: bytes
ETag: "803dac9c73dbd01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 18
Date: Fri, 25 Sep 2015 03:33:53 GMT
Connection: keep-alive
X-CCC: AT
X-CID: 2
1401D0DB739CEE64E9....
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=604800
Content-Type: application/octet-stream
Last-Modified: Thu, 20 Aug 2015 19:08:01 GMT
Accept-Ranges: bytes
ETag: "803e6c887bdbd01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 50006
Date: Fri, 25 Sep 2015 03:33:53 GMT
Connection: keep-alive
X-CCC: AT
X-CID: 2
MSCF....V.......,...................I..................G.` .authroot.stl.W....8..CK...<T.....c.5(..=..!Ev"..d'..c-iTBWI.H%..V.........E.%)...f....uo...~/.3..s..y>...=..l...dbUH4M...1....&J.}<...#.L..\.x!F.t.^......q..l8p.i.J'3.........J.5v....z-...A4U.T.E...h...}$.....5.=.....VnU..E.[.[a(.."..G..P..k.m.3.....EP>.g..?.kY|..L.v...qDz...T.&p.&..:.f....T.b..\...Af\..J..I.....tN09.......|,[r._..x..Y.e.(d..o...`3........(... .$...V..e.y.s$p...u...........W..~...A.B....GoOV.....JT.."VF.<.A....3...r.......addf`.....ph.J:r.E..[\L.X.:....?.. .....b...l....St...U.N;..a.h-W....4.Uqb.MbF=.X.C..DX..............V.U..P.....'........P=.?...s_.j...W_....P...-..t1@....s:...5..j7[.!Yb|.....l...G.F.E..?lg..m-n.(/6I..........._......5........n.t.<.'....Nim..;.!{........N.h...u.....x`... gR..B..V{.'..=}..=|.hg.9.6....j..w.[P`.G.....d..............!..t./..........*.@(8(v1....'..Z. ....R.r....1Jn.j.[p..At..W;F.(..a...N...X....=.[..'.r.....^$B.a...9....,v-...%.2...:...[..6.j...1..!{.....n..={.U....%...y,.....>a`..0..6..SJda.)9x...zqc..X..Vq.1z.....'^.....^sU|$.u...~.Lgf...Y...V..(f.(...m...-..-&,..c&z...-.....fGO..6...N.y<.z..,...g|.....!..$....<....q......q8.<t.k.p.=......z.}.Q.U....&J..-T......[...........}u...T.......>.y.e..CF".VX$;&T.>..].3.H....7k..w.m...(..#c...@...v....[..l..w.e.2..3..(y. ...|K9>...o..Uz.....V..W|.k.|...,..V.xPmV...X......!.........Jj.%.N_.9T.~...v...C.!.4.5a.!...(..../5j...@p.....S...F.jde........PC...MZO..........D~...%y.....i....a.$vu.7...{.6.{Y3....5.YD.d>,.....b...H.
<<< skipped >>>
GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: VVV.download.windowsupdate.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Content-Type: application/x-x509-ca-cert
Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT
Accept-Ranges: bytes
ETag: "80b4b9e9dc5d01:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Content-Length: 889
Date: Fri, 25 Sep 2015 03:33:53 GMT
Connection: keep-alive
X-CCC: AT
X-CID: 2
0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0................O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0...O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<......<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...Sn..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0...U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H..............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU.....9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 200 OK..Content-Type: application/x-x509-ca-cert..Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT..Accept-Ranges: bytes..ETag: "80b4b9e9dc5d01:0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 889..Date: Fri, 25 Sep 2015 03:33:53 GMT..Connection: keep-alive..X-CCC: AT..X-CID: 2..0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0................O.~....%k.H..*.......c..gf.....H ....
<<< skipped >>>
GET /thanks/?q=Google Earth HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.winportal.com
Connection: Keep-Alive
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Date: Fri, 25 Sep 2015 03:34:02 GMT
Location: hXXp://VVV.winportal.com/thanks?q=Google Earth
Server: nginx
Content-Length: 178
Connection: keep-alive
<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>......
GET /thanks?q=Google Earth HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.winportal.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
Date: Fri, 25 Sep 2015 03:34:02 GMT
Location: hXXp://VVV.winportal.com/google-earth/thanks
Server: nginx
Content-Length: 0
Connection: keep-alive
....
GET /google-earth/thanks HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.winportal.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 25 Sep 2015 03:34:03 GMT
Server: nginx
Content-Length: 4931
Connection: keep-alive
...........].r.H..;y.YN.b._.. @.!ec'q6N....n*.....u!.0&.y......oF..-....V... ....7==.=../{.;.....A.......\;...J.0.n..x<.........i.5 Sbe.n.#.B.._y^..d_...y.SJ...k{..-F%.n;4..Q8....u.*u<7.n(.N..D..W....Pd.<'.@....FaOh.Ny....V....H.gkR....D....... ...Y.I...<..................V..Vw.Z..i}.....?..-....n....\...L...-w...nW....\..e.....^....oo..^..W.AjA%......7..EOw,{....a..P...M...a...y..%.......w........_.[(.......R....R.d4x(W".5-.U.....a..".....CJ..I...n..h.F../.Z...~..i.>.......g......m....YQ].Wzt..&.J..y_.BZ..?..O.....X.......9...ax#7,?#...A.Ku.!.....y.;. ...u..eT.b..3....`.o.........G.pe.q..Fo.......oP....A...#....q.C.oS.k..1Y.|N.z.u....."(..z0q.....e..V#......`.LZ..l...1............b..e.....Yy.....9#..nOB..f.z...Q.l,.,G}......S...zh..'..s.T...~.y&.Xn@.p..<.n..g$...ms...b$..S|.ui.3'..O.M.....@..}}8..a7n.eK.Vx.'.#;...d..OX](..z@mj..,....m..m...b., .~. ......Iu.V.........0p9.....O...z.....U1...S.c9.X vA.e.o... 'C......y)e)y......:..i...;.E .:...~,}...|.p.......%/.a..~.4.<bq...}E}Gw.... ...z:.> .>...>[?.@nS.h....\D....#........ .......O..FA.C.y1......#....s.......'P......W...gp(.Hb.r.4c!3...O..U#.B.X..~..vx....|..VI....6..e,?...r=U...."P.D.................5.......*.. L...0..3%..._J.d..8-....t...4..kfd.r5..m!.u.6'.....l....u....N..>..1..?$o...*....]j...$...kF....<aJ.X..LE..tm.............Y.c.~..o...)7..."WV`...'.$..{A..GD<..g{6{.....L..V....e..zCU4...h.2.......R......Q@.............Q....`....R._......TUV.&..}..,Ke..../p.*.^..-3.....Y&.j..a..I.t...$..S....\...r........snr./f.,...
