MD5: 8af788142e8ca647cae800f18e5ed6b7
SHA1: 4ffc32830e33def0eec2885f75be284dfc79691b
SHA256: 24d046a32e1d8fc27932883f4dd12df3f60f98c4ff082f7be8567b303b6a1b7e
SSDeep: 12288:uQaOJtxzAcU/oBjT1rEh1ETMZinJaxR9 yRMshvXdYr1pk712 5rDpw13lHXPk:uQxJAcKoBfxEhDZinXyRMshvXd fxDpb
Size: 731648 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: www.GameModding.net
Created at: 2013-10-14 08:50:27
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan-Dropper. Trojan program, intended for stealth installation of other malware into user's system.

Payload

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1908
157.exe:2504
.exe:2996

The Trojan injects its code into the following process(es):

CARDGE~1.EXE:2700
iexplore.exe:1204

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:1908 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\157.exe (2931 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\CARDGE~1.EXE (12346 bytes)

The process 157.exe:2504 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (1 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new (812 bytes)
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new (812 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\LoMkjwQ.exe (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\.exe (44 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\aEEEEE.xml (0 bytes)

The process .exe:2996 makes changes in the file system.
The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\x.html (0 bytes)

The process CARDGE~1.EXE:2700 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_important[1].css (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (100 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\3MEWP6U2.txt (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400i[1].eot (12626 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\vbulletin_menu[1].js (6412 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (1528 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\gradient_tcat[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\Big_banner[1].gif (108402 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\pid[1] (46 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\leaksbannerov[1].gif (483124 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\cf.errors.ie[1].css (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (3400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\close[1].gif (428 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\51[1].gif (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\larme[1].jpg (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\w3ccss[1].gif (177 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (942 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300[1].eot (5777 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\username[1].png (728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\HJEFLFIX.txt (97 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\nav_final[1].gif (652 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_md5[1].js (213 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\cron[1].htm (3879 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\error_icons[1].png (6369 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (3318 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (78 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (280 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\nav_bg_small[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\gdtmvRl[1].gif (9913 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\cf.errors[1].css (7706 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\opensans-400[1].eot (9416 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\qoEf3sh[1].png (5656 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-700[1].eot (4353 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (3346 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\sa1[1].jpg (5276 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head4[1].gif (67 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (10712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head2[1].gif (2812 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001 (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (50 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\navbits_start[1].gif (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\bg_tile[1].gif (427 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\L3Zd0Sx[1].gif (10186 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\gradient_thead[1].gif (846 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\cf.common[1].js (1161 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC3EBA4E46329F29E449DFA191208FBF_BD64D75B80DFC94E25718464FE4C47FB (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (2730 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\w3cxhtml[1].gif (175 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6AF4EE75E3A4ABA658C0087EB9A0BB5B_4D2C7EAA8150F217DD0A575079F26164 (278 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E4BE0042965AB3D0DE015F847D8AB90_03E448FF6BD55C02A6D9C1DD496E4276 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\W2NA5IUV.txt (117 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\vbulletin_global[1].js (11653 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\s[1].gif (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\GX1OvJc[1].gif (28385 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2 (2800 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\twitter[1].png (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BL247F2Y.txt (119 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\jquery.min[1].js (60249 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\opensans-600[1].eot (8385 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\altenen_com[1].htm (4519 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\head1[1].gif (1160 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\a[1].js (145 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\newofurmatn[1].gif (139152 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6AF4EE75E3A4ABA658C0087EB9A0BB5B_D004E5083B392DC7F7C7D16A878C03CA (1496 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\yahoo-dom-event[1].js (21224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\connection-min[1].js (7892 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\head3[1].gif (2338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211\index.dat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\opensans-300i[1].eot (15058 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F (624 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (758 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\P4VFDFXK.txt (246 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1F94CD5CA263ECFB1A4BAB1B832C909 (548 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25FDO7QC\navbits_finallink_ltr[1].gif (576 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\facebook[1].png (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8D93UTC3\password[1].png (620 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C1F94CD5CA263ECFB1A4BAB1B832C909 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F3TFJKIL.txt (279 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (50 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB753.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\F356ZK80.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C2.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarA0C4.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCD19.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016101020161017 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C3.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarCCB9.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DS15UWZG.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB742.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4ZZNMJGQ\altenen_com[1].htm (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\XPSP6NLJ.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCCB8.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabCD18.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012016102820161029 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabB741.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabA0C1.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarB754.tmp (0 bytes)

Registry activity

The process %original file name%.exe:1908 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"wextract_cleanup0" = "rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 C:\Users\"%CurrentUserName%"\AppData\Local\Temp\IXP000.TMP\"

The process 157.exe:2504 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process .exe:2996 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\XtremeRAT]
"Mutex" = "j0ahKrg"

The process CARDGE~1.EXE:2700 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"EnableConsoleTracing" = "0"
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"EnableFileTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "CARDGE~1.EXE"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CachePath" = "%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012017021020170211"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"fdwSupport" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"EnableFileTracing" = "0"

[HKCU\Software\Classes\Local Settings\MuiCache\30\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1481593403"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CachePrefix" = ":2017021020170211:"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012017021020170211]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\CARDGE~1_RASMANCS]
"ConsoleTracingMask" = "4294901760"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101020161017]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016102820161029]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Microsoft Corporation
Product Name: Internet Explorer
Product Version: 11.00.9600.16428
Legal Copyright: (c) Microsoft Corporation. All rights reserved.
Legal Trademarks:
Original Filename: WEXTRACT.EXE .MUI
Internal Name: Wextract
File Version: 11.00.9600.16428 (winblue_gdr.131013-1700)
File Description: Win32 Cabinet Self-Extractor
Comments:
Language: Chinese (Simplified, PRC)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www.altenen.com/	5.254.123.33
hxxp://www.altenen.com/banhammer/pid	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_important.css?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/yui/connection/connection-min.js?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_global.js?v=389	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_menu.js?v=389	5.254.123.33
hxxp://leakswith.pro/bannerov/leaksbannerov.gif	104.18.55.132
hxxp://www.altenen.com/images/bluefox/misc/close.gif	5.254.123.33
hxxp://www.altenen.com/clientscript/vbulletin_md5.js?v=389	5.254.123.33
hxxp://www.altenen.com/images/smilies/51.gif	5.254.123.33
hxxp://paysell.bz/Big_banner.gif	104.31.69.21
hxxp://www.altenen.com/images/head1.gif	5.254.123.33
hxxp://www.altenen.com/images/head2.gif	5.254.123.33
hxxp://www.altenen.com/images/head3.gif	5.254.123.33
hxxp://altenens.com/qoEf3sh.png
hxxp://www.altenen.com/images/bluefox/misc/navbits_start.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/navbits_finallink_ltr.gif	5.254.123.33
hxxp://www.altenen.com/images/misc/password.png	5.254.123.33
hxxp://www.altenen.com/jpg/newofurmatn.gif	5.254.123.33
hxxp://www.altenen.com/jpg/GX1OvJc.gif	5.254.123.33
hxxp://www.altenen.com/jpg/L3Zd0Sx.gif	5.254.123.33
hxxp://xslt.alexa.com/site_stats/js/t/a?url=altenen.com	54.192.129.104
hxxp://www.altenen.com/images/bluefox/misc/w3cxhtml.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/w3ccss.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/nav_final.gif	5.254.123.33
hxxp://www.altenen.com/images/misc/username.png	5.254.123.33
hxxp://www.altenen.com/images/head4.gif	5.254.123.33
hxxp://www.altenen.com/jpg/twitter.png	5.254.123.33
hxxp://www.altenen.com/jpg/facebook.png	5.254.123.33
hxxp://www.altenen.com/jpg/sa1.jpg	5.254.123.33
hxxp://www.altenen.com/cron.php?rand=1486741283	5.254.123.33
hxxp://www.altenen.com/jpg/gdtmvRl.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/bg_tile.gif	5.254.123.33
hxxp://www.altenen.com/anger1/head4.gif	5.254.123.33
hxxp://www.altenen.com/danger1/head4.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/nav_bg_small.gif	5.254.123.33
hxxp://www.altenen.com/jpg/larme.jpg	5.254.123.33
hxxp://www.altenen.com/images/bluefox/gradients/gradient_tcat.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/misc/nav.gif	5.254.123.33
hxxp://www.altenen.com/images/bluefox/gradients/gradient_thead.gif	5.254.123.33
hxxp://xsltcache.alexa.com/site_stats/gif/t/a/YWx0ZW5lbi5jb20=/s.gif	54.164.75.60
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4=
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0=
hxxp://a692.d.akamai.net/certs/ca.crt
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4=
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J
hxxp://altenens.com/register
hxxp://a36.d.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs=
hxxp://a36.d.akamai.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://altenens.com/cdn-cgi/styles/cf.errors.css
hxxp://altenens.com/cdn-cgi/styles/cf.errors.ie.css
hxxp://altenens.com/cdn-cgi/scripts/jquery.min.js
hxxp://altenens.com/cdn-cgi/scripts/cf.common.js
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-300.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-400.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-600.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-700.eot
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-400i.eot
hxxp://altenens.com/cdn-cgi/images/error_icons.png
hxxp://altenens.com/cdn-cgi/styles/fonts/opensans-300i.eot
hxxp://a767.dspw65.akamai.net/pki/crl/products/WinPCA.crl
hxxp://ocsp.comodoca4.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J	178.255.83.1
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-700.eot	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/scripts/jquery.min.js	104.27.141.154
hxxp://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg=	212.30.134.177
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-400.eot	104.27.141.154
hxxp://aia.startssl.com/certs/ca.crt	173.223.11.161
hxxp://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4=	178.255.83.1
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.46.123.27
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-600.eot	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/styles/cf.errors.css	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-400i.eot	104.27.141.154
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	80.231.122.161
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	216.58.214.206
hxxp://ocsp.startssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs=	212.30.134.177
hxxp://www.altenens.com/qoEf3sh.png	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/images/error_icons.png	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/styles/cf.errors.ie.css	104.27.141.154
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx	104.16.28.216
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-300i.eot	104.27.141.154
hxxp://www.altenens.com/register	104.27.141.154
hxxp://www.altenens.com/cdn-cgi/scripts/cf.common.js	104.27.141.154
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	212.30.134.166
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	216.58.214.206
hxxp://www.altenens.com/cdn-cgi/styles/fonts/opensans-300.eot	104.27.141.154
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0=	178.255.83.1
hxxp://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4=	178.255.83.1
donald-trump.party	104.24.102.24
s29.postimg.org	163.47.178.206
s11.postimg.org	163.47.178.206
redspider.cc	104.27.144.39
ah-antihacker.ddns.net	177.86.90.37
s24.postimg.org	163.47.178.204
sync.1dmp.io	136.243.44.222
s23.postimg.org	163.47.178.201
s28.postimg.org	163.47.178.204

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 10 Feb 2017 15:42:06 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:36 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: CD4E411028F5966AE35940E7A80D2D957332E76F

Cache-Control: max-age=333546,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 312

Connection: close

Content-Type: application/ocsp-response
0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..2017020
7123043Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y.
.[%.i..&Uf.9...T.....20170207123043Z....20170214123043Z0...*.H.=....g.
0d.0...`..,3l.s.zT.M...h..&.F........C^..jdu..e..\.G.0H.dD$nk..Z.E.!.b
.!.O.2.Y.<......]8M.c.{r.d..-.....

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=df3f71f4af9a46c9174e52993b6138dcb1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6ad28b59b4-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=df3f71f4af9a46c9174e52993b6138dcb1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b32c059b4-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /site_stats/gif/t/a/YWx0ZW5lbi5jb20=/s.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xsltcache.alexa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Age: 69

Cache-Control: public

Content-Type: image/gif

Date: Fri, 10 Feb 2017 15:40:16 GMT

ETag: "10-Feb-17"

Expires: Sat, 11 Feb 2017 15:40:16 GMT

Last-Modified: Fri, 10 Feb 2017 00:00:00 GMT

Server: Apache-Coyote/1.1

Via: 1.0 ip-172-30-44-237 (squid/3.1.23)

X-Cache: HIT from ip-172-30-44-237

X-Cache-Lookup: HIT from ip-172-30-44-237:80

Content-Length: 2860

Connection: keep-alive
GIF89ax.A.............................................................
......................................................................
..{{.{{.zz{............||..........{{{............||.{{|......||......
................|||......}}......................||}...}}.............
...}}............................~~.}}}...............................
..}}~........................~~...............................~~~.....
.............~~.......................................................
......................................................................
......................................................................
......................................................................
......................................................................
...........,....x.A........H......*\.......H.H.....3j.......?..I..I..O
.\.........8@&M.....h.....aJ<p......HD.4.N.......d..@/...@...=k..;.
)..3.X..UkJ.].|..s.Q.D...9`*A.Du2.H`...f%.U.W.....,h.@.....68.u...s...
.....lQc..`.Q..(&......g#...@...U..................q>.(..D.=.2..u..
..(.O.>.-W..k.....s..._LLYm..9#oG.9;z...'.T...^j.E..x.%.._I...w.eGT
...g........$p V.Bx.k.!..D=...f.< .~rUX.....V....bR#...k...Sa.e..z.
........T)vf^.Xf...Zv.%q^.. ..A ..*.Y..h.9.......tny..s..'...........s
.*..|.ZgEp..g.......V.i..f.(E......R.i..Z....r.%.........yj..j.f....'.
...'....*...k...&[^..6....F ...Vk...^ ...v..... ....k.... ......... ..
..k.... .........,....l.....o..7......p..Wl....T...w... .,..$.l..&.d..
,....0.,..4.l..6C...<....@.-..D.m4.:...v.4.t.N?.t......TW....a.
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Cache-Control: max-age = 86408

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT

If-None-Match: "8017f9a85f10d21:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.download.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Sat, 12 Nov 2016 01:34:12 GMT

Accept-Ranges: bytes

ETag: "02e4de843cd21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50939

Date: Fri, 10 Feb 2017 15:41:41 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2
MSCF............,...................I.................kI;. .authroot.s
tl.6....7..CK...<.[.........].y.Q..YKv..%k.....!..H!.Q.-..$tU$.)7k.
.R.=...n3......}?...3gf......h<.2...4.(q..f......&{.`....02.s...2@`
.J&#.<#..q..0Xy%.4..egd.:M.B....in.([....W....(.|.....|....s!..Mo..
@......|"(n;Z..'~DE.}(........Mz:T....x..{..n.`z..-.\.............q...
.ld2z..N/.b.J...........X.S.:UN.S.v."..'l........:yz.<."!.]O..6.:d.
....C.P ....P($.Y.Q y..y..B....u.`...u.00.....|(..A.J.Cp.c...X..g.....
....}..'........D.QVFf0...D...a6.f.0.....k.*8...<.;..o...(.....f...
L.0..C.......I.A!.H.....'._)....Qc.V.....5D..,..d../(..j.F.d.....`..f.
..$>:_%.W..(....@.r.9..Ob.e.$..m.~.]....g.......%`e_..&Qhp .......e
y.c.....H`.%<9.......#.\S...R.5....v.......dWE.....:...../"3.._..l.
XiH.J!..............{.5C_...i.U....7....;p....Q.`....L.j........u....b
.`:Mk.L.......*..@M^m..Jv...g........<d:l..Kq.X...*y...x1.u....... 
.....z.....c.(<.b...l.#....,z~..M.Y.]..Z....F..N./..[.#....Ol...f.k
........U.rF)D....3..sK...`..W.....5.=.@#a....!./....>...g.(. ..9..
>!.K..e..j..{x.0.^,...U9..ru.C......,..q^1.G..A.e.F[...".1..*...^..
.L..#:,7...:.z.n...fI1.....l..E.q>......E...x n....H....t....5.....
\...<.l....7}.`\..~_..#..Bz....i..[{.w.....a...c....E w?..6..l.....
.x8..H....7.e.;.%.:.!.*Q....#..bT.......(....ka.......B..|.........1..
..t.r...fk....C.t`....@3.P..*t..nmD.....8$.bd..`D...5X.....H..L../1:..
Ap...w.\...,..U..../"X......}X...a...G....N.X..<....MG....r..H.....
_@..Q2..T...Q.....].e.G./.v,.Z5ib..5........9 ............z..!...g
<<< skipped >>>

GET /clientscript/vbulletin_global.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-659e"