<<< skipped >>>
GET /gs/gscodesigng2.crl HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/5.131.2600.5512
Host: crl.globalsign.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache
HTTP/1.1 200 OK
Date: Fri, 25 Sep 2015 03:33:53 GMT
Content-Type: application/pkix-crl
Content-Length: 1802
Connection: keep-alive
Set-Cookie: __cfduid=d228cb2a9e0427670368786a53e6746e51443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.com; HttpOnly
ETag: 015432
Expires: Thu, 01 Oct 2015 23:00:00 GMT
Last-Modified: Thu, 24 Sep 2015 23:00:00 GMT
Cache-Control: public, max-age=588367
X-Cache: Hit from cloudfront
Via: 1.1 b47ef3766a859c0c1ae31872e114e497.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jfhWD9UoHBaO17LVteJh2FL9nAdzdBBNmX6Dkfjxca6y3AQCzPp8ag==
CF-Cache-Status: HIT
Accept-Ranges: bytes
Server: cloudflare-nginx
CF-RAY: 22b3ab91b2ec1467-AMS
0...0......0...*.H........0Q1.0...U....BE1.0...U....GlobalSign nv-sa1'0%..U....GlobalSign CodeSigning CA - G2..150924230000Z..151001230000Z0..40#...!...z..g{g.Mt..G...121120180003Z0#...!5....u.H.5.n..K...121121154803Z0#...!a. ..5.Q.....g.Y..121127202406Z0#...!.9...^............130118021202Z0#...!.g.|.d..-,...A....130201163603Z0#...!......R..B.....h..130212223046Z0#...!....oL$Ds.|...IN..130327184808Z0#...!,oYM;.LlE.I..D.k..130328114802Z0#...!Im..y..j.|-.`[....130515143603Z0#...!y......"y/9r.;b...130828141203Z0#...!...r!d....%(...I..131111162403Z0#...!H......w.X8...(...131121104802Z0#...!.........G.5g-....131121104805Z0#...!....d.z% C....(...140117143602Z0#...!z.....V....U..N...140117144802Z0#...!/,.Hr.;...u..0C...140123114803Z0#...!.$u^.......O......140212083602Z0#...!........1..ITc.a..140224104803Z0#...!yx.mo`...L.s.1....140224104805Z0#...!.....u....e..!Kz..140303102402Z0#...!mv\......"........140313101202Z0#...!M......Y.......f..140318134803Z0#...!%.t...Y.w.&e..^M..140326160003Z0#...!..8..Y.j.-.. .G...140610120003Z0#...!.l@q...@....jw._..140831091203Z0#...!..../.....[.dCC...140831100002Z0#...!..d.8...|..x,F....141203205323Z0#...!../..X.js..a......141204022544Z0#...!...r;.'.....'.....141204022710Z0#...!....&h..O.6@..8...150202133603Z0#...!7..]...q.F...6t...150225074259Z0#...!..l.~...&n........150407141403Z0#...!.N0.,.............150422200911Z0#...!w.S......FP.ee....150512133508Z0#...!. D.......*.Y.?"..150616081204Z0#...!.d....C.q.|)..5o..150902182412Z.10/0...U.......T20...U.#..0....n......>..t]..../Pz0...*.H
<<< skipped >>>
GET /ga.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Fri, 25 Sep 2015 02:44:58 GMT
Expires: Fri, 25 Sep 2015 04:44:58 GMT
Last-Modified: Thu, 10 Sep 2015 10:52:20 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 16022
Cache-Control: public, max-age=7200
Age: 2945
...........}kW....w~........pk..f......ZZ(O.,.!$$!q.....gft...>{....%.G..>..fF~2........;>..i...&.9.....v*.|x.|$....L.....y. 5.....!..R*i..........>..mAf.o..@.0L.....1....w.v<_-.|aa.......F.p,....yA.....Q.{'...kyA....^.S...'o.2......5K..2o'~.....F#....*.7...c.#.l.P. >.L.j.4....h...L~-....JW.Z..bm.I.9....s..;...=..Ue...b....r.................).......dO.c....v.f...^:....=.}.N'.-4.5m|h..tb.6v..W..r$.@.8................v......e...T.t.h.c:..(....~.e0.].....{Y.p.....K.@L..JZ.q.s.8...T...9..1r...u.KS..(xa!..{0!..5.4.^...7..."..........J8... .....O....t...q...|...a......a.V.q.5.e.([2..F[.........E...W.|....5a...0..0...Ma.ML.....d....3.....=/.z`....i....ku#.4.b.Ra.^.:.-.j.*..L.......A.;...Q.{2i.....}l..H.....T...Y._.Q!q ..V.y...9.@.R..8..!x!...p.e4...'$c......x....'..AF&*i.../..@...!..zx..bq.{<..9...~..]...cW.Q....@A...........U..}. .ihA..n..KK0:....b....@.D..U.....b.I>...-=...|..E.._.W.pS..5....4.Ma..|.B......w...b>X. ...a....gV.1...ra!ZX.).,...[..*[.....)s8.. .....X8.c..D6'ai.6..Q.u10..N...p...>V.............!V.......p#.....#.j...b......C....^........#..>E.`.........y.....%..M.D.e...Y.HB.....a.G(.b.P.=.......'...&.T._.B..C......T....8..Ra.5.o.*...!.o..t ....`"@...='..<.Z.n..}`...m...TY...-...&".!.p....j...H....z........|....H.....*...4"...K.0D8..2...`.O..R......../`2.6.F.W..,...2.....I..Y....o...8..yA].....G.....8..8[..U.*x..).]...=.\...0<.pu....7%.e?".P..f../.C??.h..8|Y.....W.j...^.O(.O.....3W\Q....~.N.G.Z.3.OO..W.....7i(....c...!.Az....*...*..pdo.c4.k.%..}.......". ..f...{_.z..
<<< skipped >>>
GET /r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=VVV.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Fri, 25 Sep 2015 03:34:04 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Fri, 25 Sep 2015 03:34:04 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;..
GET /icon/810b.png HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:33:59 GMT
Content-Type: image/png
Content-Length: 7611
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:33:59 GMT
Last-Modified: Tue, 03 Jul 2012 15:39:00 GMT
.PNG........IHDR...@...@......iq.....IDATx...ip..u...v..;@l... ...(....(J.fi.D.yO..8N..=..C...Bf.&5....8....GN......h.,...............w>..~. ...^.......{..9..Xk.....o"B....<.~.Z.....E.9..k..'...z.T...G..E.U......[kAlHG.q.DF.Xjr..........(P.0>..SE.._btl.B.. .S)...ikn..&Am.....<,j.P.4F..."..E....@.1.b.i..U/.9..TL. ..e|....<GN....3.>?...<.....M`tH..C...TB.....*Vww.i.jzW6.T..&...P.A.X.....}.h..P..K.Mt.[.0X40[..}..:6. ..9|j...".t....mM9.k.Tg}Z.S..*..K.....g|......Cc\..$.I......t...nz......EU..{i........C..TX~..-.6.. Lk...9.|....=...,U5..^......jK.....6Cu.'.C.!..J"....J%.L....4g..9x.<o.......-k..m....M.4'.('..Q.\.o.........r7F.....c...O.._.....32'.....l.\....._.\_E]M..l..].i.I..,E..Z.j.....H8}...(.L.-.........]..JE..m ...jV...Q........&P.W|AY..k. X....[~....}.8G/.P..,....".....X....O ..... ...iK.aU#.o\CwK..g...^..50W.v.=......7........7.{..T.....|(M.cL................<....9..N..$......<......X7.5`u.1(...%.JS......{o....ki.M..M.i` ..|.w......5g.....].......,..~).!....G.j..e......<.......wq.o..M!..{..X/.U>V|D...9'k.F.......S....'.\{E.....m.:i.._.0..mN....'v..3o..g%....|t}3ikY....b..Kz.............?}.....l...V...I....N04>..T."I./.../.h.....1`.;.%'.].. &...2E.......K._K....0..j..al../.?.w.z.e....o....md.../...&-..(.0.X~..a~..;ds9..q-w.p%.... ..T........c..Y......xe...k,.h.......X]..%T(.t.).....?...l......X..U....W....{...../..'?....`d.m..}.{.P.0....3|....mY....m<p.j:.}2X.@.H.Y..Z2l...5... ...4.$..!(......J)D...... ..F<.&..9~...zV..%..0Y._.. ..U7...{y...W.v...:t..B....!o,/....?