Content-Encoding: gzip
1faa.............<kw.F.......F.2.O.`..$`fv..c'.=.p.j.2 .I....t.....
.-...&'c.~TWWW...u.........6......j...U.q.........S.g^x....V....}...Y.
.O[...i...2.E.Xga..V.]4m........./4.....9..y......-..Z.g...%4..,.'...5
.y;..E...p.........O.............|........em....]|.\........<.V....
....D..9.......E8.QJ..l.(@.E.:.......k..6......R .fs$...aB'..........?
.E.....Y.3b....o.]..s.'...$....SX......{.\..,.. ....x..%.?.`..#..%..kV
I.<R<a.Q.:N.D .[...!.\.h....FX...kp..F..:."....v.E.....w.>...
.md. ._.....m...z.F4 ..t.........../?...Q...WAQ.....j..)-`..R.....$...
..7. .q?..8..6..vO..?.qF.s?I.k..RV..g4.o..i..e..qBg.ne..._....2..dM;Eo
...oc/^..,....57!.].I6F..#.1.......l|....3..=..V...q........Si.e.,~...
....i..xE..6......I....o.....M._.Z....0S.@Avc..`0kz... ...G.q;o..*..C.
..u.H.$_`l.. .....2...N..q....c^.J_U".Z..i.#..^.._..).....X!..8......)
.p.b..)*.Os. .....P......_.." ..BMeh ......BJ.E.Q...Z.J..(a"e.2...IB.:
.U....O.I...`.rN.>.......^...fM.QY...y.ri....f.$.0...._1.0........N
.q2L....."cb...a-....2..O_}G..z...8>.NQ^.O.....o4.A..{*.{.....c>
..RL9.|.3.1D....=k. .7..k.[...y}......L........aU.HY .T<.e96.y..Y..
.~..zgn.k4.......^.=.....bF.v ..].l:...?.438..x.^"..h._P|t...9...CoN7.
..X.... g..........<.".Q|...S..Y...k3)..TtP>.X0W.N.._......*....
J..'Y...&....Ey...*.5f..ON.).Yn..o...hL...9.....9Bo......b-..V........
.)*[.Hj >...f..s....9.w..p.D(Y(.`D:...g..#.>.......X.&.2l>...
0..' `.-....^.~..7."....?M.T.....qm.P...~...........u.6...X..}.\..lL..
..pw.....0.l...s.$..@?e5.......F.......:r\4K..i6.. ..9..8..s0.`.U.
<<< skipped >>>

GET /clientscript/vbulletin_md5.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

;.C=x.._=#...E..........o.oG........F..0.a.a}X...f.....hX.....?..>d
........}.!..v....@.P.....v...)..!~......Zu...E.......V.Y;?.\..'.].g..
..G.L..'..A=s...?..h.I..{.(?R8.......Uo..}...W..].5...;..e5k...Ry....^
..0T.#.:O[Goe...~..).....z...}....O....>.o..EZ..&.ry5.7Q..??..AF..,
.........C.....dir..=.A;.i../n..W...B......aX..e......J.U_=.."h..T.6yQ
.......&./....n._..`.w....l.e.......b@....._.......o.x.....B..........
...?...............<..l.....-...].7..>~......ko.h..'. l.x].Q....
-.~..[{...U...m..D......."l_..D.x.r*v...._..`........U...zjo....~_..x'
.f.........-....bS.4...t$. .`...]{......1...}k.....v.....x..{....D{...
.l....53../.....-<..._.v...O..[...ZY.7&.;.Q1w............"..b....aC
.{@..c...i......jH....!.N;..g...........d.\.?......9./...~..Z./?.oo'.[
X....OV..)B..4...y.ZC{..D....,....R....>L.8...o6p.C.7..%..Z...w...!
j..7.....?4EwXX.....0......


GET /images/head3.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 33457

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-82b1"

Accept-Ranges: bytes
GIF89a................................................................
..................}..e.....\..........................|..\..L........l
.....T.....;..4..$.............................|.....F..B..t..>..l.
..........t.................d..\..:.....6..2.....T.................*..
L..&..D....#..."..<..C.....w.....4..g.....,..L.....X..$....-..(....
.....7..'.............................................................
....*...........,.....b.....$.....4..<.."..T..L..D..*..&..y.....d..
:..U..6..2..............|..F..B..t..>..l..[........................
..........................n...........................................
....|..\........t..L..l..d..F..B..>..:..T..6..2.....*..&.."........
...............F..B.....t..>..:..6.....2.....F..*.....L..&.."......
.....,.......................!.......,...............`...x...cgoN"v...
c.P.@{.-j....G. ....Q...%1.c..^..."......B.Y".(`.I...@....7o.......4S.
8]r.n....mr...%..]..I...K....J41..n...ry..&....K...>...i.V..6n.. ..
S.Wv.XND.........G/K7z..)d............k.=}..M..c......%..n......6Wve..
s.m.#......L..k..y.....(.....K..m.......(Rm.......%.........y?\...>
D...?d..L..uVd....E]..._..s.5.p..5.l..nb.FQj..."P....y.....Wx&FLmU..q.
...<...I6..6.5...C(.D.M6.hcM.?0..7. ...f.4.{4.T.Kh.q...t..7D...;^..
.</...Q..b..#....;.q.4..e.D*=...`.w..zd..S.<..4..g.R1U4.....cm'.
.Ue... ....#O...3.7.`..5....&.<..2.8.I7lb.M6.`..l".4.7]\r.v..d!DY..
...l..M......X...p...6.H....$..4.pc...e...... ;yD.N6.@s.u.t#.L4......W
.O.U.S.;...e..R....*M.B\..*.(.L4&h..#.\A,...Z..wv...H..c..}..7.L..
<<< skipped >>>

GET /images/bluefox/misc/w3cxhtml.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 175

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-af"

Accept-Ranges: bytes
GIF89aG......   ......:::!.......,....G................0.....f.E.X...(
..... ...........<....z)m-e......a.s.n..e.I...E*oH.E..I...p.k.9]G.[
...?!F.f.T..s(.W.x.....H)&y......iP..;HTTP/1.1 200 OK..Server: nginx/1
.11.5..Date: Fri, 10 Feb 2017 15:45:46 GMT..Content-Type: image/gif..C
ontent-Length: 175..Connection: keep-alive..Last-Modified: Fri, 05 Oct
 2012 06:41:12 GMT..ETag: "506e8108-af"..Accept-Ranges: bytes..GIF89aG
......   ......:::!.......,....G................0.....f.E.X...(..... .
..........<....z)m-e......a.s.n..e.I...E*oH.E..I...p.k.9]G.[...?!F.
f.T..s(.W.x.....H)&y......iP..;....


GET /images/bluefox/misc/nav_final.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 652

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-28c"

Accept-Ranges: bytes
GIF89a.."..T.5..9..B..C..N..O..R..S..V..W..Z..[..^.._..b..f..g..j..n..
r..s..v..w..z..{..~...................................................
......................................................................
.................  .&&.  .--.00.22.66.99.==.??.BB.FF.KK...............
......................................................................
...............................................,......".....CDFGLNQSBC
.K.SABEFJMPS@ACEHKOR=?A.I.;=>AEG.8:<..K578;.G23469<@D.01.79@*
,./.59$&) ,.4 !"#' -1... "%),....!......!....................nC....D..
.@..... @.....-N.......6r(..$....:.`a.....f. "...-?....B..%.(.@!...'.,
X.......L0:.....b...`@........;....


GET /images/head4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 8085

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-1f95"

Accept-Ranges: bytes
GIF89a0...............................................................
..................}..z..v..r..f..a..Z..M..J..E..A..=..9..2............
...........a..\.....e.....a..z..g..U..2....................y..`.. ....
......................~..u..p..l..Z.....U..F..B........N.....}..J..&..
#..G..6.."..%.....I.....R..N..>..:.....X.....2..O........P.....1..(
..#..!...........\..S..5..&..;........I.....*..B..!..............,....
......................................................................
......................................................................
..5.....!..D........)..#..... ..(..!.....0..#.. ..&..@..=.....N..Z..:.
.......3..9..B.....U.. ..(..%..#.. ...................................
......k..^..Q..5..R..I..?..|..)..D..... .. .....R..?.....-..).........
..............!.......,....0.............3Y.tu[UJ..p..y.'...F...;.*T%.
....X@....H.*.rQ..&.h.....T.dA..-..T........F.B.%..@IQPE.,...A4w..C..[
.n........q........]..j....].O.1...N.j\..../l8q.V.R....Z.T....2.=.4...
.i........O.W.f.r8...]......V.f.Z..7GNY...:...3..w.A.R,U.p....:..D_..i
...Z.l.^..Q#g..A...'...64..}.....n...jJN..Z.d..6..`.0.|3...x..E....q.,
b.{.4V...l..zLI..8..h.1..s....c.<.~C.].zB.K..r.>.u..7....,..S.*.
...6.....[<..5.tS.x3Ng.g..B@7....7..3K8j..\H...$..X..;..cM6....,...
.f.:E@"^.C 8.q#.,9!.....s.c.T.M7.......5.9.. .T..B.8....,.x.J,.....Q. 
..#..5.8... "....~..c.#....5.... ...kY...R".D.."z.0.F.&RW...4.#...M..|
..=....D......(B.",9E.(w...]..,W"..s..b~.....Qo.ki4..S...(....\.."T8..
...Y.....Q,.'.@E.RJ......U.E....(.p#.3..#.6$rsf8...p..E...C.e....3
<<< skipped >>>

GET /jpg/facebook.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/png

Content-Length: 6642

Connection: keep-alive

Last-Modified: Sat, 04 Oct 2014 10:23:20 GMT

ETag: "542fca98-19f2"

Accept-Ranges: bytes
.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..[y.T...o.....z.7.....U.E[Ea.%n...K4:....3.H4.h..3..O&.L&
lt;.....arTp#"B ...4K....wUw.^o...^U.B..29.<x............}-..I|H.Dg
y.v..Ln`....t......;..........8...,YB../....b'...;.P.....r..>.s..c.
`&.K#.`..r.hQ.GA.q.SN..S.uJ$......w.y......i....4>..p.\...3........
.....222$M..;j......1.H..K.3I.,#.-.....'.|....nqaa..H$.?00..........p.
...h4J===....s..i..N...C.j.us.M.V....~...N0.2~.....gW<..../))....0.
.l6r..TVV.......~...#I.....g...mR.E...U.8..........~...n.....uww..9...
.......6''.X.d7..0L..\..`._~..w.yon..}].....c._; ....l.... 7.....{pU.}
........E#......x.........kj...~R.... (77.N.A.dP...B.7g.\.....!.J.....
.(.....".....U..K.e..5."..`...o...%.p...?....Z:..Oy.. ..7......#.5.y4e
L.M......TZT...HR......>x......9G....d..z.c.x<~....>.W.{..q'r
....D....?..yC.A.................vRe...A.Z.i...r(...{......RM.e.....=.
.G...nZ..g~..P0.a.%9.. .7L.......{p..`$.....;J......B.)S.TO.>...H..
..>?.3\.. `..d..$Y%.}......v...SK...h...6....L.8..&....\1...$9..../
...hNq...-]..z...?....g..#..[.... ,..VP.U&<...4.].......$..QwO..v."
..$#.&. !.%I....[7SL B%......../Lm.....:h8..].o..u....n..?.]..MT......
0.I.N..(.g...<./..b.......%.\............UT\Rb..........t. ...!....
.$...H..9....n..=.!C..Z..Q.&.@.A.e............x._A..@\........4...... 
.....8..O=S..a...<.....`.#....1.~\.233)....u...Z...'....].:-'X.SJ..
n.d0...b.=....#B.MM3..P....)F.6.jkC..q.d....%:Fv...\........Qe!....veM
M.r.UW9`....(J......".......$H.*%..Cv.....7..R.....6.Q....)..R.n..
<<< skipped >>>

GET /images/bluefox/misc/bg_tile.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/gif

Content-Length: 427

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-1ab"

Accept-Ranges: bytes
GIF89a.........!........ .............................................
......................................................................
......................................................................
......................................................................
..... ............................................!..!................
....!..... ....................... ........"...,...............~.~....
......;....


GET /images/bluefox/misc/nav_bg_small.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/gif

Content-Length: 1453

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-5ad"

Accept-Ranges: bytes
GIF89aN."..H.^.._..b..c..g..j..k..n..o..s..v..{..~....................
......................................................................
..........................................  .$$.  .22.44.66.??.BB.DD.I
I.KK.TT.VV.[[.]].``...................................................
......................................................................
...............................................,....N.".....G......F..
.G....F...E.E........F....ED...C...C.........B.............?.@........
...@?.......A.><.==<..................;9..987.......o`.......
#a>..#..A....22..xq.F.5B...Q$...7..(2...-m.......7].h.S'N.9}....(..
>..=.....F..0..*..)......W.*.n..V...g..M!v.[..iY.`A..\.!@....o...C.
.<./..!...1........L......X....f..?w.p.4.../.V.!....c...A..../[..A.
....C..!.o..../.......?g.\.....g...;o.....O..x...7h`.<.....o.......
...`A....(....h...*.`..6.....P...Vh...Nh...n.!....a...X..'............
".-...........H..?....6..c....@..L29..G....4..#......3r...\....0....6.
.f.7.0..C..'./.Id.v.y..7..g...H......./2Y....j!.K.8h..R......h...h...z
.....:j...*.....@.."......j..F....6._......... ..>.........0....2.^
....-..u....Z{-}.P0......u..;.t.B......[..6g...V..... p...;p...,0..(.p
.....l...V.j...Y..s..l...A.$.L...i...&....-..2n0....1w.r.,.L.....s.-..
X...-4.G..W... ..TW-.a.U...!\-..T_.u.`..u.S.=6.T.`..%.`B.%.M..&.]w.t.m
w.r.m7......'....(.....#~.........-...7N.../.....>..x;..d.7^9.y...a
}. ;...N8...N...3&.. x..`..V<..#O..%{ <.y1.<.......g.v.....&g
t;clk-.....<.j/.}....;....
<<< skipped >>>

GET /images/bluefox/misc/nav.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/gif

Content-Length: 1831

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-727"

Accept-Ranges: bytes
.PNG........IHDR...N..."........<....sRGB.........bKGD.............
.pHYs.................tIME....."5&.......IDATh..Z]..6...b,.q.].EPt.c..
.B.....G...I."I.....Z.8} %...$o.E."..93.|.C...pH.......-k.....l.7o\...
g.|:..s..h.....4..u...|....Ck......u.Y..Xp...1.....N...{..........l...
......:......_..u...;&].p...R.......5tD;'._,b.9..^.b.%....M.PY.....ed.
e.}.. K.xl.3...-.8...^..R...<.H..F.p6j..u.=gqwWw..-.F]........j...V
.c...V...=.e9....2..e.....pn(...U...]...#......FM'T...._....%w...iY..`
..s.Q......{=.I8V^...)...3.i..}=........CX...b.z.Z...8..r....E0.p.;..!
...Y.Q....N....v:y;....>..=t..v.........gl6Z.....l.#.i..M.$.....Y.;
....u.X.)J.^fU....33...5.....-.5...,e...(V......l$p..O*..`...Z).z6.H..
!..DB...m....k.`..D...0..0s..S..[...\....V./_L"..F......:....m6&#.....
.u-.C.p...^1......e.u.(.1..9..@...3.gq.mz.o..B.......8..Q3d.....d.rT.R
tJY.0..N....7...J.Fv.c9R..3............V....M..'r......."...Pyh,[...Q.
R.e..e.$......g........mu.. {.......js..,)....)....s.....L..X.<Z..q
.9..N..].....Z.........x.p.`..........t.=J.a..B..{..J.8m .=.N.K..HCY..
...{b..bP.S;...H.4J.....`.........2.z.d.).DO...@."!.......]fz.........
.B.9Z....}......*.h).....q.[..}4c.&]F...._E.}......}..6.Z..G..........
....3..._...".,...=.x..tPz8.)...yNt.d/.[....=.|.L.@\.}..J..U. ........
lS....z."..8..K".M.=...C.Ow.W.........-....7../......d2a.%.B./.&..[M..
&....rN.. .W..k~..Z...W5...m;..oGdap.`$.....2[.....]...@1^{....m...>
;......O....}..B......5X.1Y=.....^Q;S........%..;G.q..s..`......@.....
2..FX6..i,..5.9p.q.D.....n..........._s.F.F.0.....Zus...i.(......Y
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d88f945ee8f86b78537fbfe644b73f56a1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b10ca5954-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /certs/ca.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: aia.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/x-x509-ca-cert

Content-Length: 1997

Last-Modified: Fri, 18 Dec 2015 11:03:49 GMT

ETag: "5673e815-7cd"

Accept-Ranges: bytes

Date: Fri, 10 Feb 2017 15:41:36 GMT

Connection: keep-alive
0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.
1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certi
fication Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0..
.U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..
U... StartCom Certification Authority0.."0...*.H.............0........
.....lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg
...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r
5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...
:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[
.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.....
..,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.
........`.g:........r".................\R<...*s......`.z/...n.&0...
..W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U.
.......0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.s
tartcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl
0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startc
om.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.p
df0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited 
Liability, read the section *Legal Limitations* of the StartCom Certif
ication Authority Policy available at hXXp://cert.startcom.org/policy.
pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification
 Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[
<<< skipped >>>

GET /site_stats/js/t/a?url=altenen.com HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xslt.alexa.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/x-javascript

Content-Length: 3153

Connection: keep-alive

Date: Wed, 26 Oct 2016 15:41:31 GMT

Last-Modified: Sat, 11 Dec 2010 00:35:34 GMT

ETag: "f4022b30d2ad8a3755b6e53f31c63252"

x-amz-meta-s3fox-filesize: 3153

x-amz-meta-s3fox-modifiedtime: 1291757166000

Accept-Ranges: bytes

Server: AmazonS3

Age: 4865

X-Cache: Hit from cloudfront

Via: 1.1 c722429a8af7d9f02db581c7256a2bef.cloudfront.net (CloudFront)