<<< skipped >>>
GET /css/ie7.css?v=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:03 GMT
Content-Type: text/css
Content-Length: 165
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-a5"
Expires: Sun, 25 Oct 2015 03:34:03 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GET /images/blank.gif HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:03 GMT
Content-Type: image/gif
Content-Length: 43
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-2b"
Expires: Sun, 25 Oct 2015 03:34:03 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
GIF89a.............!.......,...........D..;....
GET /images/grad1.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:03 GMT
Content-Type: image/png
Content-Length: 221
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-dd"
Expires: Sun, 25 Oct 2015 03:34:03 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...............u%....IDAT(.uQ[..!......%....~...n.q|@. ..!."!`N..H.3!..).....B..|'.W.K7yc.L\<.......U............>.......W...K.U..._T.U."......Z7........._.{.......hM.....5..y.".9.~Ya...q8..#......IEND.B`.....
GET /images/langs.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 233
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-e9"
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR.......(......1......IDATH.c...?.51....3.....N.b.j.(....... Pj.....P6E^.0.....4.....0r...p.....?.;.....:@...u!..........20....(6p.p.5p..Q...8W..D.n...(4.>..4%...I$. p....h.5.6..Q.@.^..~.J..t8j.`2.......N.h....IEND.B`.....
GET /icon/1383m/installshield-2010.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3081
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:38:31 GMT
.PNG........IHDR...0...0.....W.......IDATh.....T.u.?..73..]X.,,.kvY....qbS..];..X..CM.XQ..JREU........Jv.G. E..FQ..v..6vDc.ZIll.L!...`....b..3..=............^i........{...x#.9..8D....... .-.T.. ..@ .p(."....w....*...f=]ca.....i}`..E...}.|H@......I....W.v.].n.&f.w.....R..m|.R.....q~..^H3..j...`;.).XU.S.l...par....8.......Q*.....m.D.....\......).......t..'.:.O.g..).j......L.h...z>..D.@.4...j.W...KOE.X...{.....F'.%....I..y.....{G^..8...Ap.a...U......_%.<..J...A:Q.y......G.....G..b...cc[S?..#@,..2\..<...p...\...k....w.q,...;0.....5.[4._.$...}k.g.M..s/r..W.m.Nfffq...q.k....^SN...Z......>|..=..r........3Fo.....93~.U.s..1.q.B!u&Rv)WJT...I...`>5......I........J.. ii0h. .%.f.j....e*q...N....T.Yp..m...MkC....V....I..4.h.L.......J..7.0.....Z...3~n.K.....T...h.........p.J.V.SK.]l.Mk.p..l....J......>..0....7....O_.J5`...x.Uq..RS..R..t.a.^..)...`...............j...P.!........y.p....0...5...s...H.S..C..M.......".s,1..>6..wM'.%!...0=s.#4kK.U.....z....`M_'.F6....P. ...U.}.^...o3}.R.[...k.OG..l..R).\.Y.&.ZD.h. .P.4.\.|.......9~..]....`pM/.?{........VQ.7n_..}[...syf. ..H....NV.z..PM@........4dU........t...-...........neg....k.2.../N.i.......].y`..'..5h...H.9s..)>8.......1..>9...^<.*.O.aeO...Ul..b..F............]..>p.e#..c7...Q...@... G.}.....Z.k.!...UX.&.^.3~a..^.....\BL.......<L_W.Pv..eth5.N...y..5.H..i..'..3....B.C$E{........$..m.f..G_`..M..U.........6.E^!,..@[.....L.:b..lZ........Q.)......c.<......{._Qib%B...n....23.l-...eu......i4o$.....Z.8ud..Tb.'...o..o.]....et.0.~........C........N.m.
<<< skipped >>>
GET /icon/875m/animated-inverse-cursor.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3635
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:39:03 GMT
.PNG........IHDR...0...0.....W.......IDATh...kl\ez.........xb;q. ..VKA.PV*..H....RQ.J...ii..>..*E..vWb.~.Z.R.@D.....Y`!.J..$&...xm.v._...s.......9.[.i.U..h........y.PJ).T. ...P...u.(..T4(./.......!.R..Q..z..S..jPj.Mk:.*.PJ5h..X..._>....6.)..PpE..YC.PeV..o.....- ..Z...5..x.@........R.......\H)|...k..{^..s..q.....~..G.....n.k...q....................!.n........*.p]..]..u...1...I..8r..'O....0.L.../....244T...>G...j..*. .....U....3.G........85.).X^^..g..........<..#hZ....k..>.(....aX.w.m.q.=........k....{..........o..{z..S`....=.o..."........._gdd$n.%..r 9L...m..$J):;;.</2...<.M.H..h.F.T.@......k.....PJQ*..4.)%........y(.1;.#....#........"..0..R.G........155.......F.uD.PP........qH.R...........,.....,.t&..].H.R...`Y.W....:.......].9}.4mmm....H$hkk..<...8w..---..EL.$.H.J........h......6m.....O?.....<...V\.e....0.......... ......v....Z..F............m..,.!.]D4.M.ih..p. ..R^u...T.zeV ...5..q8u..o..6.....p.8.......\..hX`ii.......'N..[o5. fgg9p.@..RJ^}.UVWW...A....q.Zt..2....r..e.o.....%..<...~.ggj.0.....9|.p...|.....4................h.#..X,r..a......Q..R..../...={..y3[.lY7.T....s.......37...5....R,....o.t#T.a.A@..X..0vjj.7..).&...."..A.J%........a``.T*....A.S,..........,..X,F...@......a..8..a.13...p]...H$..aH*....m...V..$.....P(.i.A.......i.W.\aff.D"AP..../.{.n&''...r.<n ......v..?.eY.!p.....J...w.....mr..}}}...088...gI.R,//#.$...L&..m......N>.'.J........J.......5.@=.TSu.SIH....E..0.e.{5.pV?.....s..a...DT.U...aU...qa...h.x.f.K..5p...H..m..}.....0==.......L&....O..O..]\...6..!D...G..3'
<<< skipped >>>
GET /icon/752m/pdf-download.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 3738
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:38:58 GMT
.PNG........IHDR...0...0.....W......aIDATh.....%.].?..z...e.g.,=.Z.!y.!.2.....oDp..........p......`N>.D.........d)..G.f...=....2..!...{...dD.{U......._.xUE.b.*"R.....XS.....YEA...G....J.Q.....R.......?......8D."b...G....{..~.....}I..$.....1..T1w..U.}.......$I.L&.c... HN.A"@...?$b....T.Xd.$...2,G=.(... ]U..j..t.E.....~h.jd..G../..jp.......r/..e..d...Gr...Ge?^...f..........Kx/.".z.B*...R`_..H..d<..7@.X.f..0.L........;P.8............p.D..GbFs.=..b.n.......f...K..!.E4....Adj...;"k...Z\...s.|..2.M..9Y.2.....;...?......Cp..*........>g:.\~...n..=n0.^.c.b.......5$...].{w.t....,^.N=..S...D.)w.s..ts.,.-<..Gl.k..........5.......k .*........_e.;@GS...g...Y;{........;.. .....0....x.J$...ab....[..*....).=y`.E.$5.{)......x.FWu..<...F@.S.......A/......._I_...K...D....v1x.EUs..A.*i..v.u.B...eJ...S.7wpm.rWj$....f..Hyu...J.QUb.....;4K...>...'...c<.V...[....q.3.P.&....R......5..9...T.Z.......E..1....L2.1..z.)..X..'3.w....5.#S2.#yv..'s.w~.....;.......o1.z......]&.....S....\.>g..8...F..Z....3...]..y........N.......v..Ly...o..g=.D.......1..~..>v2....G..F..n^.N..&."...!..Y.....|.ps.........;VUP.[..>...H..m.-.tE........Y./.'|s.C=....{.. ...V.../.hu.F... .. .oS4Mq..... K....M.......S.<..3.drt.\.&....s.N.a.PW...*..3N...g......[@.....*[..C.N...]~....,c....*...t6E.....[.;...*5..E.8B..Q...Y.....(*.6D....6<.a..q..V.....E...1X.C..*..aP7|.7..'...kmo1....?..;._...].......(P..$@... ..T.QV.k..".....c. ..*.9.Z@..W...N .c..F.w.....!...[.f....|}..F...;..oBA"....I...l..PJ....Vm...^...tc.S.7..N...a.``.o.X.e0r.......
<<< skipped >>>
GET /icon/1412m/stanza-desktop.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 4103
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Cache-Control: max-age=2592000
Pragma: public
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Last-Modified: Tue, 03 Jul 2012 15:38:31 GMT
.PNG........IHDR...0...0.....W.......IDATh....o\.u.?wyovr..H...J$%k.#...;Zl...8Q..i.&6.K....h....@.? iQ$..(.4I.....v\[.M J%Q....eI..........f.3..7......}..{.9.{.Ka...B....47!D..F.....lD..X'.-...r.7..?[.x...}......>..g..h.y7;-.!..s.{.......K...x......;..|.....c.;.......u.h.h....v......>-Y..W....Xk. .w.v..i....UFl...E...c,.(..(..... .J.8.RH.....H!At...........t.M!.B..I....-.'...X.1..P).....G..LLL..\..twu...>.....H).B`........i.L.m..N...\...3..J.T.h.g.FI...........L_..w....m[.T*....a..._.......NmW....;.vg.*g...y!.I..Xk..a.a......k..Z>........i|...Y.z..F......={PH.....!O?..2.T...........b.R(,.)5.-aE#..-..1P..F..td .C^{.w.?y./?.$.d.|.....869...W.Z;....@h8{...=.m...A.b.!.MM..A.cBCWW.X,...%]@.._.z(![.A...n......7....H.H.S..]=9v......9~....y....?...F ../~.SO=E,.'.}. @J..W.B...........o.'...B..qZI.....2>..W.x..7...?@..T.e..g?e..i...l...)l.sz..o......d.........`.RJ....|....2.X..4~V..........n..`..X..!....#.*.A./(......x..../..rb...?....L.../.....7........................EJI>.D.RAJI6....-..]d.rPCC!D$...O.o......1...\.a...}..Q.b...<*U..7..5.;...._.H...}......`..&...............b..-.u..o...V...\....;H.S$2i6.......z.GF>E.&c.y.!..p.U.....r.......;.._.X*.U ..Oh.q....x...\.r.m........0..p...(..v....=...u...=$...?y.R..G........................5.T............x~.......78.w?......p...CbP.e~.._....t...>...?....z.5s....B?...i...A... E.....s...<..or..EN...W._......~.q._.....1.......l.....{..E../oEM....[3.........(.........|.!AY.... /s...v...g.}...>........r=Y.6..Jd.X.1...c.X ...g....[..............>
<<< skipped >>>
GET /images/footergrad.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 192
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-c0"
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR.......x......Z......IDAT..e.A..!.CK.:.?.....L.....i...[k...[...~.p.}..n.....mI....T.X..2l..G..D...c).,0D.ek..qp.<N......r.`....O...E..r.J~.W...........3.....ll.F.e....IEND.B`.....
GET /flags/flags.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: image/png
Content-Length: 8050
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
Connection: keep-alive
ETag: "5592ae97-1f72"
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Cache-Control: max-age=2592000
Accept-Ranges: bytes
.PNG........IHDR...`...7.......Ow....bKGD..............pHYs.................tIME....../........IDATx...y.T...?.v..3.....0"...WL.....&......$n...&.E....5.7&.$n?5.Q0... ...$Q.E@.}.g.om..G..ef@.y........t..{..S...S....).Er.x.p(.....q.....r...C.Ge..?......cZ.PJ.i.......".s.Sm.ED.jk-.............'..I.B...L..k...>.9.O... .....8Gv[..l..C...".N...`%......$..../..... .@.....:.~...b...1............K.....~E..E. ......Db.MF.k.......z.u...{..C.Uc-. ,-..P.1.........3..rT.5..U........ ...t*.V..v...h...x..^......".u........AX..16..3...VD...L...C.....X....=.C.._..~C...d-b5._..EkD .(Dk..N..V6.u'..~ .;...b.k.T.e..A....*..).?.....8..../...[........(.p...0.i-;.k@;..z'^...."..\...."..;...W.@.3.g8x.V..h....Y....0<....y$w....s...h.AA.s..:&)..XDt..}Q.h\hGT..l........XZgYl^..Y.(.j.(.....)]P....#...56a.[....F.oQ.... .....PY....K.....81...F.M.`..w.....l..-..2bX..h..9...%....i........ ......7W...<l.....5u.WdT..........{.^.J..6Z..k@..c........9....E)...k.c...Uw...7,.:..s..*.....(]...^.).[.8..=.TN,.@.....3...kD.....'..U.sX.cG.W~_......./....s{.x .....Z:....K._../NCl.4..w....||.K..5-....V.....mgL!.p.a.`.Pm..}.......[.X...k.{.%..........`.3@.......B.M...Ct...........(....^f..I..Dx..,..%.Z.bA.......=........iL.i.3...K..:M.7.X....-Za......SE.K..i..!c.......u|}...^......._.L....alL.mW.;.....e..J..D.. ?=..Z..w.*..........1G.O...m.........uU...s...v.e<......h..zW.&...^$.....K..)i.k'....' qSJ\.1.A.......0..qX..o.0....[0.(.0s....B.`..p.{.. .......4...Q. FA...j.fn/P`....jnz&...Vf...D....z.17e.....c......z.V.-..`...C.Sx.hp..5Do...;.._w.....