X-Amz-Cf-Id: bqeDJQuhbICRtFFNrkOBZXEioTG509zu6NvAyIlPYNwsEInTm2oXKg==
function AlexaSiteStatsWidget(){.    var keyStr = "ABCDEFGHIJKLMNOPQRS
TUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 /=";.    var jsUrlRegex = 
/http:\/\/xslt.alexa.com\/site_stats\/js\/(.)\/(.).*(?:[\?&]|&)url
=([^\?&]*)/i;.    var jsAmznIdRegex = /http:\/\/xslt.alexa.com\/site_s
tats\/js\/.*[\?&]amzn_id=([^\?&]*)/i;.    var imageSrcPrefix = "http:/
/xsltcache.alexa.com/site_stats/gif/";.    var detailURLPrefix = "http
://VVV.alexa.com/data/details/main";..    this.replaceScripts = functi
on replaceScripts(){.        var scriptElements = document.getElements
ByTagName("script");.        var thisScript = scriptElements[scriptEle
ments.length - 1];.        var scriptSource = thisScript.src;.        
if(scriptSource != null){.            var urlMatched = scriptSource.ma
tch(jsUrlRegex);.            var decodedURL = decodeURIComponent(urlMa
tched[3]);.            if(urlMatched != null){.                var ass
ociatedMatched = scriptSource.match(jsAmznIdRegex);.                va
r base64EncodedURL = encode64(decodedURL);.                var imageUR
L = imageSrcPrefix   urlMatched[1]   "/"   urlMatched[2]   "/"  .     
                      base64EncodedURL   "/s.gif";.                var
 img = new Image();.                var fullURL = getFullURL(decodedUR
L);.                img.src = imageURL;.                img.setAttribu
te('border', '0');.                if(urlMatched[1] == "s").          
          img.alt = "Alexa Certified Traffic Ranking for "   decodedUR
L;.                else.                    img.alt = "Alexa Certi
<<< skipped >>>

GET /qoEf3sh.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:39 GMT

Content-Type: image/png

Content-Length: 26299

Connection: keep-alive

Set-Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.altenens.com; HttpOnly

CF-Cached-On: Tue, 07 Feb 2017 22:28:49 GMT

CF-RAY: 32f0aa40f29759fc-VIE

CF-Cache-Status: STALE

Expires: Fri, 10 Feb 2017 19:41:39 GMT

Cache-Control: public, max-age=14400

Accept-Ranges: bytes

Server: cloudflare-nginx
.PNG........IHDR.......@.....}o......gAMA......a.....sRGB........ cHRM
..z&..............u0...`..:....p..Q<....bKGD..............pHYs...#.
..#.x.?v..e.IDATx...w.\e...g.e7....e.HH......A.)^..,..Q..k.z-..r...z.^
..E...P:.!,.@H...l......y...df........u^[f..9.y...._........$..@30..e.
...d.......z...3?k........@....e~..v.......t....,...j.O.2.....(..y....
I..,..6.A....:j.t9.".^s..6#rY...^.:..u..1.D.1.D..<j.q$.q,..#.....&$
Y...Hb.........@.....K2.CL(..!..........,E.....D.y..J....c...3.V.?&..#
..pT.Raf.......#.i.@F3\D0....C.....^...&|..Ð$2../'#).X`.2.....B.....
...$...\B..<AC.C"5..r.p>p*0.p.?..4..<...o............0$.....H
.,d\m...E...R..n.nC....X*..P*..D..q..8..4-...Q.AD&..7!......J!&.2."...
t.b.eH..U..a.. . ....b[K...J.`..$.....H.W............V.....1.....L.^..
.yl..}mc.....Y..........D..d.p.".....#\..$.k.w(..Ki..J...d6.Z.2..F..Y.
......k.Z..K......2.......\........q..~.r.b.P.....X.h'....A.x1..4R....
...\.bB..K.....x;Rub....w..F.,qRb....O.2.....!;I....cD.H.pQ.[.*......k
.N.iLFu\.F2............5..z.::6T{..BL(#.Ro.G.....M5..D.L...Y?....3=.O.
z..i.I...;=.....o...Y...A=.)..6....f.{.9.....T....w rg.E..".X...,7..H.
...."..b.I...ZVr ....c'...4.>.Y...#..t..i.j&7...:N..h.Hb..{.9.X?..V
...&..:s.........X.*.m@e1w....AFV2...J.X........8L..H!.c/".-ham#C.[...
Ax.....%Y. .....NE5ef..wIT.j....#.?..4R.:...9.I.s...H.2~..J...4.o.>
....5E....EF...v..(yo3.....t..OC......)LC.1...1.I.^Q.Bb.\.2.G.qW .x.I.
[....<r!&..,..'P...j_WH..F..&<..v.5hg.Hc..L.nXK..C..3.Q.E...".hE
d.b.W..O#r\..Q...Ad...6&.#.bBa...t...L<6.....B.ZT..a.F..Nd`....
<<< skipped >>>

GET /register HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 522 Origin Connection Time-out

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Frame-Options: SAMEORIGIN

Server: cloudflare-nginx

CF-RAY: 32f0aad1818c59fc-VIE
1734..<!DOCTYPE html>.<!--[if lt IE 7]> <html class="no
-js ie6 oldie" lang="en-US"> <![endif]-->.<!--[if IE 7]>
;    <html class="no-js ie7 oldie" lang="en-US"> <![endif]--&
gt;.<!--[if IE 8]>    <html class="no-js ie8 oldie" lang="en-
US"> <![endif]-->.<!--[if gt IE 8]><!--> <html
 class="no-js" lang="en-US"> <!--<![endif]-->.<head>
.<meta http-equiv="refresh" content="0">..<meta http-equiv="s
et-cookie" content="cf_use_ob=80; expires=Fri, 10-Feb-17 15:42:47 GMT;
 path=/">..<meta http-equiv="set-cookie" content="cf_ob_info=522
:32f0aad1818c59fc:VIE; expires=Fri, 10-Feb-17 15:42:47 GMT; path=/">
;...<title>VVV.altenens.com | 522: Connection timed out</titl
e>.<meta charset="UTF-8" />.<meta http-equiv="Content-Type
" content="text/html; charset=UTF-8" />.<meta http-equiv="X-UA-C
ompatible" content="IE=Edge,chrome=1" />.<meta name="robots" con
tent="noindex, nofollow" />.<meta name="viewport" content="width
=device-width,initial-scale=1,maximum-scale=1" />.<link rel="sty
lesheet" id="cf_styles-css" href="/cdn-cgi/styles/cf.errors.css" type=
"text/css" media="screen,projection" />.<!--[if lt IE 9]><
link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.e
rrors.ie.css" type="text/css" media="screen,projection" /><![end
if]-->.<style type="text/css">body{margin:0;padding:0}</st
yle>.<!--[if lte IE 9]><script type="text/javascript" 
<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/css

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-6eeb"

Server: cloudflare-nginx

CF-RAY: 32f0ab8da2cb59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
1313.............=k.....E..`...GO...\.r.!....|....D...DE.n.....>$.)
...,n.XX|...bU.......?..^.....w......wP...h{.}/...M.......... xj.l.7..
.Y^...}....d\....jA..q..!.....g...a\......n%t.v.hw_.O..<...w .v_>
;.r....>..}..;.W|8L........vM..[.}9~$..HK.K..E>.l_...~..V.%..K..
.s.m....,y.....,Qy..c_...Y.qg.fV......uB..2.......y..7.6...sq;..?.9.gg
.m..{.7po.6.mU...s.....p...3.. ]Bg!.... .{/VRx...N~.3.|...!.7..w..u...
Wm.....;.2y. .7.2.Xif.....6..a......7rC....r[.r.e/?...\....=..I8..5d.z
...Tw.Wr..:(c.!.v....\~.....T.k..y.......Nz.....2........x4m...}#o...J
..d...................\Y.tlp_.M])...O.....P).N.....x..L.B.[..Yn.U/5T@.
$...3..X^..]..#....{dQjA).oa.1.-A!...@..5...M.....{..,A.]i....^..N..N&
{GDPn9)..(Sd....2...R....].T.<G.q.<.q..f..3e...lP.......A.......
a..@...p..^ 1e..A...n.ZX.........Af..N..dJ...n..(.F.c.q.Q[....Zji....g
..............l.t.e-..^.d..2y.5N. h..l.:..&...Q.d..`..>x....Q%..|..
.#.}.........$.&....j5n.....t..2.b.S.C......T.7.U9<....O..p........
.q....*w...../.x.DCW.. P..G......L...,t.U.O......c2..D.u....dd.<.._
...u~.j...'...lK.q..D.f....8\...q<....;.h...(.ha...Q.Y.e..g..U.....
.*........CK.k...4p..#........R..0.>..lR..M..)... =.l.@i...W....k8.
....s.D"@....g.....~_.....~....IZ.E..$b..D`.Q..BZ....f.2.....9.^.5.V..
r.K.*.}...`yw.l`....#a...;.......>..Q.M.m...... .p..0.;5...g....]..
...l.i}v..E0....-..t....G..m...n..h=.wjW.Y9./..M^.g..f~...t.L.N..*W.U.
...6*.N..av...d......w*..g......|..:..-H.d...i;...LZ\..W....f..]M.....
..]A.i...M).e>....3Vq./.V..k.9.1.>n63.........}..N.5J....M..
<<< skipped >>>

GET /cdn-cgi/scripts/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/javascript

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-17bdc"

Server: cloudflare-nginx

CF-RAY: 32f0ab8de30759fc-VIE

Expires: Sun, 12 Feb 2017 15:42:17 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
500a..............i..F...}~E....b.E.v.1.,.,.m....n..R....Q$...Z.....8'
.$@Pr..{..7.*bI....9.OG..........t.l.....b..~Q.......h..o......m... ..
^..(.-bH.q..G...E\;.....L/ver...{..T<...>..[..I...DQ....hF.. ...
..MB.uU._....uU.....W..6...._..ER._....._./...D}[.........s[$"...8#]].
} ..z..h..w...Y...Uy*X<=@w.....,b^......aM.,..E"..Oi........|SWy...
..k~.....*.....-$.1G..C....j..D1M.i^.5.9..]..........b..b..7..'.......
.arIo.........".YN....i].}...K~..9..dVL.UY..{.QN..G..8..m\.._.....t...
EV......U....m....o...=9.L..)..~.....fW<..!...T.........F.M..M'K...
....2.I.V.<By;}..J.}.s.... m-............>.7X...Hw|?...3........
..hl.s....0..9R......XL.~.}..Se8...A.W..\.....#...&.........F..l....e.
.L_..._...FWq........ ."9.J3XMs:.r>..=.U..S...=v[<..GZL.C-...JS.
Vy..N...*hJ3f:1.....H.lN...n.5...).cQYn./.]3s]..e...*.....m6k.b......H
.x.{<..f....er..'.......(O=..<.)...Wr....p.....L.O6b,.....@.?ly^
.~.b(.VS~........./b.9M.w..%'..Q..s;/|.x.P<.}.].....we.\.Tm0IL.....
......I.....{....^O x....Vb........3.8.....O.....p.t.p.$.u\.....G.....
w.#.1VLa.1..5>....4..pxs.....:.g..g.O..._|w..U..,RHk.*Ow...?..&{^..
....^D.. 6.l_...;9..Y...`~q.r....kk..|..A..e0...i..(.......B...I[R]...
......6r.....;.zc...}...?...S.-...:^{f....P..../.....t...ED.n.S[.{.X.4
V.#....;c<.c..Ov..Fk*..A.^.....i_.?.l[F|...o.B#...:..|.E.u=>.."~
.W...fqD..T......A b..[.1....B.Sgw.8.......D|.w....#g.......u.My......
......4a3....\.0V1.j{_.W.".{l.Z..gB.....IT..9..A\......=...BO.o....`..
.*a{..c#z$.E.FM...V^.qx..l.$..SL..........?...)'..G...e....&...R.k
<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-400.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-4b10"

Server: cloudflare-nginx

CF-RAY: 32f0ab8ee3c759fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
4980...............P.@..9....>...............<....A.[....H.....w
o...........V...... ...... .""<......2...d...O `....d...)..@.c.....
./..P.x.l.n..@.`.p.x...L....`.....,.^............G......`.p.8..o......
......A...@...m.;w.4..@.f$}....JV.c.`8.S}..q?.......~i.i..>....!V.7
SMV\.O..s.|..p...M.M._.L;. i...Y.|2.2./E[ri].;.^{....&.'b...b.].%....Y
S~...U....E.}*0"%sZB..0t.:.ZI......h.....^.....^..%R........5..53...%.
..a...y..P}.}T..'.3.z..X.i:B....{..i.]2K.h.a.NS.n\..@.@A.7........'...
a-..].....2[e...,..].`.....vNB.....(,..S.g[..\4_...[....M..f.Ij.Q.....
!...G..P.....v..bQ.<.i..U..t.......P!..hP@..E4.$ ..p..D..8...&.....
.!a.8{xk..D-........v.N.........3.!b...31N.....L..S...v.0.p.NR6...D...
............7i8o.6....@......V.-)J.h....v.#.O.. ......p4...L/..].....0
...!.~..c..F..D-,F..c..:..F..n#..;...Q4..;..|:M.f.-..j..T...s. {W1..'.
.j>b......,._....b.. T....#_4.....V.=i.i.w%n......op..EfDeQ.^.f...w
..t...*.....P.Xuu. t.u...6......... .u|p&... ..]....s..B...}...6....q.
.#`.....=&..I!G....m..h.ZC.&m...;.....%Y..-.I....Ws]@.....rlmos\s..AN1
t..`. ..:3...RCT6lT,....6....Z1.0..q.F..).&2.N0.9......./....*....T...
N.<....Y.9.s.\dM;...2..{.&.B...-.....V..B.mBN....x.......d...).u...
......_....p..j....p"...j.e.fcW.p"..`~.......7IS@l...q..$........;!...
d._`..h....(Z....f.$...:tG..Moh.3.&%4....<....>..iq.i...t.{!..A.
#'./.l....@.......HZ=..<...M.. ......-....W.:.G...$...=$eZ..f.T...w
..(........?..S>......Bj..T..;u..^.8QLV{.L0..|.p...........|.q.n...
.$..........r..EKS.......w8.u>.(......D...!..f.u..M1.T........%
<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-600.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-4b8b"

Server: cloudflare-nginx

CF-RAY: 32f0ab8f742259fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
4b6f..............SX%...7.......m7....m..lL.....&.....:....97..Y.f...W
..2.......... TD.0..........8......kL..`.........`.~f...-@.......(...K
. ....-..........6..........|...K.'........O......?{..;......x........
......?..v...o.K ...g.,n.bM..A.C..?...' G..I..>.......].t.&B.....j;
...F....nX....B.......v..Q...(.7....[..u>.eb.......Y.^...u.@0?.i..9
..?.|]...[......9..g...2..l..../!.T......=Cjn..F..S..T....._..^0s.."..
I ......x........j...b.X...'....O 8...<....]......]...b*...Zi2[7...
..aZ.........?d.jN$.m&...-3.....{..\..R......@...M.u.lO.\....eH.D.r..X
.-...(. ..*...P.....A..d...Ak.=4..M.mo....'q...@J;.`b.]N..."C....%...2
?'..lDom..z...2Lk..3@.4........Q....Z. .*@B...g9i=K.&.......I.B.NI..@.
A..`;.......GD.T..x..........4r..YR...p'0...lq*...k..(..W.j.wR.....&'.
G..FJ..p.*e0.5..._.......o...KB.f%......... ..]..4.......`.........`X:
ftn..@voR.2.&4.D.Tr......\...J..?7.,Q.*4.@..%..G..V.x.._....D.l.5f....
....X.......g...Q.....Lj......5.v...."..... ..K..z.W...9?....L}...)aHo
Z1.B.F......[f.4.....L.IZW..[... j.N....1.@JO.R<b_E..\.h..K..^j....
.8#...5.......zzO...k....Ki0....\.5.!....=....;`t.......`......Gi.n.Dd
.....@0...I.Q~*..#.....l.....Q.W.'.)f`q...O.7..1...M@]..n^...$|..,."..
.4.E....!..f*d@........e.&w......(n...)n...mgq..C.m&.L.k...?.7Y..L...W
...a..?...A....s0.u................m.B.'......U{.:t..(f.>a}`.....&l
t;U&.$......T..?..T....s_......j....G`.Q.>.>...5...u{7..S..\.c(f
AB..S#.../..._..wJ..".....I..Q.Om..|.Nw. .Q.KT.SQ.3..u.:.2A.....e....=
.....v[......-... ...y......n..fY,..mO.V.!..._..........M../5....6
<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-400i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-52dc"

Server: cloudflare-nginx

CF-RAY: 32f0ab90148c59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
400a............l.UX...dC.nA.....ww..w.b......;..ww .?..K..~..vw......
....u.. ...... .22"....! $#.. .../ `..5......!...w.............-..@...
X............X.\...k..@.0.......G......8.<.n..@..Y...>. ....?...
....~..(...o.g............Z}Q/v.L~....6......-|*...@~\MA..blu.EV..{.Fc
.}.a.....Y7....3(zk.5.Ki.....o2...k.Y..g.A...u[.p%.Y..%...K..x...T...D
TM.96j....b.P[`.:..@.K.u...r..R2i...h..Q4.c.kfg].&E.X......K.r&..8X...
.......-\(.<..?O........!.<.~....x...A..0......h.A.k....hI..'.f.
...JKWmD......THkHdF5$....sI../..........a..0.!_.f.q.)..B.?...=....g..
.z......Q.-..0.L....v.R.h.....?...*.%*.di..Z..s........F.{...!5.M.|[..
.!4 ..:.ö../.)f........9.2B............M.y.g...<%...DF."38..y `&l
t;...7.;..yo...S"..c=.........d.I.cY..<......K......[......r.o....H
.XB...qSn.s..........!....?@.a....y......D.$.o.d...b..&#&..Q...k.f...3
tda-......%.....em9.J......-&..:..r%.......s.%.....M|....I.!/<'.|=.
k.i:Op6W..e.O..x...W...n...%yV.nl..._......U...'~D.....**...PV'*)wL.L.
jd..Bh...$...H..':#../rX.*.... ..'...Q..*E...p!2..&..e8..p,..?..`Es|.X
........a`..[...7E.....|.A].'xs..E~..5..;9nu/....... {.........;L.=...
...\.g.o.M.\..Jz.^$i'V....4.........q.I#=a...F..',i...D~.....)..u....f
&}..F.T.;?."..g..1)%<.W=.m;....K..........T.1%.G..[I......aBD...%/.
P..@.8Z...,".....{..Y.9K#..h5..m....W.o.9.......0.`..0C....o|`';.!z...
........5|8../m.Tn. .bQ.X...n..A..........E..............=......)...J.
..\.t.p...F,.3...23#|...*...*......G..I....:... -....Yd(P......T.a..h.
,.R/.!.....).t...^..f'../..._....C..0.L..{....i......b.o.PK..$...p
<<< skipped >>>

GET /register HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 522 Origin Connection Time-out

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Thu, 01 Jan 1970 00:00:01 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

X-Frame-Options: SAMEORIGIN

Server: cloudflare-nginx

CF-RAY: 32f0ab90c51159fc-VIE
1691..<!DOCTYPE html>.<!--[if lt IE 7]> <html class="no
-js ie6 oldie" lang="en-US"> <![endif]-->.<!--[if IE 7]>
;    <html class="no-js ie7 oldie" lang="en-US"> <![endif]--&
gt;.<!--[if IE 8]>    <html class="no-js ie8 oldie" lang="en-
US"> <![endif]-->.<!--[if gt IE 8]><!--> <html
 class="no-js" lang="en-US"> <!--<![endif]-->.<head>
...<meta http-equiv="set-cookie" content="cf_use_ob=0; expires=Fri,
 10-Feb-17 15:42:47 GMT; path=/">...<title>VVV.altenens.com |
 522: Connection timed out</title>.<meta charset="UTF-8" />
;.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8
" />.<meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=
1" />.<meta name="robots" content="noindex, nofollow" />.<
meta name="viewport" content="width=device-width,initial-scale=1,maxim
um-scale=1" />.<link rel="stylesheet" id="cf_styles-css" href="/
cdn-cgi/styles/cf.errors.css" type="text/css" media="screen,projection
" />.<!--[if lt IE 9]><link rel="stylesheet" id='cf_styles
-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" type="text/css" media
="screen,projection" /><![endif]-->.<style type="text/css"
>body{margin:0;padding:0}</style>.<!--[if lte IE 9]><
;script type="text/javascript" src="/cdn-cgi/scripts/jquery.min.js">
;</script><![endif]-->.<!--[if gte IE 10]><!-->
;<script type="text/javascript" src="/cdn-cgi/scripts/zepto.min
<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.ie.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-d65"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:17 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-d65"

Server: cloudflare-nginx

CF-RAY: 32f0ab92761f59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/scripts/cf.common.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-1138"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-1138"

Server: cloudflare-nginx

CF-RAY: 32f0ab92a63859fc-VIE

Expires: Sun, 12 Feb 2017 15:42:18 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/styles/fonts/opensans-400.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-4b10"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4b10"

Server: cloudflare-nginx

CF-RAY: 32f0ab93067d59fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/styles/fonts/opensans-600.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-4b8b"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4b8b"

Server: cloudflare-nginx

CF-RAY: 32f0ab9376b559fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/styles/fonts/opensans-300i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-53af"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-53af"

Server: cloudflare-nginx

CF-RAY: 32f0ab93c6e059fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/images/error_icons.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: "589b19f3-4177"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4177"

Server: cloudflare-nginx

CF-RAY: 32f0ab94070459fc-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
HTTP/1.1 304 Not Modified..Date: Fri, 10 Feb 2017 15:42:18 GMT..Last-M
odified: Wed, 08 Feb 2017 13:15:31 GMT..Connection: keep-alive..ETag: 
"589b19f3-4177"..Server: cloudflare-nginx..CF-RAY: 32f0ab94070459fc-VI
E..Expires: Fri, 10 Feb 2017 17:42:18 GMT..Cache-Control: public, max-
age=7200..X-Frame-Options: SAMEORIGIN..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ/icg9B19asFe73bPYs+reAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:36 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: CD4E411028F5966AE35940E7A80D2D957332E76F

Cache-Control: max-age=333546,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 312

Connection: close

Content-Type: application/ocsp-response
0..4......-0..).. .....0......0...0......uq..H.....AG...Hw..y..2017020
7123043Z0s0q0I0... .........%...' ..}j.^.v.b..x..uq..H.....AG...Hw..y.
.[%.i..&Uf.9...T.....20170207123043Z....20170214123043Z0...*.H.=....g.
0d.0...`..,3l.s.zT.M...h..&.F........C^..jdu..e..\.G.0H.dD$nk..Z.E.!.b
.!.O.2.Y.<......]8M.c.{r.d..-.....

GET / HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: BHC=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT

X-FireWall-Protection: True

Content-Encoding: gzip
1b1.............R...0... .:,...N),]Y)....tais(...{...%W..,%..Q.'..[.0.
...i..t..y.Q5.....k..U.........Z.c..,../........."...`.h...*.....?x..k
.G.u.Vu8...f.....hX.j....%N...D..6.#w1x.6........CGX^..J...2`R.nz.1...
...M.....\.P.......R0.v.x..P.).TGmy..)j...t...$p~..aX...t6.......T....
g.._.....0.(...f.........y.0w....!...V...h.O..5...c~NL)_.....<u.A.W
e9.... ...\.&..`..H..........<h.kI;....Iz.....KvI.^).U../z......g..
.%.*.)..}..]._.....d......0......


GET /banhammer/pid HTTP/1.1

Accept: */*

Accept-Language: en-us

Referer: hXXp://VVV.altenen.com/

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/octet-stream

Transfer-Encoding: chunked

Connection: keep-alive
2e..JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054...0..HTTP/1.1 200 OK
..Server: nginx/1.11.5..Date: Fri, 10 Feb 2017 15:45:45 GMT..Content-T
ype: application/octet-stream..Transfer-Encoding: chunked..Connection:
 keep-alive..2e..JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054...0..font>....


GET / HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: BHC=JwJ8Hnh2gFyq/Rd4pH44qt5IPWM=_356491700054_

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: text/html; charset=ISO-8859-1

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: BHC=; path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT

X-Powered-By: PHP/5.6.19

Set-Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; path=/; HttpOnly

Set-Cookie: bblastvisit=1486741283; expires=Sat, 10-Feb-2018 15:41:23 GMT; Max-Age=31536000; path=/

Set-Cookie: bblastactivity=0; expires=Sat, 10-Feb-2018 15:41:23 GMT; Max-Age=31536000; path=/

Cache-Control: private

Pragma: private

X-UA-Compatible: IE=7

Content-Encoding: gzip
ebf.............].w.6.......e..vk.z.......$.7.o....E..)..%.$.G........
)J~....s...)`0...3.....G...?...Q6.....oN..Ss.....{t~$........7.y.M.0..
.....;G8.,......e..]...{..."XM..>.2.f..|g.......8....8....Y..~.t.(K
..y.a..&.@...h.d..x...$q/.RG..I.L..3....\...(./.....z-.}.^t.CY.v~=...Y
p........$..........N.i.....I.xY.<M../fQ.d.D.....Y......2N|.k/.....
^...u....F.#..%H...0......c/....%..._.&.0.....$I..8.R..=....M...$.^..d
.N...p./~...pJ.m.....8D.....[.D..8....l.(.:..wA..t7..$. .=F...:.D..w.&
m?Mi .<~.....|{.x.K...^/..Y..=y.b.A. .. .../z...o..O.........a..&~.
.G1.<m....].~6..........0...]1.}?.....s.J5.x.7...e..o$I..|..<.Vv
..K.....Y?.........Y,."N0.DS..L$.O.......0.co2...ZpMP6..e.E"...(*_....
..2....i..z...M3/..):......`@.....DL.. J...PaS!y..<.:..^.1.8.$.c.0.
.&.p...A~.T...CD..&}.%..`...eA...}{.8..Y2..~.....X.....@....x.C.y.q>
;.r../y.].8...........P..0...8.....0U...aBbj.G....?...>...../....q.
"...:..G.d....h0H5.....h.y..`5...$0U....5..?w0......q0....3...k......s
M...$....q..:..M ..i`.....zi.`..J........6.O.....yF..`...3#.%...@..A..
L.........K5./.O.UG..g......v.5<.Q......[c#.... ......H....O.Smb...
.X.x......7..O..w.....Y.j.../L..._.cP...40{..kC.q...4..0.P.A...%....K.
..?.D.h...)hM...8k...`.....Q....Q.r.B..._..k..5]..D.Z....;.z.~... L..G
. .\..L..=.5..s-....... .....nK.\...t. ..*C......a*...EL.a.....?c..N .
...(..X9....S...W.(.............xY.WM<CQ...*...-.!.........1.......
~..{qO.....}.3.....8?.1.$jB...n[..>.........9........\.p........U7=
]U...s.Xm`%?..A<.V.k.W. ...=...$(..D....X.2...\|..@..V7..@.!...
<<< skipped >>>

GET /clientscript/vbulletin_important.css?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-68c"

Content-Encoding: gzip
26d.............TMO.0.=._1..R..-*..q.R.J|Hm..TBN2i.u..q.V....r.I)]..V.
.....{~..;......l.....M......h..S.........h..........~..u....^.....J.'
0...WB.....`.z....5Ky.....[.T.B..1/..ai0..Q...JC...'<b.@....h}..O..
..F.......8...h.........>........WU.-..cz..`.....G(..R..wV-.:o..|..
;p....6.*.\.....N.t./.A.........yu..B.6...P:...V.S.=I.X.N.4n.........K
.%.la.,Q..P.L...d<..6.R..-......c.4.d..E..2.P..).. t..7......q...4.
..2...T..P.:.4{.6".....%t...P....VUsR''.J.v..^8....`..j(..[.]...(.LJ_K
^...$tJrQZf.J....v...s.e^....{."..aN*:...x.2......o<{_...~.....@..U
 .........UIr;....,..N`..p.4....v~5...4...pj'.1..G..m.......k`...../..
).........0......


GET /clientscript/vbulletin_menu.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-24d3"

Content-Encoding: gzip
a58...............r.H.}......H.....4.@.... l....%....F..%.........SB.{
.......2.......Y~?|.f...}.....T.f..C.H...................,.L....~.....
.V.^.p.....6.|Ss.P....v.S.lp`...K.js.bm.m..2m....$e.....4@y...A.-%....
.EL.......8.e...7....6.....j.W..v..b..s5...p.X|vrr{{knf.^.OW..u.$$>
.Rl..*,Q=.^??...|S(.......1.m. ..........K.`...#.....~..:v/.(.q....4j.
.Gn.p...}.\.{...^.b....Mm.SI...jN.x[....M;...&a3N(.l.c..1.........X>
;X'X...E~3..L.... .Q..dd..B.^....$4.9.."&..it#.R`y.....x.6.?:.....1.9.
 s.A.kp.?MA.d..:...I...)..>....A...i.....G. ...z.E'|..:P......~2e.S
....`.N"..}T.K.T$n.........1....Xt#..l.b.. ..b.3q7q....N.1!x0..O/.S...
.m...~A.}~.d.3.Fx/....[....48PW.cb.....=...Q......k.r..J........4..(.D
...M.....3.U*UY.......r$..0W...|...c./]:.7..^...... '. n).......{.q..V
3<(y. ....E.....X..Tl.!..X.C............Z`y..}..='I..K.....M.y.w.vl
4..6.4....Q..w.~."P..s...........;..O.n......k..3....S|..Qp.....y1h/..
.".50.C....0e@10.=Wl.Vf4. ......b.!x.B..rP.........rr...f....%n..NP..2
..NR..1%.DvW..!....vaCcnri..J`W.[.HV.b1......8.=`."p6../.6...%.Rb.R..&
lt;._...@>..E$..6..V.``.W...B.;..LUw..j....;...... U...............
..(.w._..Wa...t..<d....\{&....`Tb........x..8.....=.{>a[({....v.
..D....6:..eY=.....@....].W5..p\....P...WoP7.........q.`Kk...c..B v.5m
..P.../........?....tqc....*...Mc..*a..w:.3.F........:R....|......._. 
...~U..fOC.f.....q.=..Rn.de...~....].....kD_.....E....C.....R....@9i.x
Q.0.P.%.e.....k...l..Q......"..C..&.....-........6>.@...@.L..n.....
\AY.kQ.S.[.!7.....N..o.......7.[..9...O...=9....(....{..)k._.p....
<<< skipped >>>

GET /images/head1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 25780

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-64b4"

Accept-Ranges: bytes
GIF89a...................w...35.PQnAB................%(~-/8..K()......
............|.....e...lp.........t.....l.....d..\........T..L.... x..D
..h..,$%<..X..4..,..J..$..8........(................,..............
................4D4.......................(.....H.....................
...(%.....................)..<............................. ....m..
...X.........O......X9...........v....l:..|.:".....l.H#..b...'.H..k.(.
..O..U.........|....>..0........?.$.....i..|...8.,...U04..X..9/-...
.#.<...yw....'.D.....T.....L.....|..t..l..d..\...'.................
..............'......... ..:24...FD..............................|..t.
.l..d..\..T..L.....D...........<...........4...........,..|..t..l..
$..d..\..T.....L.....D..<......*),..W...C@$......>=I.....a/....H
44.ccWGG...H??...dYY............!.......,.............aK...9....L...C.
..>L(.....-ZT...C....#...A.2".[.N.C..GB..1.K..I....`..#}....... u..
.r!C.7..|:.bS.OaF,x..6h........w...k......L..'........J..G....H(..`.:I
.....ch.L..I....A.7v6..5n..c.&......j....T.U'b...'hh....<......QcV.
.......(p4h.T ..n80.....,i.45.....Z...t..x..^.gfr..-....cj.KC.|#q^.7L.
.^{..ZL..._c`.u^e.=..A.(c./o...7.5..h......agb`M!..m. c.x.qs.W....t..4
.m.0.N3.-..l"=w.WC.E.U....F....7&A..H.5..z..D.4....q.4C.F..._.D..../.H
..(......3.2.R.\:7.$ZmmZ.SP.6..g..g’`..&GR..A..E.JQ.f.k1..M....RjXb.
XhT...7.$.3.qo...6h...@..T.F.5.*f...XF.!F..>.....J......U{..e#8/HvC
.:.....@..C.8s.A0.H%AM...u.>...*.f...*.U.^...z.p..1..*./.8...h.Z.^T
e.......u...]..qC.N0..U.....TXn......&C..P../.@.//@g.J.Y.lz....S.*
<<< skipped >>>

GET /images/bluefox/misc/navbits_finallink_ltr.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 576

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-240"

Accept-Ranges: bytes
GIF89a................~*#....)#|'"~)#}(#.,'.($.*$|*#|)#.,(.,(~)$} $. &
. &.)%. &.,'{/)}/*r1(q3)p2).74r2*s4,.IA_@/XG3YH4TJ5.yi.......*(.*(.,,.
 (.-,. (.0/./...-.*'.53.10.0/.... ). ).--.,*.33.-,./,.11..,.//.0,~0 .1
0.0,.2/y5/v4-p4 s5-.PMl?3bG6^K8UN:..|HK=.......00.53.54.53.11.--{61MN&
gt;...EFBDDD..........................................................
..................................................!.....[.,........@..
.[........[...?..&...$.8E..[.,3S1.TR/."..KC7..WL...N .....!Z... 4M.PY9
.5...=......>I......#..*(.'.....[.)Q-.H-2U0F.[@.....O.6G.B...\P....
;..S.C....-T.b...k...;....