<<< skipped >>>
GET /min/?g=js&4 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: wnpcdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 25 Sep 2015 03:34:04 GMT
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 6049
Connection: keep-alive
X-Powered-By: PHP/5.6.12
Expires: Sun, 25 Oct 2015 03:34:04 GMT
Vary: Accept-Encoding
Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT
ETag: "pub1435676311;gz"
Cache-Control: max-age=2592000
Content-Encoding: gzip
...........<ks.F... (9.."...K..i.e..[..v..m....@`H...........=......]]U..3===......cE......d6O._.LWYT%y..U.EiX....u7wa. .....].~....K.s2KN.QA.U...yR.4.....n.sp...<.hV...O.....d"...~zX. ....m.W...5..0]Qw.s....0..&.....`.=9Q ...Sk.a......t........8.'.M.7Bf..l..U...$K..|....A..c.aEgy.0.....j..p}.8..$.r...%....'..L...8..YI.....^.h.2O..f....\.`.%.i..........:,.M.Y.~.GI..'...3.-..C...p...b.v..f.IE.4.cG..fp...\* 8..8..............R\....q.6...3m...R6..y..< ..s}>.)_.....a^v...>.<. }......Vv.........4..F..j!.[.3Z.D...L'.=l.>^...f....Cx..B..V..ji.........m..w2....v.y6....=..h.m..~...`X9......F.x...g.MA..q...eo.......sR..>.b-.f4..l...&...x...b...@:.8.B.....?.........[./........Y#.......yA......C.k.............:.z..........5x1.W....VH{. ..\].\...L......6.......#...@....^...VU....F|.>....J......i.p9......g...xb..2...a8....M..F...' .p........u........sy..O}.'Q.O....L..rYe?....eRe}T2...8..Pd..Fq..%}...W.H .|9..B........2/bZ\'.........0t..4...`.U.\....!8.q:$9..B.>..,.x..^.'..L...(.........Q.w.........=Fx...|..5...........F...UX..../...#....'...e....]:]L`..`4..^IS....A.....L&....2.Q..f.. ..<.d............4X..`.u....B...r.*..f...8.z..UU$.:@.....^.|.T). W..i^8(...z.A.(9;;............BwG.y.R....6..B"t.<.".<...3P$.c|.De...zLS.l.@e..1..p.D.H^..]/....,...?<y...f^...)...e..v....a`..,f6....e.........;..{,..<k...B......D. .c @...l* .,...*.(8!g.:..rF....?.Y.$.d/.m.........e....G..u..F......... .^.^.q..F...........a.......pG......CP...c0B...\.....y'a.eV..,..."..4.\...y.sx.$..C..p........[(h.aL.
<<< skipped >>>
GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Date: Thu, 24 Sep 2015 21:50:20 GMT
Expires: Fri, 23 Sep 2016 21:50:20 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 32819
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 20623
............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V........V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g..Q...S_..Y.....G)..T.".......<......&...*..Z.t%..s@it5..y.c.....p.h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;.....3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE..,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q....v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_........j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*........H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v....n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f..........&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3......i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&
<<< skipped >>>
GET /ui/11d/en HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: public, s-maxage=900
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 25 Sep 2015 03:33:58 GMT
Server: nginx
Content-Length: 1558
Connection: keep-alive
...........Wmo.6..._..[.....n.%...I..}.Z..0..%Q...TI..W....f.v..h.4....=..Q.;g........../......S..4}.`..g.3.0....L...aR......d\..._JJ..Xd...m.!.6.M...-3<..Pa......~.aC?...8EEM..&.L..c..%.44.J.....B2Q..."! ..\.d....i2.MK..y...yv.t..zq...3.p:.].....(S.S.7.L\.Z.*..NI...&...O.....G...#Ey..Ys.kJ.F.... .QCKF2L8w...rV..R.G..2...Z..*...8S....P...dI.,.....8....>aC..`.|.6$......?...@.r5_Q^H..!v.R<g...J.C6)N.t.Z.VL.R... ....k.>...xS.g.t.Nj.l2.e.F..0.......H....dT..$.|.&.....y1|Ds.tN.......!F...&.B...-.*.;...J..U..w. ....RS8IA.W...s.....wE,..J..h.......k........c$P.E.Y..1(...h..Z..h.JSg......Em.st....6.D*.lY......,....Ha.....A.................mF.}).LpIJ<9.O.......>w.yj}.$o.v<..Z.-......p.z..q...M .....}C...>.Z0J...yas.Z.^.>&...:.Nf5E./..25..b.e.Wu..k.Yx.f0N!"....o..A..Q&.KA.df.......A.jX.L.<b.......JSuOC..l.H......'..k. .L..; .d.;>.....E.............j..|Ia..q]...c..ax.H.!.YR}.aD..'.(j.!...((..:z.T...D.G.........)...;QR.X9-.:.R.....u.;([%....".j...."*.D."M*..0<.......D.@.......,.A.@....,!|...Od..fU.Q5H.....W._=!. )!e!a.j d........"Xq....f^A...3..9.....Cd.(0.c.C5........h...#...[MsY.;h......s.q\....Z.@.8%...7k.TlI.5...nm..nb.....O...?...T"...t.St..u.Mlg......)....6.:(.......BO.Q.g..pY... .....'.....;2."'.X..........!8.-.t.kjwo....b.........f../.%....[j...._.. l.W..Uu<.R.^}..v.JH..1.......3...x'I......,T].2.dK.....{.....b...@q.D..Y.q.."...Y....Vs,..|w.]...D...E..&.rc..}2*~.CI.E.....f....YAh^t.f....s....7r..pG....m2......6......S...:...6.].~e3T.&:...i<..z...^!.....^....<u..7.....