GET /jpg/newofurmatn.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 1507947

Connection: keep-alive

Last-Modified: Thu, 09 Feb 2017 19:56:56 GMT

ETag: "589cc988-17026b"

Accept-Ranges: bytes
GIF89a..z..........999...CCC...nnoRRRtttMLM......222..................
......ddd^^^.........X..s........&&&...............hhh................
.....WWW}|};.....#  2.......................H.........................
......................................................................
...............922......YWX...LBC.........|}....QLM...*(*vpq...*  qqqo
hi=;=...eee...wwxzz{c_a......s........iii...ljk...`aa...rrrQQQ...HHHll
m......rsu}zzVRTzxxbcd...B@A.........PPPTTT.........YYYXXX......fgh866
...QRRWTV0,-UVW............gfh...fefZZ\..................cbb...JJJ>
>>............FFF...~~~...'""...@@@.........444......666.z|.....
.......###!!!, ,.........%..ccc.......................................
UUU..................fffkkk.........[[[............   ................
....................!..NETSCAPE2.0.....!.......,......z........H......
*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....
H.*].....P.J..U ..X.j......`...K..Y.V..].....p...K....v.............w.
.... ^...c...K.L.....3........C..M.....S.^.z4...c..M..]..s.....o.....N
..q... _.......K.N..u...k...{.......O.5....._..<.....7.~..... .....
...._...h.z......R.`..F(ao.Nh....Va..v..d.~(..$..b.(...Z'.."k3. ../..b
...3...\...3..#....cl...B.=J...@....1..T.@6...G..$..b.$.V....Z*Ee..q..
.<...u?B.f.1..e.y.Y&R3@...[....QV..Ou.y..T.y...Vy.R_....2^j..Q....}
z:T...Z.w_B...9...........E.'.."...K&...T..#.L..j...Z).k..kR..Jhjn^..P
..z&.6..(...J%.2...VX*.).N.Z%P.......KT.K.[.......Ku.'.aA./K...$.7..o.
3..p..^[T....Z..M....Z..K.;.../...Ob.......i...|.....s..v*....$m.;
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.trust-provider.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: 5907E30F032C051F75CAAEB6ABD5F2B380B5ACAC

Cache-Control: max-age=333552,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2017020
7123043Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.CR.?..........DN....20170207123043Z....20170214123043Z0...*.H........
.......,.....y...{.J....<ox.*{.`rU....=.1.v]'..Tq.V.....O.2..!....s
..!#^..DGC..6.Xo..h...}...>..q...*Z..[[....^r%.1......p~.K...}..<
;.....H..X"Z..A..&.....x....&..O..uN....4"..l...i.W..? ~.....A?..]..ZX
.h.........7..$......tv.N&."_].b".....Qr...........'I.{..m@U..

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEQDKocXPk7YxqrHoH1imS68J HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:41 GMT

Server: Apache

Last-Modified: Wed, 08 Feb 2017 18:34:57 GMT

Expires: Wed, 15 Feb 2017 18:34:57 GMT

ETag: 35B3F2D38FB07E0E4D1650824751696EF02E7821

Cache-Control: max-age=441795,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 281

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0.....0..0......@.ag...qO...,o.. v=...201702081
83457Z0t0r0J0... ..........3.....>v..1.9S......@.ag...qO...,o.. v=.
.........1....X.K......20170208183457Z....20170215183457Z0...*.H.=....
I.0F.!..JB\.1...3....0k.rw.v.......&.7..!..dW..:..S..#.I..I.]".A..a...
K.....

GET /clientscript/yui/connection/connection-min.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-2d54"

Content-Encoding: gzip
eda...............r.F.}.B....0.=.f#..@H....f<.IiU.,Z....._J.....4.9
......O..s.t.........~IZ.\o.w......e..o....r.....V.3.>...E.nE.....Z
y...E...~.Z.|..nI..wx....%k...t[3...9...r.<.w.8..$..............M&f
N...'q........Ut.N..0.M.e8O.,Y........52..W.>...G..3.f.-=....p.....
..U..~.a.6..m..~...u..1.#i..M3._..6..A.O......$]..i..90..Z...f...n...D
.>.........i....Dy.d~...8#....%...*..l.g....B"Y.ca........=......Qd
..U.O|..:."...Wx...M....6......~..@...?.L....H..."..1......P..v.f..@..
.c.T.7.BStj....M}...@...d.S......@F.[_.<.i..w..cr....`..v...p..@...
...}?..n.i4..m.........]NH.#...\.<.q.......3........,...|.2.'.u..8.
..`z....8.@W..v.[)&y...bX[......5.......^..[....$ 6.!..tc.H"L._....(..
s.eo...a....<}....Kr..........y.....o..(.T...<.gV....g..H..`.@T.
.@.o(.WN4.H...Jp...9...r..$..H...)...A0.p(-.P.........v..z..@...o.2...
.7.8[.....[.q.s....{ u...j....P.')..$.m...cm1(hm.].D....{.;].UO.}....*
.oq.].U .E......G...;..v...8$.@.).^.o?O.O0.5...\F.......X$}.86U.j...5.
7sp6=.  ....B../5O.....s.Z.I..!z......p.......w~.mw...5...2.... ...a.G
..F8........@b.b.S..._....a...X..`....@.\..oo.V.........'..N../%S....I
9!..:.}J..=.s!.EbF..qq*<[.N...).k..FO...N....6h..&.6.......^......a
.Pa|l).z.y=A?UT.Ef.g.t...."....K....&:L..v8E....C....k%~..7H...O.v....
..ck.......BC.........Cm.wj.AH..]......c;..e.....v7..v..8_...C..b...#.
4. .S..,.#.............IM..........X..b,}_u."}....Bwqp.kH.h.h.w.......
..1&.rI...~...r^U................L.VQ.......Rk...\..G...Z.q../0......V
..2......."..A.W|{Z..6.v.(...\.)....<eF.x.p....F...Wk....a.m...
<<< skipped >>>

GET /images/bluefox/misc/close.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 428

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-1ac"

Accept-Ranges: bytes
GIF89a.....?.....j9......./..<..KJ.zI......zyy....],....PP.......S"
.6...S.mml]]hff.......N.....nn.SS..........,..D..M1....&.. ...........
E..>&.X&.;;.*".K..Q../..``....77..j...qdd.80....?..D.....J..mm.....
.!.....?.,..............f...?.K..!{...sD.V0. !..&"..B..$..G..L.$Y .r.,
....z3P...(...\?.,.... .....H#.*. )....NB>.". ..3..Is.......G?.....
<!!.%;M.....0.99..../.)%..0!.(1j.:. ....  ...8.%.'.....6.....'..G..
..:,@.`....Fh.`.G..;....


GET /images/head2.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 30760

Connection: keep-alive

Last-Modified: Mon, 29 Sep 2014 11:30:44 GMT

ETag: "542942e4-7828"

Accept-Ranges: bytes
GIF89a"....................)..{..........dY....C;...vupw...........7..
f..F...#..JCV..'...........................pn....~w.......... %.ZS....
..*))....jd.zs. ..kd....|y.......sl....QK.un.'#.94....72..........HB..
.._V.............0*....3,....C=..../ .UO..............................
.......HGc))............. .gBA.`[. ..(/......................# .......
...............!....d.....|}{..................!..NETSCAPE2.0.....!..X
MP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c01
1 66.145661, 2012/02/06-14:56:27        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B65E0B12B647E411A
4ECB674E47D8C8B" xmpMM:DocumentID="xmp.did:E2D2E1FE47C211E4AE82A20A9E7
72400" xmpMM:InstanceID="xmp.iid:E2D2E1FD47C211E4AE82A20A9E772400" xmp
:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:B65E0B12B647E411A4ECB674E47D8C8B" stRef:doc
umentID="xmp.did:B65E0B12B647E411A4ECB674E47D8C8B"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....................................................................
..............................................................~}|{zyxw
vutsrqponmlkjihgfedcba`_^]\[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;
<<< skipped >>>

GET /jpg/GX1OvJc.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 302184

Connection: keep-alive

Last-Modified: Sat, 27 Aug 2016 06:07:26 GMT

ETag: "57c12e1e-49c68"

Accept-Ranges: bytes
GIF89a..x.................K...fRu..YV.3J.........[..s......a,..I....rO
..U....)0.l................u.....Klr1Mi...P..l...EiVWX ARvvw......bdew
..K.............0...445.....o....J'....O6ACD.{.$%%..6......CWp[.uh..h.
....0'.RD.[.u.y.............V.....9i..n..........dT..........wi,.....-
S..V...EOl...!....sd.R..... ....Vy....o.u,6.......<..........T....-
.."57LF#*........$..............g.>...S..u........vpIQ.............
.x..cX).....Zp....s.....:0ajDg]..Q.3)...~HTM..'....)....cc...*{.l..s..
...FRW.......(::.]f.#.....:...e...lAEHV......D..4.OK.........4;kkm...,
..ew|c.....q...y....3Y|../.=3r.7a6.;4.xVl.....E....Ei..A.{.}zc........
......@......X{nWCS.............dp..... M..;#9.19a..8i_.\.1).\WA..!JJJ
;VO......................................................;......!!=|..
@....n...`.......!..NETSCAPE2.0.....!.......,......x........H......*\.
.....#J.H.....3j...... C..I....(S.......0c..I....8s.......@...J....H.*
].....P.J..T ..X.j......`...K..Y.V..].....p...K....v.............w....
. ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s.....o.....N..q
... _.......K.N..u...k...........O.5....._..<.....'.~.....#........
._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...Y'....0R.b.4.h.P3.
...<.w^.@.).M9.i..#....LN.d.PFY..RVi.}T^........`..e.d....f...ph...
......t.&g.x....z...c|.)....J....eh..6....F*.m.Vji.^^...rA......i.....
...........I.......J.................z.K..s....j*...a:...ZJK..QZ...Hj.
..Az...:.K..1....*....I....n.K.................b.K..K.....)....9....IL
...Y....i....y.....L...................L...................M......
<<< skipped >>>

GET /jpg/gdtmvRl.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 127641

Connection: keep-alive

Last-Modified: Sat, 27 Aug 2016 06:06:42 GMT

ETag: "57c12df2-1f299"

Accept-Ranges: bytes
GIF89a..x.....^........$j..d....%/...ccc6..d...........U[ity..........
\\\.......0.....gkg...........RRR................|.MMM...|||......2Ji.
.@..7...222...qqq....$..............PT   ...<<<Vd.AAAo...N.kk
k.5.[cu..8......   .t... ..................P......e......Q...-7Q......
...e..........H.._..M...v.....;DX............&p.,L.....>X...fhpm...
......J_&........Y..BT....Lm.$,3.b....(......s..yk.............(RGLZ.*
E>4.'=m..&..).d.679.......$V..Z.............=..............t....H..
..6cu..)o.3c.2u-./..............:!M.BUf. G...=..........$>`..|.vvw.
$....PT_~....... ...S..5".....0]....?m......WWW...&&&..b......D..Xy.EE
E....W..<>.....=.v.......ho..... \... .......O.........fX.......
TH......................xf...............2.........III....!.xlr.......
...{....f`v......B{.....&..........!..NETSCAPE2.0.....!.......,......x
........H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.
......@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v
.............w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]
..s.....o.....N..q... _.......K.N..u...k...........O.5....._..<....
.'.~.....#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...
".....0..@..P.b.8.HY.8.Q....(...1...4.I..L^f..G2.d.TV.L.s......]z.P!..
.B.. ...V..M.....K..ns8...R.U..~..Kp.g...Dm4F....!.....z.k.B....0i.&..
...mM.I.B..r...Xh..r6B93@.s.C...>W....em.[...........V....(....m..#
...Z...;......"..NP...{..I.@K..-Ry..F..wk.\.......r..:[_-...F8...s...J
.hr..M.A..mi..M~.qU.B.P.:.........M*.2.J)............V.^...3.Y....
<<< skipped >>>

GET /danger1/head4.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 404 Not Found

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Content-Encoding: gzip
bb..............1..0..w..pv.i...........9.@.....{.ZA.........6u^.g...R
$.<....H.vt.Z..(..d.!.CcZ............F)l.....'{........W...*?.>.
.....c....v.@".....p8........!....}..#.|a...G.:..J..\;.....0...
...


GET /images/bluefox/gradients/gradient_tcat.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:47 GMT

Content-Type: image/gif

Content-Length: 1453

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-5ad"

Accept-Ranges: bytes
GIF89aN."..H.^.._..b..c..g..j..k..n..o..s..v..{..~....................
......................................................................
..........................................  .$$.  .22.44.66.??.BB.DD.I
I.KK.TT.VV.[[.]].``...................................................
......................................................................
...............................................,....N.".....G......F..
.G....F...E.E........F....ED...C...C.........B.............?.@........
...@?.......A.><.==<..................;9..987.......o`.......
#a>..#..A....22..xq.F.5B...Q$...7..(2...-m.......7].h.S'N.9}....(..
>..=.....F..0..*..)......W.*.n..V...g..M!v.[..iY.`A..\.!@....o...C.
.<./..!...1........L......X....f..?w.p.4.../.V.!....c...A..../[..A.
....C..!.o..../.......?g.\.....g...;o.....O..x...7h`.<.....o.......
...`A....(....h...*.`..6.....P...Vh...Nh...n.!....a...X..'............
".-...........H..?....6..c....@..L29..G....4..#......3r...\....0....6.
.f.7.0..C..'./.Id.v.y..7..g...H......./2Y....j!.K.8h..R......h...h...z
.....:j...*.....@.."......j..F....6._......... ..>.........0....2.^
....-..u....Z{-}.P0......u..;.t.B......[..6g...V..... p...;p...,0..(.p
.....l...V.j...Y..s..l...A.$.L...i...&....-..2n0....1w.r.,.L.....s.-..
X...-4.G..W... ..TW-.a.U...!\-..T_.u.`..u.S.=6.T.`..%.`B.%.M..&.]w.t.m
w.r.m7......'....(.....#~.........-...7N.../.....>..x;..d.7^9.y...a
}. ;...N8...N...3&.. x..`..V<..#O..%{ <.y1.<.......g.v.....&g
t;clk-.....<.j/.}....;..
<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Dec 2015 18:30:0

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj/6qJAfE5/j9OXBRE4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.trust-provider.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:31 GMT

Server: Apache

Last-Modified: Tue, 07 Feb 2017 12:30:43 GMT

Expires: Tue, 14 Feb 2017 12:30:43 GMT

ETag: 5907E30F032C051F75CAAEB6ABD5F2B380B5ACAC

Cache-Control: max-age=333551,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2017020
7123043Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
.CR.?..........DN....20170207123043Z....20170214123043Z0...*.H........
.......,.....y...{.J....<ox.*{.`rU....=.1.v]'..Tq.V.....O.2..!....s
..!#^..DGC..6.Xo..h...}...>..q...*Z..[[....^r%.1......p~.K...}..<
;.....H..X"Z..A..&.....x....&..O..uN....4"..l...i.W..? ~.....A?..]..ZX
.h.........7..$......tv.N&."_].b".....Qr...........'I.{..m@U..

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d3c023c39da32b5569398126e9bf47d9d1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6ad45659d8-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d3c023c39da32b5569398126e9bf47d9d1486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b549f59d8-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTOpjOEf6LG1z52jqAxwDlTxoaOCgQUQAlhZ/C8g3FP3hIILG/U1Ct2PZYCEEWskcoIS7heuMrZ8bV/pz4= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca4.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:41 GMT

Server: Apache

Last-Modified: Fri, 10 Feb 2017 05:48:52 GMT

Expires: Fri, 17 Feb 2017 05:48:52 GMT

ETag: CEE8475F3B689BDA381668010AD1794EDB42BD6B

Cache-Control: max-age=568630,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: rmdccaocsp29

Content-Length: 278

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0.....0..0......@.ag...qO...,o.. v=...201702100
54852Z0s0q0I0... ..........3.....>v..1.9S......@.ag...qO...,o.. v=.
..E....K.^.......>....20170210054852Z....20170217054852Z0...*.H.=..
..G.0D. Q....;`...b.A....?.Y.E...v....... =$.w?.....v:..s..m....C.....
\..M..

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Cache-Control: max-age = 86408

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT

If-None-Match: "8017f9a85f10d21:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.download.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Sat, 12 Nov 2016 01:34:12 GMT

Accept-Ranges: bytes

ETag: "02e4de843cd21:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50939

Date: Fri, 10 Feb 2017 15:41:41 GMT

Connection: keep-alive

X-CCC: FR

X-CID: 2
MSCF............,...................I.................kI;. .authroot.s
tl.6....7..CK...<.[.........].y.Q..YKv..%k.....!..H!.Q.-..$tU$.)7k.
.R.=...n3......}?...3gf......h<.2...4.(q..f......&{.`....02.s...2@`
.J&#.<#..q..0Xy%.4..egd.:M.B....in.([....W....(.|.....|....s!..Mo..
@......|"(n;Z..'~DE.}(........Mz:T....x..{..n.`z..-.\.............q...
.ld2z..N/.b.J...........X.S.:UN.S.v."..'l........:yz.<."!.]O..6.:d.
....C.P ....P($.Y.Q y..y..B....u.`...u.00.....|(..A.J.Cp.c...X..g.....
....}..'........D.QVFf0...D...a6.f.0.....k.*8...<.;..o...(.....f...
L.0..C.......I.A!.H.....'._)....Qc.V.....5D..,..d../(..j.F.d.....`..f.
..$>:_%.W..(....@.r.9..Ob.e.$..m.~.]....g.......%`e_..&Qhp .......e
y.c.....H`.%<9.......#.\S...R.5....v.......dWE.....:...../"3.._..l.
XiH.J!..............{.5C_...i.U....7....;p....Q.`....L.j........u....b
.`:Mk.L.......*..@M^m..Jv...g........<d:l..Kq.X...*y...x1.u....... 
.....z.....c.(<.b...l.#....,z~..M.Y.]..Z....F..N./..[.#....Ol...f.k
........U.rF)D....3..sK...`..W.....5.=.@#a....!./....>...g.(. ..9..
>!.K..e..j..{x.0.^,...U9..ru.C......,..q^1.G..A.e.F[...".1..*...^..
.L..#:,7...:.z.n...fI1.....l..E.q>......E...x n....H....t....5.....
\...<.l....7}.`\..~_..#..Bz....i..[{.w.....a...c....E w?..6..l.....
.x8..H....7.e.;.%.:.!.*Q....#..bT.......(....ka.......B..|.........1..
..t.r...fk....C.t`....@3.P..*t..nmD.....8$.bd..`D...5X.....H..L../1:..
Ap...w.\...,..U..../"X......}X...a...G....N.X..<....MG....r..H.....
_@..Q2..T...Q.....].e.G./.v,.Z5ib..5........9 ............z..!...g
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.10.2

Content-Type: application/ocsp-response

Content-Length: 1454

content-transfer-encoding: binary

Cache-Control: max-age=478809, public, no-transform, must-revalidate

Last-Modified: Thu, 9 Feb 2017 04:41:40 GMT

Expires: Thu, 16 Feb 2017 04:41:40 GMT

Date: Fri, 10 Feb 2017 15:42:17 GMT

Connection: keep-alive
0..........0..... .....0......0...0........FC..&..<.0...Y......2017
0209044140Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._).
.a..eR&.....Y.)..".\....20170209044140Z....20170216044140Z0...*.H.....
........\....4..M&...8#8d.)..F....oe....k.'4.......U...I......j?.....&
.'.......:.D.....[.t.~.c.{.g.^...R.?..aU9M$........l2.).gL...*.......t
.........E.y...Ff/.3..x.'.b...._....u,....G...].........r{........../.
..D...'.{v.I.F6]......SW|.C..c.qJHzJ/..&....~..:..........0...0...0..4
.......My_e.\....'....j0...*.H........0_1.0...U....US1.0...U....VeriSi
gn, Inc.1705..U....Class 3 Public Primary Certification Authority0...1
61122000000Z..171214235959Z0..1.0...U....US1.0...U....Symantec Corpora
tion1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA -
 G1 OCSP Responder Certificate 50.."0...*.H.............0.............
4..IP.....B..h.....]..).]w.!"..a..{...="....._...~.s1.E.......;...6&/.
..\2..A....\..T aH:.8lH^.....l.v.$...K=sZf.*.|.%.Pb.......B..*f.T\w.:.
s.... ....9..4..cV...3.qc.c..j<.f.....>1X.I...P%?.........5R-...
.Ca14..X.U....u.....:.z.\.k..b.E.v..,.J................0..0...U....0.0
l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.
. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-OFF-470...*.H.......
......G..\..R.P..e]...N.....m.....4f......b4"8v..b.R....`.Auz.........
.2=...@..........5..cWh....J......r...g.h......Kw'...j.@...x.....
<<< skipped >>>

GET /bannerov/leaksbannerov.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: leakswith.pro

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:23 GMT

Content-Type: image/gif

Content-Length: 2629427

Connection: keep-alive

Set-Cookie: __cfduid=d537f39d050a94905c11b5e67cb55cfce1486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.leakswith.pro; HttpOnly

Last-Modified: Mon, 06 Feb 2017 17:20:17 GMT

CF-Cache-Status: HIT

Expires: Fri, 10 Feb 2017 17:41:23 GMT

Cache-Control: public, max-age=7200

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 32f0aa4094ea5a20-VIE
GIF89a..x....................................."..'..8..-... ..!.#!.*#.
3"...'..!..$..4!.!,.!:.!."$.% .% .$9.*4.-;.(6.-9###*%%&(& )&$&)*')%*  
  4#%2,,9%'#,3,.1#.92.2$2< 38333;;;76:01.H..X..Q..g..x..q..H."W.#h.
#w.#|. G#'V#(N36k(-L!..)G..D.4H.6X.;V..Q'9G9=D%>S0;M.:f.:k..JB>C
X=Bn<C.C\.B\(DY3GX4BK.Gh.Ku.Sz.Gs&Jf'Ux5Yw.Pk8a}CCDKJLHEINLQQNRSRTY
VZ\Z\WTXQLO]\aHWka^bz\bdbelkmhfjnmqqnrznutru|z}yvzqmrdW^@A>........
............".")..........59.=B.[`.JO.<D.X..\..R.%[./]..d..c.7d.&f.
6k..g..Y..j..u..m.$l.(s.7v.%w.3v."^.~|.mx.Fy.Fm..{..t.${.,z..{..V..~..
|..|..{.7.....`........'..%..7.................'..'..&..2........%..F.
.G....................................................................
......................................................................
..........................|..!..NETSCAPE2.0.....!.......!..Resized wit
h ezgif.com.,......x.....#....#(*((%.%.#...#%.....#....%*.7*..(....17.
..*44.//*../11.....7..#.'.......*..(...)4564..../41,....6.465..*/6.1..
.'1............:W#]...Z.......7jH..oX......!.#.P..$x..Z.?.;..hpb>..
..D).&.....C....?<.UT.!..w...<..F.L.R.3.meIa7;..q.'....I.W.E..b.
....-Z..............B. A..Vm....c..w..%.8.......C..^...3U.....'.......
...4.hR%..5I 0 .....G.......%r..v...}.b..p..q...".xm..l,.W..........f#
..P........... ..u...9..z..T...@..0..B.V...B .... %l0.H....H.P. .....#
......L.H# ...!....*.`....t....D".n.t.H.-v.....C.1...H..(..!H'.......P
..*.M9*...<.<.....iH)..$T.1,....Yw.... .q..DC.Ba..h.L5UE&.d.P.."
.Q.h..,TJ.bi ...d).5.67.6BK.NV.:..&.r.m.XyO.h.bn...H%.......JZ.ueC
<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.ie.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: text/css

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-d65"

Server: cloudflare-nginx

CF-RAY: 32f0ab8de6f1595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
31f.............V.n. .}...T..[,...-....8F...\......c...6......p..Dsr..
.. .9...KaF.*..l.1...,c..G..n...,....KbTrC.>..<j...q;...,.E.....
-4.7.f......o...uc.k.Qk.I.B....XG..4.;u....4.@-..T%...$...2^..*.2.$CC.
b.)kv(l..;,....2.....U.Ka.a..o.........s.).R..&.^0.;.....j.e.yh...h..X
V./..g..S...c...I.....}.....h.QS.!...3..fT.*cFq...\.....9.g*...{.(.?..
...v.Ja..L(.&..N].kn.=...6FV.*YE......H.....IC|...m..P...9....y..Ki..!
....7O.7...m..*.`..-&..$Lp&..D?.....]JN.-....J..;M^&.u.?..T..5..O..}..
.p..rjG.... SP..@X......T'..M.i...!5..-.....|T.......h...........J5.0.
.C.yP....Y...}.f.6....Sr..r.l.LJ..&.Bz..... ......"..a.6._..m.c.......
].....}...B#0...hd.>Q......K.U.I..,;......>X...\0..(....T.u.g...
.....!.I.&...t.b...D..1d...a....R.Y..:...r....N.....\...h...}.)..h....
g..........~.3...P....FM'..@...;.us....E..e.....0......


GET /cdn-cgi/scripts/cf.common.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/javascript

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-1138"

Server: cloudflare-nginx

CF-RAY: 32f0ab8e171e595a-VIE

Expires: Sun, 12 Feb 2017 15:42:17 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
7c6.............Wms.7..,....j.#z%{.I...K.6..t......P...6E.H..E.......v
zs..,A.........h[..h.p.o.riMw0..._...!.......m.......Z.e.'....GJ-Br..g
1\./..'.ff&.....`@z.#..\..a....r..S.2`....A(.....;......0...xL...@j...
Y.2s..U..r.Ri/@..r..K4.3"."..h0.U..B...%.].."...K....x..).1.l.n@.-Lq..
.D(.OV...}...a  .C...LjL1...v........0..0_H.y....Z}.....iI.A:...'T....
......j.1)...h.pv...y...Iq....#M......4.../...r.$.........>X..ML...
....X|...E...U........Z.zx..'..*p......d4.n.d8.*-....JQ..4?.d..[.0..v.
.4.UMa.|.......@.Z.. HC.....)..z...B..z...&n..>.....g?..nX........`
...3..1....!.`.Y...^o..<Jg..9......}.u......@FS.}.....'f..h.....|..
......d.DHV......'...o#...Km......L....'.m.M........M..j...:.(..9.....
.T...I$u....L.p9>q....a*..!.t...r.I.u3~.n.k.wi.2v...}P..YG.........
...X...b<.!]......t.KfK..St"L4.E(.=~....J.$w/.....e......2..OO.:..i
X..}...b...J.Nl.....nif..v.h.e.2.q.B..wb.n).K.x.......N....xQ.u..J..w.
~...iz.....`/..#Z.N.j...G.....r..V_...a|}9.....~'.B&...U.cm..Z........
.4.... e...U...N.....r&..d..[&..3.BA.8&...M.rLXNj92A7.`H.sE_..V.FQ2.T`
.....\..?.i[....x.l.....$s%.6.NX...%m.V.~.y..g...Z..ai.R.Y...2W.s.....
......t...&..(..jn..n...<..'..Ger.(......:.{_.....o.!.6...........=
.....j........L..p.....Qs.g...r...8.]...?....X....y.2 ..=..<...i..x
....y4.e...8.....~4....K.k.1.....Ia.....0..=...P..U=......z@.\I..R....
K......W9..H..X......A...-..t.2.........v..GB........Q..-DQ.Y:.\......
.Z..of"\C..G.. ..DQ.}(.&.;.(Cp<*.M.F].=w.<"R...!..c.|@...]9..>
;B(d..o@yp(.....i...N..b.........;.w...M.X......{...h..&(]=....a..
<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-300.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-48ca"

Server: cloudflare-nginx

CF-RAY: 32f0ab8ef7d0595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
48b7..............SX%...O...m.6'....5...ms..LvM.l...j....w............
..... ......@d.<.............e.. `... .......(..../....2....`.p.P..
...W.'....p.....^................... ...l...O.....Yr............Q.... 
.%......l..L:.&#.-.......5.I{%w..?*.!...L...-\4.g....;.T.:|.....J.....
f)....j.5...I.>zQx.d[.. .(..|.Y.6.....%.....6....g....u7.....2^....
a..jP...,........zL......O....Wqr8g.S.\eZ%L<...P."...'..w..Q..!.R..
,.....H...e..l....._q...(;..2v.%.:-.d.{. ..{.kY9.[.8...0..!../.V...X..
$P...#-A..T.|...r._.h.*.W........Xa..~t%D..x.,&..-.C....&....>.....
V..c..<..Li.R...0...V..s...?-T7.^...L`.^....7......7...me,b..m.l.~[
....&.^.>......uA...?.B..2.....-]..C......Z........ow..t......a...F
.NI.?...n..\.uc.*a.....:f.bW'K.vI6.:P..).)..".e......mp. 4...2.......b
.....a....#.t..).>Z.....-....T..P..V.x.(....T...F"R.- .........P..h
...[.._...%.5mt.F1...M.......V.../K.C..%..z.b(..|<....n?N|:l..S}.d.
...4.*9..^=.0AxE<...M.7a....D....MZ..2.o..`>t..G....Y.....`.....
.P..R.... ...$..#...b....8D...7lqy..N'M....'...~/e..HvHE..v.cW. ..JO.P
]...... ..TW0X.:j1t...)#j..p.H..l.5"N9.G.D..-Lvk.}..ZW....O........8..
.....P...~.X&V.'.&k.a.:..33 ....(.\..1.Xu......".g..0f..6Y..V....{}\mk
..{<.X[H^w3_6V.A1...\g......7t..4..Ia6~U...dt.@.pL8...Z.l....8.'.("
.~...D.8{A.v,=A..A....>W.........p...2..,.......B..@...<....Y.KB
.....R.......P6.u0.....2..&.`......m.H1v.P..qV.Y1Q|.5.`....h...E..]...
..q..I....~..gAsg.9_....:V..}.......C v.]H%y..I.h....i...}Nx....m:{..C
i....<q=.[l.Pt,:.m.."..|.z{.V.2ur.b.NAB.2A.H.,._S...l)...{) .$.
<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-700.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-4d50"

Server: cloudflare-nginx

CF-RAY: 32f0ab8f702f595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
4d4e............l.ET....waq[\..../.....I.w. ......;......C_.K_..2...\G
]...U....p.....CCF.G.......8...PV...l.A.P....;.....$...........6.W....
........2@...p.X..."........8...W......p........?\.@RKN...........L...
.....Q...1{%....T:B.,..<....1..........a!...(..4}.^\... n..T].K1J5.
V.B...l.yFA?.ZG4M.X.OuDK#U.!-..].."..&^..=..8....|....E.....B...U..2b.
.|.i ..y...p.......:..j.......E.[..~'.:..~......0...A....L:.%...A.$..M
.s.....r]...~j...Q......V.o=......V.g.l.Y....;^...x.....u...&.....v.Y}
...OE....6O@s;....<B..}yd...O..&..(.l... ..S<..U.V........f.^.G.
.-T..Y.hD...P .%...4...........k.....DW..`b..JE....*_...8....YBT<y.
..}....uU....N..._..EiI..{........q|..5;..."..^`c.._.K./\,...}?@....,.
O.?..m....)...(..sP.N...JX.p.....fA.'P..],].. .h..(.F......E...%.:.M'.
.......I.m[.GO..n.Pi.S.8dh=.t...'2.d..=.ZdX.0G,....g..]...E....H..r..4
F.'..5...Y"...&6z)\{..2........5V<Y..I.rUP...:<E.OD..bf....#,.[0
.\..."...19...#`.. $=... hj.8R..0W..E...H.&.=..`..6*$.p|.....  .=.b.jR
,.*.B.....L....1z..J..v.....q....ZDL...?.....r...Ni|..!.7..D^$S....u..
....aB.j|$.......Y.Q..#.S.cT;G..x....&.p....D.....K-.8.n...ql..C.%._6r
 Oo..y.....Y^.....'..)..c._=C...cQ....... .....n%.A../..N.?..uJ^U.v^..
.2......b9#c.y..&..<.x.P ..1C..v.8...t....4...T.3..C._..OK...{X....
H.$..q.c.5h.g...w.~..4)r......x..;.v..TjM$.........;OO...:g..lk....F.g
.U.........p.N.._.._D7Zz.`............ K.GF@.tWbJNc...Zt.5..3......`D.
.../p...ur...C?.E..X..0.='......ewu.............5.*D.T~(...nn....?....
.O-..dT.....g..Z.....9^.h...b.q .......W........|.J...?....*.q ...
<<< skipped >>>

GET /cdn-cgi/images/error_icons.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: image/png

Content-Length: 16759

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4177"

Server: cloudflare-nginx

CF-RAY: 32f0ab90009c595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Accept-Ranges: bytes
.PNG........IHDR.............R ......bKGD..............pHYs...........
......tIME...../....x.. .IDATx...y|\U...$m.)..;.4..*`A....^....E)..d..
. .N...z..T.M@6.....HY..(.;.BY...=.?.I..&.....;...........<y..s.y..
!..B.!...u.A|t4..........)"...1..k._....p.V..q.....8.{...L...@'0.....b
.-E["G%.P`3`.....@...q3.x.x.x.x..X(.U$r9.6...;..._..{t.o......Jl.\*.r.
X`.`.`....t...O.....<.\[.....&....9.Xo....:..D.............../p.puk
...D.O.=....m.%.....m-..!..).....w.......|...ba.D._.5........BL.......
.......c.h....:/......Jd?....=.XN~........S.9=....`}.X..._....DNN.....
...LF...1...M.9~.....XY...-..............WY8.f..[...H..$^.p>.z. Q,p
.pR....<.x<..`.y.....[..7%...n......7...Z...$r....n.v.?^.)...b.:
.O..3.W..Hb/Y..CGs....}K...W`59.=W.G.4.....G..!\.)............[.w.K...
q......E.hn.....&'2.=..ig...%...[.g....:.[....%.v#.A...\...kCd7..W`y..
.8...&Dv.A.FCly......s}...vn..T{.....Z,.9...]...u.u..-...#w4...nT.....
.......$^.x.M..En..M..W}....n..5.X.B9..#_.V9.:gv4.l...EGs.....Zc'.s...
.d..$.R.U.X86...b..<`...(..7.&.].7..Ae....,..9.........%.DX.J.'....
.........}eS.Z}.w-.p.!..O..........4..|n...Ow{..)...tZ.$.;a-.....g.g..
Z...K.t..........O..#w4..........Z...J.}i.....Pw....=.c0..`...?...}...
.;.[V.........J...{.%....gx.?..g.K8G..:...3}.Z...NI.0.....4..N..<.x
..$..L..w.........-.{#rGs.......o-.....?.v.T..."q...MX..'.........M.}.
..../.l..\f..u.{.|.p.g...GsKK."....g.........g...../8..*...R......i...
!#....&..Z,.Wa..v.yr.%.!.Q......nnN."........gT..]..)..o'.[Q...X....1.
.=i.%.o.&rGs...;....b.....[....xL....\'...........T...xU..y..d~1.L
<<< skipped >>>