<<< skipped >>>
GET /s/app.min.css?2015041501 HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: text/css
Date: Fri, 25 Sep 2015 03:33:58 GMT
ETag: "5603ac7a-2aa3"
Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT
Server: nginx
Content-Length: 10915
Connection: keep-alive
body,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{padding:0;margin:0}table{border-collapse:collapse;border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn,em,strong,th,var{font-weight:normal;font-style:normal}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-weight:normal;font-size:100%}q:before,q:after{content:''}abbr,acronym{border:0}.cf:before,.cf:after{content:"";display:table}.cf:after{clear:both}.cf{zoom:1}body{background:#eee;color:#333;font:normal 12px/20px Arial,Helvetica,sans-serif}a{color:#11c}a:visited{color:#11c}#app{width:730px;height:430px;margin:0 auto;text-align:center;background:#eee}div.data{height:375px;position:relative;margin:10px 0}#sidebar{text-align:left;width:160px;height:375px;z-index:100;position:absolute;left:2px;top:0;overflow:hidden}#sidebar .logo{width:140px;height:40px;padding-top:5px;text-align:center;vertical-align:middle;margin:0 10px;margin-bottom:10px}#abw{background:#ddd;margin:0 12px 10px 12px;padding:10px 10px 7px 10px;text-align:center;border-radius:7px}#abw div.icon{background:#fff;padding:10px 0 5px;margin-bottom:5px;border-radius:7px}#abw p,#abw a{font-weight:bold;color:#777;line-height:15px;overflow:hidden}#abw img{width:64px;height:64px}#topics{margin:0 0 0 5px}#topics ol{list-style-type:decimal;list-style-position:inside}#topics li.active{background:url(iconos.png) -253px -325px no-repeat;border-right:1px solid #f2f8ff;color:#333;font:bold 12px/34px Arial,Helvetica,sans-serif}#topics li
<<< skipped >>>
GET /s/ender.min.js HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Content-Type: application/javascript
Date: Fri, 25 Sep 2015 03:33:58 GMT
ETag: "5603ac7a-7a40"
Expires: Sun, 25 Oct 2015 03:33:58 GMT
Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT
Server: nginx
Content-Length: 31296
Connection: keep-alive
/*!. * =============================================================. * Ender: open module JavaScript framework (hXXps://ender.no.de). * Build: ender build jeesh scriptjs morpheus. * =============================================================. */.../*!. * Ender-JS: open module JavaScript framework (client-lib). * copyright Dustin Diaz & Jacob Thornton 2011 (@ded @fat). * hXXps://ender.no.de. * License MIT. */.!function(a){function c(a){var c=b[a]||window[a];if(!c)throw new Error("Requested module '" a "' has not been defined.");return c}function d(a,c){return b[a]=c}function e(a,b){for(var c in b)c!="noConflict"&&c!="_VERSION"&&(a[c]=b[c]);return a}function f(a,b,c){return g._select&&(typeof a=="string"||a.nodeName||a.length&&"item"in a||a==window)?(c=g._select(a,b),c.selector=a):c=isFinite(a.length)?a:[a],e(c,f)}function g(a,b){return f(a,b)}a.global=a;var b={};a.provide=d,a.require=c,e(g,{_VERSION:"0.2.5",ender:function(a,b){e(b?f:g,a)},fn:a.$&&a.$.fn||{}}),e(f,{forEach:function(a,b,c){for(c=0,l=this.length;c<l; c)c in this&&a.call(b||this[c],this[c],c,this);return this},$:g});var h=a.$;g.noConflict=function(){return a.$=h,this},typeof module!="undefined"&&module.exports&&(module.exports=g),a.ender=a.$=a.ender||g}(this),!function(){var a={exports:{}},b=a.exports;./*!. * $script.js Async loader & dependency manager. * hXXps://github.com/ded/script.js. * (c) Dustin Diaz, Jacob Thornton 2011. * License: MIT. */.!function(b,c){typeof define=="function"?define(c):typeof a!="undefined
<<< skipped >>>
GET /s/box.jpg HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Content-Type: image/jpeg
Date: Fri, 25 Sep 2015 03:33:59 GMT
ETag: "5603ac7a-1cef"
Expires: Sun, 25 Oct 2015 03:33:59 GMT
Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT
Server: nginx
Content-Length: 7407
Connection: keep-alive
......JFIF.............C..............................................!........."$".$.......C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....*.. .j....<...Eg.......u^......:..FG.U ..6.h..e..?:C".xUm.l......R....U..6P..z..i...4..l.....)....I.............{...F..a.S.f......Rm.e.69..RG.Z.Eq._J....9..j.......w.Z.Z.......&..Wk..A...98.x.:1.:V......&._OZ..A ...t4..m.mg.W.,%f..x..V...~....6..in.)..C..P .v.....?...4.........h.*.f=I.....t.....4....U...d....)...MW...9.vO..go............_.......e.A.... .k....\..B...jT%Q.cV.i.M}g....(......s...e..[.{Vy...JxhAZ..S.Rn...M.f&...A.^)..c.1....d.|...o...D.`. ...,K.....#O...v5...7>...".V..........8.......3Eo.?yX~.".@....eQS......F.u..4...,./.v.CI. ..4VR.N.....V.A..O..^.....U5.O.B>."........c.E.).4m....I.8....:.iY..q.._W..R..M......g.,...%Gy;...1fb.I'.=.....fp.................PE....4gc......k.......%.......|P......GE.. 0v7........y......VQ..iZVGS..e.Y....Eoo..o|(...*..G.6...t...m....h...u...^..b..@.w...G._.y.r........pKf[.........e...,L.}..m<.Ud.....S.h=(....by...5.....z....b...PY..I...k..W9.wc
<<< skipped >>>
GET /s/app.min.js?2015041501 HTTP/1.1
Accept: */*
Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/javascript
Date: Fri, 25 Sep 2015 03:33:59 GMT
ETag: "5603ac7a-a450"
Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT
Server: nginx
Content-Length: 42064
Connection: keep-alive
var _gaq=_gaq||[];var _ev=_ev||[];var ERROR=1;var WARN=2;var INFO=3;var DEBUG=4;function InvokeScript(b,d){App.InvokeScript(b,d)}var Helper={capitalize:function(b){return b.charAt(0).toUpperCase() b.substring(1)}};var App={step:1,steps:[],topics:{},topic:"welcome",topic_map:[],queue:{},shown:{},is_cpa_installed:false,installer_id:null,level:ERROR,appToShow:"",idAppToShow:"",idLastAppShown:"",weigthingmethod:1,init:function(){Logger.setLevel(this.level);if("undefined"!==typeof dmr.replace_target_by_filename&&dmr.replace_target_by_filename==1){var b=$("#app");var f=D.getFileName();if(b.length&&"undefined"!=f){var d=new RegExp(dmr.target.name,"g");b.html(b.html().replace(d,f));D.setWindowTitle(f)}}App.installer_id=$("body").attr("id").replace("i","");App.steps=$("#steps>div");if(3==App.steps.length){$("#topics li.campaigns").remove();$("#nav button.skipall").remove();$("#nav2 button.skipall").remove();$("#nav3 button.skipall").remove();$("#nav button.skip").remove()}cn=$("div.ccx").length;App.topic_map=[1,2,2 cn,2 cn 1];App.topics=$("#topics li");$("#nav button.continue").bind("click",this.processNext);$("#nav button.previous").bind("click",this.processPrevious);$("#nav button.cancel").bind("click",this.processClose);$("#nav button.close").bind("click",this.processClose);$("#nav button.accept").bind("click",this.processAccept);$("#nav button.decline").bind("click",this.processDecline);$("#nav button.decline_custom").bind("click",this.processDecline);$("#nav button.decline_custom_big").bind("click",this.processD
<<< skipped >>>
GET /installer/4d48823a-b8b4-4f4d-b72e-794a5bc06ebe/1345/config HTTP/1.1
User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)
Accept-Language: en-US
Host: northstar.393532df4f28.api.socdn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, private
Content-Type: application/json
Date: Fri, 25 Sep 2015 03:33:57 GMT
Server: nginx
Content-Length: 3832
Connection: keep-alive
{"Target":{"name":"Google Earth","url":"hXXp://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe","icon":"hXXp://VVV.winportal.com/images/files/icons/810-64x64.jpg","uuid":"4d48823a-b8b4-4f4d-b72e-794a5bc06ebe","checksum":null,"fileName":"","types":[],"args":null},"SuggestedApps":[],"Config":{"id":1345,"maxsuggestedapps":4,"strings":{"setupWillClose":"The setup will close. Do you want to exit the application?","stillDownloads-close":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Close?","stillDownloads":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Continue?","stillDownloadsUninstaller-close":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Close anyway?","stillDownloadsUninstaller":"By cancelling now, your downloads/installations will be incomplete and some of the selected program(s) will not be downloaded/installed. Continue with the downloads?","downloadError":"The file was not downloaded successfully. It is recommended that you close the aplicaci\u00f3ny to retry the download.<br>Attempt to execute all forms?","connectionError":"The connection failed. If you do not have Internet access at this time, try to complete the installation later. If connections are available, it is possible that this product has expired.","noSauc
<<< skipped >>>
GET //www/delivery/afr.php?zoneid=31&cb=5515585 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.secondofferdelivery.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Type: text/html; charset=UTF-8
Date: Fri, 25 Sep 2015 03:34:03 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Server: nginx
Set-Cookie: OAGEO=UA||||||||||; path=/
Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:03 GMT; path=/
Content-Length: 1096
Connection: keep-alive
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>.<html xmlns='hXXp://VVV.w3.org/1999/xhtml' xml:lang='en' lang='en'>.<head>.<title>Advertisement</title>.<style type='text/css'>.body {margin:0; height:100%; background-color:transparent; width:100%; text-align:center;}.</style>.</head>.<body>.<a href='hXXp://VVV.secondofferdelivery.com//www/delivery/ck.php?oaparams=2__bannerid=97__zoneid=31__cb=b54e227aa9__oadest=http://lp.ilividnewtab.com/?sysid=533&appid=1079' target='_blank'><img src='hXXp://VVV.secondofferdelivery.com/www/images/de0ae333c183355452cb397cf09eeffb.png' width='728' height='90' alt='' title='' border='0' /></a><div id='beacon_b54e227aa9' style='position: absolute; left: 0px; top: 0px; visibility: hidden;'><img src='http://VVV.secondofferdelivery.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://VVV.winportal.com/google-earth/thanks&cb=b54e227aa9' width='0' height='0' alt='' style='width: 0px; height: 0px;' /></div>.</body>.</html>.....
<<< skipped >>>
GET /www/images/de0ae333c183355452cb397cf09eeffb.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.secondofferdelivery.com
Connection: Keep-Alive
Cookie: OAGEO=UA||||||||||; OAID=acfd61925510fa466d97ba8f6dfd29f2
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: image/png
Date: Fri, 25 Sep 2015 03:34:04 GMT
Last-Modified: Tue, 22 Sep 2015 08:00:46 GMT
Server: nginx
Content-Length: 22030
Connection: keep-alive
.PNG........IHDR.......Z......4!.....pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>
GET /pagead/conversion.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 9955484316556696860
Date: Fri, 25 Sep 2015 03:34:05 GMT
Expires: Fri, 25 Sep 2015 03:34:05 GMT
Cache-Control: private, max-age=86400
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 4389
X-XSS-Protection: 1; mode=block
...........Z{s..........&(......c*q..l.8.g....k$.@AH.$.$..o.H...}N.[..5.==.~.z...B'..P.?.<nMY:..._g..q..]....u.."L..$.....I...m.......In.Skj$.I....X..X.G,.U..X..o.b`.3.uE88....E..xp..k_l./.#nl.=..?......K.S..qc.}o...I.Lv..^.k....V.....PK=...SA..L..3FS...t:..?..V.1-{./k.C...v..B.).....5... ..a..R.f.uY......]..]....(Y...C...l#..h-.V.H.....a.....Q..Y.....r:......l.......%...k....j.........<.p..|...L...............aw.&p.. .W......... .......S.Y.mdDZdR.......f...3..X...|.Ho.o.I.e..Q.].c...M.1.."N.....:......:..V_.#w.n.sw../i....&h/.....%G..A#3...;B..5.'.{..tw..O..N......R....ss./..9.gS.Z| ..;..!_.S.F..6.=3.W...JD.r....W......X.9l.~...ty.=7.lk....o<...>q...H......P.6.!......y{.=..F.r......7..G....e.4..6"....h)....|n... ...Y>.K..............x$.. .....6.kL.I.jc..h....A...)W..r..Fcwl.lM.R..mm8.E..5..Z.Gu.A.Y..Oa..SP?.RQ......j...Z.m) .$.h.#W.2......A.w:S.]1O.<.(,'.k.' m...B..N....i.:../..... ....a.5`...9..2._.$p.Q....9:.|..4.4..a?..o.......O..c.........R#YBn...q...:G..<...~..F .i:.......[}..N.;....f.2g...`R......}.....F...}.G:~....La..O0-7.jSv.gg;.W..J.7.W.eF.jt4-.]:.O..w:.^.m*..e..L.T...r..BBB.n....6..r..>.t...^ESJ [G".of~ ..M.xb.......V.U....N.r....i.....2Z,yJ.{k8..-wXL.W......,..w....;k.. s.g.wH}...;..9.................0...e..<I.y...1.6.M,........x*W...`......4.0*.#{2......>Q...q...1.An.0)...`A2..Y.....1.,..q......"pN..zf..S......B8r..2.Z:.,j.6.t.p.h.eJ..<.4/p..L0....PlZ.....H..."?......@.(...`..].....\.@.-..<7.......1.E,....."...!../.R ........'/..o5..vs..2...H?K...`%.-...0...gg.?
<<< skipped >>>
GET /css?family=Asap HTTP/1.1
Accept: */*
Referer: hXXp://VVV.winportal.com/google-earth/thanks
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: fonts.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/css
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Expires: Fri, 25 Sep 2015 03:34:03 GMT
Date: Fri, 25 Sep 2015 03:34:03 GMT
Cache-Control: private, max-age=86400
Content-Length: 155
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..Expires: Fri, 25 Sep 2015 03:34:03 GMT..Date: Fri, 25 Sep 2015 03:34:03 GMT..Cache-Control: private, max-age=86400..Content-Length: 155..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..@font-face {. font-family: 'Asap';. font-style: normal;. font-weight: 400;. src: url(hXXp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot);.}...