GET /cdn-cgi/styles/fonts/opensans-300i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:42:17 GMT

Content-Type: application/vnd.ms-fontobject

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Transfer-Encoding: chunked

Connection: keep-alive

ETag: W/"589b19f3-53af"

Server: cloudflare-nginx

CF-RAY: 32f0ab9050d5595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN

Content-Encoding: gzip
400a..............Ct$..e.b....m....Y.m.c.6:..t:.......?....z..F..`Z...
.@......"$.$4................C..@....)..@..=L..........`.p.....3.3....
(...6.[.'..@...<.f.G..........V.w.......vl.f......0..j......5dT..'H
.{..............2....Up...%..wgd..4...FAr.[.Y}......HM*J ..O.o7K..v..(
o2.6L3..(.h$[...BEy.;....\..q..O...\q....=*~.`n.@:.5J~ A..`Q.-..t)....
...r.(0.......m7.I.)...6........{L-..2oF05......O]..8....ZX...........
..0.i..!.nfA{.1..j<..le&..2...s....C..r.5.V.k).8o...&B...p3W..n]..L
.{..>.........2|....g.. ...iC...l0,..........8.!..9I..`...)%..l....
j...c.6.G..N5..?...........#.Y...-s.......wr.Ah....!......3...o.......
... =#..J.......Qu.G...8...4......'.z'.%sMD.x7...'59..Q..X.w.p.H.~.Pw.
..V.g..#....-/&.........%f$;!xU.a..&..&..D ...$....(/#.........'..O..!
......h.......q .Cr(i....=i...X.n.....tC...."......BX7.H..*.l....=S.".
.r.>.S...d..7@n:..&.R.B.n.t.z.o...P3G.G..N....<.....[}"..r.-.|..
..I..G.|...6..........{.^....).}tc*.p.a2......t4.[Z..5. .y.....r....L.
.K..M....#....T.]..s"I.R .....m.....N.....sC..r......lF...&$.....Bx.Pf
....q.(...@D2....`..x0... ..d..7.....}.h.Vp..`.7.NR...-4...FrY.._J.(..
.x.6!.3p...Xwq.........(..Z.(B...V...0.U....Soo{DL2.....@..!la...;...D
(....p.(m]o.[kj2~.......=....{.....&./..j..b\.,.:C.....r$...|x.R.0K...
,......E.<._N...{.z_..(^..D....7....Df....L........m;S.\.w.E...<
.......{q._.3m..r...6B..C....@C...}.tD....k.2N.w... '..*..":US.....5..
.1...-%..jx.gYc..&....k.......s.nJqwtc..B.....?k.m..]31G.n^./.'M..n.$(
....}...."qA.A......I..Y.j..%a....L....e..$oG.T....Qy.$./....E.tS.
<<< skipped >>>

GET /cdn-cgi/styles/cf.errors.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-6eeb"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=80; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:17 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-6eeb"

Server: cloudflare-nginx

CF-RAY: 32f0ab926228595a-VIE

Expires: Fri, 10 Feb 2017 17:42:17 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/scripts/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-17bdc"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-17bdc"

Server: cloudflare-nginx

CF-RAY: 32f0ab92a250595a-VIE

Expires: Sun, 12 Feb 2017 15:42:18 GMT

Cache-Control: public, max-age=172800

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/styles/fonts/opensans-300.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-48ca"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-48ca"

Server: cloudflare-nginx

CF-RAY: 32f0ab93028c595a-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/styles/fonts/opensans-700.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-4d50"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-4d50"

Server: cloudflare-nginx

CF-RAY: 32f0ab93b2f5595a-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
....


GET /cdn-cgi/styles/fonts/opensans-400i.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenens.com/register

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenens.com

If-Modified-Since: Wed, 08 Feb 2017 13:15:31 GMT

If-None-Match: W/"589b19f3-52dc"

Connection: Keep-Alive

Cookie: __cfduid=daf09d50338950f0cd4cfee342b1fef291486741283; cf_use_ob=0; cf_ob_info=522:32f0aad1818c59fc:VIE

HTTP/1.1 304 Not Modified

Date: Fri, 10 Feb 2017 15:42:18 GMT

Last-Modified: Wed, 08 Feb 2017 13:15:31 GMT

Connection: keep-alive

ETag: "589b19f3-52dc"

Server: cloudflare-nginx

CF-RAY: 32f0ab93f32e595a-VIE

Expires: Fri, 10 Feb 2017 17:42:18 GMT

Cache-Control: public, max-age=7200

X-Frame-Options: SAMEORIGIN
HTTP/1.1 304 Not Modified..Date: Fri, 10 Feb 2017 15:42:18 GMT..Last-M
odified: Wed, 08 Feb 2017 13:15:31 GMT..Connection: keep-alive..ETag: 
"589b19f3-52dc"..Server: cloudflare-nginx..CF-RAY: 32f0ab93f32e595a-VI
E..Expires: Fri, 10 Feb 2017 17:42:18 GMT..Cache-Control: public, max-
age=7200..X-Frame-Options: SAMEORIGIN..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1769

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:12:37 GMT

ETag: "D897C7E78CB5282B4C0FF19C78568ACE591CC8A7"

Expires: Fri, 10 Feb 2017 15:41:47 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:47 GMT

Connection: keep-alive
0..........0..... .....0......0...0...I0G1.0...U....IL1.0...U....Start
Com Ltd.1 0...U....StartCom OCSP Responder..20170209101237Z0s0q0I0... 
........As....j....k..b90pi5..N....@[..i.0.4hC.A....j]..;NO.{i....dk..
..20170209101237Z....20170213102237Z0...*.H.....................h ....
_XE.....Z....&.k.$&...R......%.7...%'.}d...N..."..0..q.E......p3.4.w.T
.:0u..i.....c.m...O.].."mF.#.....z.3....k./|..m...8I.....p.~.r.2P.|..%
.....d..M.Z..P.,X....C...u..=../tB.......|:.w$u,........^(.]%'.......{
z,...t..!#.......z..0e1....t..=z....0...0...0..........t.P..M7O.">F
.v..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."S
ecure Digital Certificate Signing1)0'..U... StartCom Certification Aut
hority0...160920000101Z..170920000101Z0G1.0...U....IL1.0...U....StartC
om Ltd.1 0...U....StartCom OCSP Responder0.."0...*.H.............0....
......W.-..Z.\.....u..6.F~....~>IXqW..h)..{ .C..k.wL..e..{.k.o.....
...%...l\..=......b...,a....9..4.....6..'.h..ca[....[.>...e.vdpm..)
...e..-....6/.e...ay...T.c.}..a25...'A...x.S..<.#... ..xl....D....p
..5........L.o. G!....Ld\.!..)o..GK..i.w...b.....p.S.r.............0..
0...U........0...U.%..0... .......0...U.......0.0... .....0......0...U
......_tY."....!\.n..&..*.0...U.#..0...N....@[..i.0.4hC.A..0...*.H....
.........-..x5i...H...$Y.....y....2r.!..W]T....z.5..w^...[.1....H`..N.
..|.3...(d<.8..4..l.*.@...:.GV...........=.n.... ...y.WK.x..~1.%...
j....d..../R..p<.mR...Ii.%....d.5.P.Z.s.... ..p.7.W_.9.*.T.........
 ..l>M.=...w8.K~.).uU...n.Q.@^.cR.a...5X...]'.P.Yf...0V.3. ...h
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRBc6bT2N9qzRkeiWvn5WI5MHBpNQQUTgvvGqRAW6UXaYcwyjRoQ9BBrvICEGpdw+U7Tk/Qe2kepfzsZGs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1769

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:12:37 GMT

ETag: "D897C7E78CB5282B4C0FF19C78568ACE591CC8A7"

Expires: Fri, 10 Feb 2017 15:41:47 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:47 GMT

Connection: keep-alive
0..........0..... .....0......0...0...I0G1.0...U....IL1.0...U....Start
Com Ltd.1 0...U....StartCom OCSP Responder..20170209101237Z0s0q0I0... 
........As....j....k..b90pi5..N....@[..i.0.4hC.A....j]..;NO.{i....dk..
..20170209101237Z....20170213102237Z0...*.H.....................h ....
_XE.....Z....&.k.$&...R......%.7...%'.}d...N..."..0..q.E......p3.4.w.T
.:0u..i.....c.m...O.].."mF.#.....z.3....k./|..m...8I.....p.~.r.2P.|..%
.....d..M.Z..P.,X....C...u..=../tB.......|:.w$u,........^(.]%'.......{
z,...t..!#.......z..0e1....t..=z....0...0...0..........t.P..M7O.">F
.v..0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.1 0)..U..."S
ecure Digital Certificate Signing1)0'..U... StartCom Certification Aut
hority0...160920000101Z..170920000101Z0G1.0...U....IL1.0...U....StartC
om Ltd.1 0...U....StartCom OCSP Responder0.."0...*.H.............0....
......W.-..Z.\.....u..6.F~....~>IXqW..h)..{ .C..k.wL..e..{.k.o.....
...%...l\..=......b...,a....9..4.....6..'.h..ca[....[.>...e.vdpm..)
...e..-....6/.e...ay...T.c.}..a25...'A...x.S..<.#... ..xl....D....p
..5........L.o. G!....Ld\.!..)o..GK..i.w...b.....p.S.r.............0..
0...U........0...U.%..0... .......0...U.......0.0... .....0......0...U
......_tY."....!\.n..&..*.0...U.#..0...N....@[..i.0.4hC.A..0...*.H....
.........-..x5i...H...$Y.....y....2r.!..W]T....z.5..w^...[.1....H`..N.
..|.3...(d<.8..4..l.*.@...:.GV...........=.n.... ...y.WK.x..~1.%...
j....d..../R..p<.mR...Ii.%....d.5.P.Z.s.... ..p.7.W_.9.*.T.........
 ..l>M.=...w8.K~.).uU...n.Q.@^.cR.a...5X...]'.P.Yf...0V.3. ...h
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1816

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:43:27 GMT

ETag: "19EA21C5EC4190A4DC16E6AF38C1BC22119AC819"

Expires: Fri, 10 Feb 2017 15:41:52 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:52 GMT

Connection: keep-alive
0..........0..... .....0......0...0......0..1.0...U....IL1.0...U....St
artCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,Start
Com Class 1 DV Server CA OCSP Responder..20170209104327Z0s0q0I0... ...
.....Qh.....:U.`."....0=)....N......g.D..3....... .m..I......i.......2
0170209104327Z....20170213105327Z0...*.H.............~..Z9..]r........
.s..x>.HO......a.KUL`...>.Rn.,.....T&.......>,.}...oo.,...o~ 
X#N..k.Z...G8..b......d!................6..(.H...62.g.......w.D.r....W
./..cy3_..Aa.q....xh.oGI...Sc...%3.....P.8....T.l=l...b,..-X.N...FW)k.
...........;..e^I..f.f.Ok...$."r...|:.....0...0...0..........T...._fA.
....v..0...*.H........0x1.0...U....IL1.0...U....StartCom Ltd.1)0'..U..
. StartCom Certification Authority1&0$..U....StartCom Class 1 DV Serve
r CA0...161210034431Z..170330034431Z0..1.0...U....IL1.0...U....StartCo
m Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom C
lass 1 DV Server CA OCSP Responder0.."0...*.H.............0.........Y.
.J.?V..F.r..,.:..{{o@.O....$bC...s7!..J.h..T...jY....V..c.\$.(q.{O..L.
.u.X89U....{.K.?}..,(.S.>F<`].`...yJ.......2.v...&."><.f..
.....CK.....}.k.8...[....Rg.t..x...z....(..?..9xT..Z.\|}{........>.
........a.2.G.'..h....!I.....:..<..h...5.H$.\.>PI.....JY........
..30../0...U...........0...U.%..0... .......0... .....0......0...U....
...0.0...U......o...iOM...:...S....T0...U.#..0.....N......g.D..3.....0
o.. ........c0a0$.. .....0...hXXp://ocsp.startssl.com09.. .....0..-htt
p://aia.startssl.com/certs/sca.server1.crt08..U...10/0-. .).'http:
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRRaBWasZmbOlXoYMAiydUZ4DA9KQQU15FOAcSwv/jIZ5NEnOcz+q2TDK8CECCIbc7NSRKoi/mPAmncjMg= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/ocsp-response

Content-Length: 1816

Content-Transfer-Encoding: Binary

Last-Modified: Thu, 09 Feb 2017 10:43:27 GMT

ETag: "19EA21C5EC4190A4DC16E6AF38C1BC22119AC819"

Expires: Fri, 10 Feb 2017 15:41:52 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 10 Feb 2017 15:41:52 GMT

Connection: keep-alive
0..........0..... .....0......0...0......0..1.0...U....IL1.0...U....St
artCom Ltd.1)0'..U... StartCom Certification Authority1503..U...,Start
Com Class 1 DV Server CA OCSP Responder..20170209104327Z0s0q0I0... ...
.....Qh.....:U.`."....0=)....N......g.D..3....... .m..I......i.......2
0170209104327Z....20170213105327Z0...*.H.............~..Z9..]r........
.s..x>.HO......a.KUL`...>.Rn.,.....T&.......>,.}...oo.,...o~ 
X#N..k.Z...G8..b......d!................6..(.H...62.g.......w.D.r....W
./..cy3_..Aa.q....xh.oGI...Sc...%3.....P.8....T.l=l...b,..-X.N...FW)k.
...........;..e^I..f.f.Ok...$."r...|:.....0...0...0..........T...._fA.
....v..0...*.H........0x1.0...U....IL1.0...U....StartCom Ltd.1)0'..U..
. StartCom Certification Authority1&0$..U....StartCom Class 1 DV Serve
r CA0...161210034431Z..170330034431Z0..1.0...U....IL1.0...U....StartCo
m Ltd.1)0'..U... StartCom Certification Authority1503..U...,StartCom C
lass 1 DV Server CA OCSP Responder0.."0...*.H.............0.........Y.
.J.?V..F.r..,.:..{{o@.O....$bC...s7!..J.h..T...jY....V..c.\$.(q.{O..L.
.u.X89U....{.K.?}..,(.S.>F<`].`...yJ.......2.v...&."><.f..
.....CK.....}.k.8...[....Rg.t..x...z....(..?..9xT..Z.\|}{........>.
........a.2.G.'..h....!I.....:..<..h...5.H$.\.>PI.....JY........
..30../0...U...........0...U.%..0... .......0... .....0......0...U....
...0.0...U......o...iOM...:...S....T0...U.#..0.....N......g.D..3.....0
o.. ........c0a0$.. .....0...hXXp://ocsp.startssl.com09.. .....0..-htt
p://aia.startssl.com/certs/sca.server1.crt08..U...10/0-. .).'http:
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=dafb21e8c4237f866f7ead9a70dc4bf651486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b12eb59f6-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8DYx HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:30 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=dafb21e8c4237f866f7ead9a70dc4bf651486741290; expires=Sat, 10-Feb-18 15:41:30 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 10 Feb 2017 12:21:32 GMT

Expires: Tue, 14 Feb 2017 12:21:32 GMT

ETag: "3a8357a1df81b110dc1f69b5db989e6caac35287"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 32f0aa6b632e59f6-VIE
0..........0..... .....0......0...0........>'...;6..9.wS..._...2017
0210122132Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4...
.K........DN.61....20170210122132Z....20170214122132Z0...*.H..........
.....o.C].........g...>'X...z....".D...S....tlL.;.^>.{.u1..P.@w.
7.%.L.Q..Qx.d...8...Cd.%......4......%vy&.V.4...(*..JE.s...:...O..8k..
....J.r..........P.*.`.J.8mG5.v....,.&....<.....@.....(..!..?.-..B.
m..H..Co....S.0.i..0i.Z.\B.D...,..H.;.Z.X..!.T..Q.l..C.jY.....0...0...
0..........H...!U,43.....0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1612080
00000Z..170515000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
.........N....K.N..z.........p...CL....@....\....f.JsR.{_awn....;...-.
.g..8..6.|l.(....h....;G.@..T..%.....7.R..O;u.g@g.C........2.Y....I..g
.J{}...u.@...ih..$.<...{.h.h... ....}M}.:.........rS=.$....lE)3.o.B
.x.....^.V.#N..=S^.F..U.}C2...-S...... .2....I.......].c........0..0..
.U...........0...U.%..0... .......0...U.......0.0...U........>'...;
6..9.wS..._.0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H.............>S.......F@.).fox..V\.........x.[...I&.=[...u..
4.\m....V..n......3YC..Rl-.....a..@G...@..o.......@..~....9/}.i.<..
..e\.\a.'.}......}.....Cn.y.u....xZ9..x..x|h .}I-:..RD.S..Ql..2cnX.Fil
stf.......e.V.G......\..]hh ....W.../..x:.2I.*.....S?.Dr..A.....=.
<<< skipped >>>