GET /earth/client/advanced/current/GoogleEarthWin.exe HTTP/1.1
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)
Host: dl.google.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Length: 36182856
Content-Type: application/x-msdos-program
Etag: "55021"
Last-Modified: Thu, 21 May 2015 22:00:00 GMT
Server: downloads
Vary: *
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Date: Fri, 25 Sep 2015 03:34:00 GMT
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.................@......_]......_i.......P.............._h. ...._Y......_^.....Rich............PE..L....(]U.........."...........&......a....... ....@..........................`(......s(...@..................................S............&...........(.H.....'. ...."...............................H..@............ ..T............................text............................... ..`.rdata...@... ...B..................@..@.data....3...p.......J..............@....rsrc.....&.......&..`..............@..@.reloc........'......h'.............@..B................................................................................................................................................................................................................................................................................................................................................................U..QV.M..V....M..B....M....G.....^.....A...u..@#A...8.A.VW3...;.t.V..Y.....P.WWWWW.ER.._^3.PPPPP.7R....D$..V....4#A.t.V..P..Y..^....|$..v..L$..D$.f..f;.u........L$.u.3.....f;......@..D$...P.t$..t$..6R.......D$...P.t$..t$...U......3..|$.....j....j.j.H........P..H A...D$..A..D$. .j....Q...D$..A...A...X A.P..T A.3.@...V...>.u..B.......t..t$....t$......^...........D$..V....h#A.t.V..O..Y..^...V.t$...t .Q....r.......;.r....r........I...H;.v.....2.^...U..QQ.M.3...t)......w....P.[X..Y..u..e...M..E.X#A..;........
<<< skipped >>>
GET //www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://VVV.winportal.com/google-earth/thanks&cb=b54e227aa9 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.secondofferdelivery.com
Connection: Keep-Alive
Cookie: OAGEO=UA||||||||||; OAID=acfd61925510fa466d97ba8f6dfd29f2
HTTP/1.1 200 OK
Cache-Control: private, max-age=0, no-cache
Content-Type: image/gif
Date: Fri, 25 Sep 2015 03:34:04 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Server: nginx
Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:04 GMT; path=/
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Control: private, max-age=0, no-cache..Content-Type: image/gif..Date: Fri, 25 Sep 2015 03:34:04 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..P3P: CP="CUR ADM OUR NOR STA NID"..Pragma: no-cache..Server: nginx..Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:04 GMT; path=/..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_1736:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe "c:\%original file name%.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe "c:\%original file name%.exe"
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp
dlmgn.exe.config
dlmgn.exe.config
&hXXps://VVV.globalsign.com/repository/03
&hXXps://VVV.globalsign.com/repository/03
"hXXp://crl.globalsign.net/root.crl0
"hXXp://crl.globalsign.net/root.crl0
&hXXps://VVV.globalsign.com/repository/0
&hXXps://VVV.globalsign.com/repository/0
-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0
-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0
4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt04
4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt04
(hXXp://ocsp2.globalsign.com/gscodesigng20
(hXXp://ocsp2.globalsign.com/gscodesigng20
!Certification Authority of WoSign0
!Certification Authority of WoSign0
hXXp://crls1.wosign.com/ca1.crl0g
hXXp://crls1.wosign.com/ca1.crl0g
hXXp://ocsp1.wosign.com/ca10.
hXXp://ocsp1.wosign.com/ca10.
"hXXp://aia1.wosign.com/ca1-tsa.cer0
"hXXp://aia1.wosign.com/ca1-tsa.cer0
!Certification Authority of WoSign
!Certification Authority of WoSign
$000214F9-0000-0000-C000-000000000046
$000214F9-0000-0000-C000-000000000046
$0000010c-0000-0000-c000-000000000046
$0000010c-0000-0000-c000-000000000046
$0000010b-0000-0000-C000-000000000046
$0000010b-0000-0000-C000-000000000046
3System.Resources.Tools.StronglyTypedResourceBuilder
3System.Resources.Tools.StronglyTypedResourceBuilder
4.0.0.0
4.0.0.0
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator
10.0.0.0
10.0.0.0
$07D66D3B-4491-43B6-81C0-88141A95FB9F
$07D66D3B-4491-43B6-81C0-88141A95FB9F
3.1.50
3.1.50
_CorExeMain
_CorExeMain
mscoree.dll
mscoree.dll
&?4?)?3?'
&?4?)?3?'
nst2.tmp
nst2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe
c:\%original file name%.exe
c:\%original file name%.exe
%original file name%.exe
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
Nullsoft Install System v2.46
Nullsoft Install System v2.46
imgr.exe
imgr.exe
3.1.50.0
3.1.50.0
"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2#
"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2#
PublicKeyToken=
PublicKeyToken=
publickeytoken=
publickeytoken=
dynamic method does not support fault clause
dynamic method does not support fault clause
unexpected OperandType
unexpected OperandType
dlmgn.exe_892_rwx_003C0000_0001C000:
S.HW#r'
S.HW#r'
dlmgn.exe_892_rwx_03710000_0000A000:
$.wv^
$.wv^
iexplore.exe_2116:
%?9-*09,*19}*09
%?9-*09,*19}*09
.text
.text
`.data
`.data
.rsrc
.rsrc
msvcrt.dll
msvcrt.dll
KERNEL32.dll
KERNEL32.dll
NTDLL.DLL
NTDLL.DLL
USER32.dll
USER32.dll
SHLWAPI.dll
SHLWAPI.dll
SHDOCVW.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
IE-X-X
rsabase.dll
rsabase.dll
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
dw15 -x -s %u
watson.microsoft.com
watson.microsoft.com
IEWatsonURL
IEWatsonURL
%s -h %u
%s -h %u
iedw.exe
iedw.exe
Iexplore.XPExceptionFilter
Iexplore.XPExceptionFilter
jscript.DLL
jscript.DLL
mshtml.dll
mshtml.dll
mlang.dll
mlang.dll
urlmon.dll
urlmon.dll
wininet.dll
wininet.dll
shdocvw.DLL
shdocvw.DLL
browseui.DLL
browseui.DLL
comctl32.DLL
comctl32.DLL
IEXPLORE.EXE
IEXPLORE.EXE
iexplore.pdb
iexplore.pdb
ADVAPI32.dll
ADVAPI32.dll
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
IExplorer.EXE
IExplorer.EXE
IIIIIB(II<.fg>
IIIIIB(II<.fg>
7?_____ZZSSH%
7?_____ZZSSH%
)z.UUUUUUUU
)z.UUUUUUUU
,....Qym
,....Qym
````2```
````2```
{.QLQIIIKGKGKGKGKGKG
{.QLQIIIKGKGKGKGKGKG
;33;33;0
;33;33;0
8888880
8888880
8887080
8887080
browseui.dll
browseui.dll
shdocvw.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
6.00.2900.5512 (xpsp.080413-2105)
Windows
Windows
Operating System
Operating System
6.00.2900.5512
6.00.2900.5512
dlmgn.exe_892_rwx_675A6000_00003000:
.Qg
.Qg
*Rg`.Rg|)RgL Rg
*Rg`.Rg|)RgL Rg
dlmgn.exe_892_rwx_6D739000_00001000:
/hmh.hm
/hmh.hm
.hmh/hm0.hmH/hm
.hmh/hm0.hmH/hm