GET /certs/ca.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: aia.startssl.com

HTTP/1.1 200 OK

Server: nginx/1.7.2

Content-Type: application/x-x509-ca-cert

Content-Length: 1997

Last-Modified: Fri, 18 Dec 2015 11:03:49 GMT

ETag: "5673e815-7cd"

Accept-Ranges: bytes

Date: Fri, 10 Feb 2017 15:41:36 GMT

Connection: keep-alive
0...0...........0...*.H........0}1.0...U....IL1.0...U....StartCom Ltd.
1 0)..U..."Secure Digital Certificate Signing1)0'..U... StartCom Certi
fication Authority0...060917194636Z..360917194636Z0}1.0...U....IL1.0..
.U....StartCom Ltd.1 0)..U..."Secure Digital Certificate Signing1)0'..
U... StartCom Certification Authority0.."0...*.H.............0........
.....lF|x..{.3..rb..6 "$^..w.C...d...6.8.#.nm.<.r.....=.3 ./....AYg
...}..t..yL.7z.9.RY...FC......q.ub4.,......4.....R=.3..M..;JK..&/....r
5w.<]...&..6v\..t.%.......x.-...0.-ry.F..*.....I...........cS..b...
:..f..kt.. .v>.m..D.sb.;...SV%lQ......v.m.....=f..V...H.:K..XP.8u.[
.C......lMp[)e...]...1........{.n.'f..H.nB.?.!>{..p.c..l.T.\%z.....
..,~.^.MXn........2.......n..6I..Hi...M...i......y"H..{i.p..z7....vOW.
........`.g:........r".................\R<...*s......`.z/...n.&0...
..W..=.. ..v.... ...*r..3.].K....t.RK........R0..N0...U....0....0...U.
.......0...U......N....@[..i.0.4hC.A..0d..U...]0[0,.*.(.&hXXp://cert.s
tartcom.org/sfsca-crl.crl0 .).'.%hXXp://crl.startcom.org/sfsca-crl.crl
0..]..U. ...T0..P0..L.. ......7...0..;0/.. ........#hXXp://cert.startc
om.org/policy.pdf05.. ........)hXXp://cert.startcom.org/intermediate.p
df0.... .......0..0'. Start Commercial (StartCom) Ltd.0.......Limited 
Liability, read the section *Legal Limitations* of the StartCom Certif
ication Authority Policy available at hXXp://cert.startcom.org/policy.
pdf0...`.H...B........08..`.H...B... .)StartCom Free SSL Certification
 Authority0...*.H..............l..f.4...^}....N8.^..%.K.2..;.=.D.[
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 10 Feb 2017 15:42:11 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha
<<< skipped >>>

GET /Big_banner.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: paysell.bz

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 10 Feb 2017 15:41:23 GMT

Content-Type: image/gif

Content-Length: 1439404

Connection: keep-alive

Set-Cookie: __cfduid=d91df4e7668368f826f0a547a006dcf071486741283; expires=Sat, 10-Feb-18 15:41:23 GMT; path=/; domain=.paysell.bz; HttpOnly

Last-Modified: Tue, 31 Jan 2017 12:42:39 GMT

ETag: "541117-15f6ac-5476344792a8c"

CF-Cache-Status: HIT

Expires: Fri, 10 Feb 2017 19:41:23 GMT

Cache-Control: public, max-age=14400

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 32f0aa40b170599c-VIE
GIF89a..x......V..#pp..(3m.6*.."....%.....`...O....%....o.l...""...M..
..uP....".#...V#....Pm...........Odqu......Rf.q'f...Lf....WT....3Gp..m
..."..h...T.w.T.."t.......i..Vl$l...2H$..........u..%...q...Uz"......s
..DO.O.r.....O......jkg....'....kw.3E)F/P  T...gr..)$FS..RS.......(.DZ
P....ig..H&R......1Sc#...w&(mq.s.a_.....I1..gJ..P...o%....w........BW.
G.n$..U...2..U....$..#.....K....v..$U..|K...N....}.."....|Q9lNQ..H....
.x.....3....."....."..3..f..h~...."..3.....".....3.......m...3........
4.."..3..3..3.."..U..D.."..".......""..".....U...."".....3.."....."..V
.."....!3.."....""..".."....""....7...U..D.."...."3....."..D..D.....".
...5"..3..D.....V..".."..3..3.."....".."..:D..3..D..D..3.....U..f..3..
..;............3....4..73..3.....8.......;:..>....8V..."!...3......
..............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="...
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:m
eta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 
       "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-s
yntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns
:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorToo
l="Adobe Photoshop CC 2015.5 (Windows)" xmpMM:InstanceID="xmp.iid:961A
15C7E73B11E6AB398C80DC03CC4C" xmpMM:DocumentID="xmp.did:961A15C8E73B11
E6AB398C80DC03CC4C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.ii
d:961A15C5E73B11E6AB398C80DC03CC4C" stRef:documentID="xmp.did:961A
<<< skipped >>>

GET /clientscript/yui/yahoo-dom-event/yahoo-dom-event.js?v=389 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: application/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Thu, 31 Mar 2016 02:55:20 GMT

ETag: W/"56fc9198-8f14"

Content-Encoding: gzip
3265.............}k[...... 0{.^2..3.J..'\.......|"D...7A....~....N....
..k.$}.....[_......q9.......L......z..t...M...=..(.O.\..=...T....7t'.;
J=MF.,5.wS.N)U............}v..Gw.[".....-..=Y=7_..zvg.7..S.s....z...w.
./...m.gW[-..l....#c...Ds...d...z....yp.Gg.....p.`3........;....'O.1 .
. Y..Y.....G;7v'w.{.....sU...........co.1r.i.95E..<S......f....}...
.@.x.A...~a0..w........:s.O.I.l.Z........lV.h.D..o........;wf....t.k. 
...dU.......u....M..;.....=..YI.W.......t.4v}.Z.U.. b.;..=0W....H.....
<y..>...8.[U^.."V....u.51..L..U...6<.*...T.W.T?....g......Lxp
.Iq..>/k.|...#..L.....a.r...N.......y.^...............LA3)A....3.9.
.0M@m.2...@..). OD....}!I..Q0.....^...-......E....>......;.:..o..Wo
.....o..i.8..R...P.....y....t.{..`...b6.Cf...m.......@VsU.....z.9..|x.
......g...._.e..]..w...@.t.........w..Sg...,..jP......D..A..9pZ...W.iB
{{.w.9.....FK..hz.....Nb-.....A....l!..W>4..M..M,.PR.o......y..F.V.
.3Ti.]..lt.D.9#.}...W...9O.....D..&...."0..L.|..D.....1....1..1......I
R.......B.i.f.s].]...[..".eZ ...$.X..gO....s.]. . .8/.....f.:_...\... 
......K......d2.I_...#n..7...y......`.0.H..T..(-.8...H...}c>..g....
.......1.DW.O..A..@Z.9U)...\B....ze._.N..3I.&...e..Q..:..?.V..5A.%....
..B.7..{..P)#........{...YB.L%... ....).B...i..R[.<......!......W).
x.w] ...#o.......y.....`..;a..^ ....e...^A.>.;.2..y..2 ...<6....
.^'dE...1.u^..W..`.iH.C.5.*;'`......l.-5q.....t..U....8b)....... ..Xu.
.............s..3sS.d8~....Z....H_*V5...$|...t.I.f....A...4...H...'..C
2Ot0....Z.._..[...-S.b..(.....{.o}..g.o.K.D`...I.)..*.H....2Z..<
<<< skipped >>>

GET /images/smilies/51.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 3066

Connection: keep-alive

Last-Modified: Thu, 31 Mar 2016 12:14:06 GMT

ETag: "56fd148e-bfa"

Accept-Ranges: bytes
GIF89a*........... mU.@4.$$$.............. ...eP.........y............
.......q.ye<ue8.....}.........aaa.i.q]0iL.]H.....................a.
......u.............000mL..............}.......qqq.....e....}.......!.
.NETSCAPE2.0.....!..Built with GIF Movie Gear 4.0.!.!Design by Aiwan (
aiwan@yandex.ru).!...d.>.,....*......@.pH,....r.l:...tJ}.....@.*..0
..=..hl..N..k.{......~....uUmti.pQ..cS..^............ .k.8*.........,.
k........5.............e.3........)4.k.......%..e'..$.....$...1'k.(...
.......)..(.q/.D(h...)..".X."....<@..@...%(x.......@.`.!... ...H...
..B.......8s:...!.....>.,.............p8< .H.b.d..N.0q....!...F.
>.,..............@.....P.D2...2.T.4A.!.....>.,....*.....?@.pH,..
..r.l:...tJ.Z...v..z...xL...h. p^....`.&.}.5C.0..~>oi.\A.!.....>
.,...........@.pH$..C#.@l:}....|>....Z.z.\........:w......K`..x*1?.
:0.......... .\.8*.........,.\........5.M..>...........C.....3.....
..)4.............%..B....'..$....$...1'D.....(...........)..(.....x.@.
...*5P.!.......0.....$(P .B...>. ..E.. XD. .....)..`"...!.d0....L!A
..!.....>.,.... ......@.pH$....1Yl:..h.#.>...V.}..[fW..W.....Y.s
k..*...x$Q....aC....|>..u....C............. .E....B.8*.......,.....
...........5.M....>............C.3.......)4.cB........%...X'..$....
$...1'.].P`........ .."B....ay.@.....hh..B.....(...... H.........<.
.... XD. ....O.f....D..!B\.`...>B...!.....>.,...........@.p.....
..@l:..A p.,..g.....F....j..o.;...Ot..>..W.P>_..HxyDWRSuW2o...v.
..VdD|Hu...oe[...N...q....Z>...d..5....S..........FN.3........)
<<< skipped >>>

GET /images/bluefox/misc/navbits_start.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 1073

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-431"

Accept-Ranges: bytes
GIF89a................~*#....)#|'". '~)#}(#.,'.($.*$|*#|)#.,(~)$} $. &
. &. &.,'./,.0)./*.2,.40q1(.73.60p2)s4,.?8.A;.E@.PF.TJ.SK.\QXG3YH4..|.
.}......................*(.*(.,,. (.-,. (.0/./../...-.*'.53.0/.... ). 
).--.,*.-,./,.11.//.10.2/.>=y5/v4-p4 s5-.A?.FB.EBl?3`B2^K8UN:......
....00.54.11.--.?<{61...MN>.........EFB.........................
...................................wwwqqqpppnnnLLLDDDCCCBBBAAA@@@???&g
t;>>DDD.........................................................
......................................................................
......................................................................
......................................................................
......................................................................
.............................!.......,........@......$h........P..5."J
.......<. #.O.;g..|"a...&..4pDJ.Ap$...fP...e...C...W......@=nf.T.ga
..Jg...4...7|h.......P...gf..0...@.B..C..lH%...x.Ta....5n..^3gO.......
.q..u....f.c...Pe..2...!:.. A...e(pP.c.. hd.A[..0[x4y..2...4...".....8
)..O..P.dp. F.....Y".O B..M.1BdB...( ...P@.;....


GET /images/misc/password.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/png

Content-Length: 620

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-26c"

Accept-Ranges: bytes
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..S=..`.~.VN.......[.A.m.A.N... ..&N..&................<
;P.Z......I.5.V....M.&._h....|..{......Dp]...|.........Q"..s..^....4}.
f ..g2.$....a....e9U.T.9.s.4/}..O..`.>.>..B..l6.f..I..i."....4..
(...l.>|.s.....8.a,'.I.j5....h4..PP..r.X|]....L..L.....P*...[r..3?.
"....`q..:..]..i.... s..N..(.. 0{.{..`ex.....[|....W..~...7......./...
...l.>..U..m.X<..S....!..u..-4,....Gl...]o...n.%.fM.....C...'...
.....m..... .K.....u....V.}.,.[_6.[. ..F{..c..e...../...#..=.[......?%
....D......7....q.F.cf..L......U!......g.pv....G.?...........c.&...m@.
...IEND.B`.....


GET /jpg/L3Zd0Sx.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:45 GMT

Content-Type: image/gif

Content-Length: 150541

Connection: keep-alive

Last-Modified: Sat, 27 Aug 2016 06:07:30 GMT

ETag: "57c12e22-24c0d"

Accept-Ranges: bytes
GIF89a..x......7....&......c.....................iE.40!...fW....HA1QI5
.di.....x...ulS..............k.........[S-.l.J1....efe.kG.....R...id3.
sAlU1.nD.........|}|.}H}U8..X..k...wd8skF.....8../..4..2.....6....u.#.
.e[E...3%....S8$..........._..m..!........7WI(XQ>.....g."....../.X;
..s...../..b.z^.......sK....u}......wg. ... .KB".D..% ...uK3.....g..!.
..........Y..L.)-.tZ.wXwq5..&...c....fmbM.....7..d..s..!.!%.....u..0z^
?....|U..-.|2..~0*...#..t.a@.....X....$.TH....@)........S\."!........&
..\.DG=4..<H.....i~tB.....)..d.&........!...o..........6=C.......s*
....|..L....zP..$......LC.................._.~I.#&.....u...rrri>,[:
(.DJ..).IQ.....$..j.ah....%........k<.......(-.......,$`8(..$...c?*
<:(....-4..... .................^....."........ ..q..............&.
..UN<........1............!..NETSCAPE2.0.....!.......,......x.....Q
..H......*\......#J.H.....3j...... C..I....(S.......0c..I....8s.......
@...J....H.*].....P.J..T ..X.j......`...K..Y.V..].....p...K....v......
.......w..... ^...c...K.L.....3........C..M.....S.^.:4...c..M..]..s...
..o.....N..q... _.......K.N..u...k...........O.5....._..<.....'.~..
...#........._...h`z......J.`..F(.n.Nh....Va..v..c.~(..$..b.(...Y'....
0R.b.4.h.P3....<.w^.@.).M9.i..#....LN.d.PFY..RVi.}T^........`..e.d.
...f...ph.........t.&g.x....z...c|.)....J....eh..6....F*.m.Vji.^^...rA
......i................I.......J.................z.K..s....j*...a:...Z
JK..QZ...Hj...Az...:.K..1....*....I....n.K.................b.K..K.....
)....9....IL...Y....i....y.....L...................L..............
<<< skipped >>>

GET /images/bluefox/misc/w3ccss.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/gif

Content-Length: 177

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:12 GMT

ETag: "506e8108-b1"

Accept-Ranges: bytes
GIF89aG......   ......:::!.......,....G................0.....f.E.X...(
..... ..9..N....pzD.(0..(..N.......j.jXKe.Iy..B.U...{.d..t^.h3]k.o../m
.w.vF.S&.v...U.(.."9....I.......iP..;HTTP/1.1 200 OK..Server: nginx/1.
11.5..Date: Fri, 10 Feb 2017 15:45:46 GMT..Content-Type: image/gif..Co
ntent-Length: 177..Connection: keep-alive..Last-Modified: Fri, 05 Oct 
2012 06:41:12 GMT..ETag: "506e8108-b1"..Accept-Ranges: bytes..GIF89aG.
.....   ......:::!.......,....G................0.....f.E.X...(..... ..
9..N....pzD.(0..(..N.......j.jXKe.Iy..B.U...{.d..t^.h3]k.o../m.w.vF.S&
.v...U.(.."9....I.......iP..;....


GET /images/misc/username.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.altenen.com/

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.altenen.com

Connection: Keep-Alive

Cookie: bbsessionhash=3f96e9abe75f6825fccbcc2a34dc589d; bblastvisit=1486741283; bblastactivity=0

HTTP/1.1 200 OK

Server: nginx/1.11.5

Date: Fri, 10 Feb 2017 15:45:46 GMT

Content-Type: image/png

Content-Length: 728

Connection: keep-alive

Last-Modified: Fri, 05 Oct 2012 06:41:10 GMT

ETag: "506e8106-2d8"

Accept-Ranges: bytes
.PNG........IHDR................a....tEXtSoftware.Adobe ImageReadyq.e&
lt;...zIDATx..S_HSQ....{..Y..@...h..2)}..P)l.^zX.P..Q........QA.......
jO... .....0.....?.....9..y...w.w..;..;.;. ..`hp..........V.u..wJSU.r.
))...z|.S)..3..766.......D..i..E..J.......L...0.f......3....*.Y.UE.K).
J.;.T){...`..*|N..N.e^...Q..t...9.; ..n.F...... ..>q......'.{.._...
.T.f..h.a.o.Z..........oo..........5;n...[](..!q.H..F....g..cy.M...v..
..;.-...D.......n.m..|.6:....`O......xj.#^L.ccc/..y"...&..z.R..f..8.N.
.i|$.... T...{9.....E..J..|>....%..Y.....y~..r.... I.......b....6X7
...b.e.v.....:...!..........2!....V........Qs..#.!..43{.......t:m..j;.
.F..`..%..p........:...lo......Ba..e...5.m..c...=2....AxD.<hnOGG'..
-...Q..D4...B.........=.........IEND.B`.....


GET /jpg/twitter.png HTTP/1.1