MD5: 8b6da4b1611c108ce3bf9a5ac119552b
SHA1: cfd5c3350dd9a1c31507d28f1cb56301902a65e8
SHA256: 878b5d3009f9ee5e973e74a24ae1f00ac54eb27b12367231fe8bf5a4dcce7ebe
SSDeep: 6144:We34y2pbTh 3pwLpAKKi8A//t4V1TLAo/o5b77ClFxo:kvh 3KaltAnIhLB/m4o
Size: 217928 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:1736
GoogleEarthWin.exe:2788

The Trojan injects its code into the following process(es):

dlmgn.exe:892

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process dlmgn.exe:892 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\en[1].htm (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\iconos-ie6[1].jpg (6 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\box[1].jpg (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\ender.min[1].js (16478 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\810b[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].css (1417 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\desktop.ini (67 bytes)
%System%\wbem\Logs\wbemprox.log (150 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (50 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].js (21071 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\en[1] (1558 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\applicationIE6-app.min[1].css (457 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\GoogleEarthWin.exe (261127 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)

The process %original file name%.exe:1736 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe.config (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe (8776 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsd1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp (0 bytes)

The process GoogleEarthWin.exe:2788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Desktop\googleearthinstall.log (781 bytes)

Registry activity

The process dlmgn.exe:892 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"Guid" = "8aefce96-4618-42ff-a057-3536aa78233e"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B94294BF91EA8FB64BE61097C7FB001359B676CB]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 2E E0 C8 90"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 6F 7E 74 A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryCount" = "16"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"Active" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"Active" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg]
"ControlFlags" = "1"
"LogSessionName" = "stdout"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level" = ""

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappprxy]
"LogSessionName" = "stdout"
"ControlFlags" = "1"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\eappcfg\traceIdentifier]
"Guid" = "5f31090b-d990-4e91-b16d-46121d0255aa"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil\traceIdentifier]
"BitNames" = " Error Unusual Info Debug"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1A A3 1E 7B 54 45 27 78 C2 09 6B C3 89 16 05 B2"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C]
"Blob" = "04 00 00 00 01 00 00 00 10 00 00 00 3E 45 52 15"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"CategoryMessageFile" = "%System%\ESENT.dll"
"EventMessageFile" = "%System%\ESENT.dll"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"LogSessionName" = "stdout"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\System\CurrentControlSet\Services\Eventlog\Application\ESENT]
"TypesSupported" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\Internet Explorer]
"iexplore.exe" = "Internet Explorer"

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\QUtil]
"ControlFlags" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\ESENT\Process\dlmgn\DEBUG]
"Trace Level"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"B1BC968BD4F49D622AA89A81F2150152A41D829C"
"B94294BF91EA8FB64BE61097C7FB001359B676CB"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates]
"E5215D3460C2C20BBE2D9FE5FB665DAA2C0E225C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process %original file name%.exe:1736 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "41 9C 6D BC 50 AF C7 61 B7 D4 A5 CA 3B 33 40 1C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process GoogleEarthWin.exe:2788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 90 EF 8B 9E 45 83 8D EB B0 2C 00 2C 41 D8 81"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt
hxxp://crl.globalsign.net/root.crl	108.162.232.198
hxxp://crl.globalsign.net/gs/gscodesigng2.crl	108.162.232.198
hxxp://os.wosign.awsr53.qihucdn.com/ca1-tsa.cer
hxxp://northstar.393532df4f28.api.socdn.com/installer/4d48823a-b8b4-4f4d-b72e-794a5bc06ebe/1345/config	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/ui/11d/en	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/app.min.css?2015041501	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/ender.min.js	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/applicationIE6-app.min.css?2015041501	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/iconos-ie6.jpg	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/box.jpg	52.20.122.55
hxxp://northstar.393532df4f28.api.socdn.com/s/app.min.js?2015041501	52.20.122.55
hxxp://wnpcdn.com/icon/810b.png	52.20.26.1
hxxp://dl.l.google.com/earth/client/advanced/current/GoogleEarthWin.exe
hxxp://www.winportal.com/thanks/?q=Google Earth	54.208.39.191
hxxp://www.winportal.com/thanks?q=Google Earth	54.208.39.191
hxxp://www.winportal.com/google-earth/thanks	54.208.39.191
hxxp://googleadapis.l.google.com/css?family=Asap
hxxp://wnpcdn.com/css/ie7.css?v=1	52.20.26.1
hxxp://wnpcdn.com/min/?g=css&14	52.20.26.1
hxxp://gstaticadssl.l.google.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot
hxxp://wnpcdn.com/images/blank.gif	52.20.26.1
hxxp://wnpcdn.com/images/logo-en.png	52.20.26.1
hxxp://dl.l.google.com/ga.js
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js
hxxp://wnpcdn.com/images/grad1.png	52.20.26.1
hxxp://wnpcdn.com/icon/648m/apli-master.png	52.20.26.1
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/afr.php?zoneid=31&cb=5515585
hxxp://wnpcdn.com/images/langs.png	52.20.26.1
hxxp://wnpcdn.com/icon/1195m/petousb.png	52.20.26.1
hxxp://wnpcdn.com/icon/1383m/installshield-2010.png	52.20.26.1
hxxp://wnpcdn.com/icon/892m/stardock-mycolors.png	52.20.26.1
hxxp://dl.l.google.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=www.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com/www/images/de0ae333c183355452cb397cf09eeffb.png
hxxp://wnpcdn.com/icon/875m/animated-inverse-cursor.png	52.20.26.1
hxxp://wnpcdn.com/icon/11653m/idm-scan.png	52.20.26.1
hxxp://secondoffer-lb-126442588.us-east-1.elb.amazonaws.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://www.winportal.com/google-earth/thanks&cb=b54e227aa9
hxxp://wnpcdn.com/icon/752m/pdf-download.png	52.20.26.1
hxxp://wnpcdn.com/icon/9277m/winusb-maker.png	52.20.26.1
hxxp://wnpcdn.com/icon/1412m/stanza-desktop.png	52.20.26.1
hxxp://wnpcdn.com/icon/40m/norton-removal-tool-xp--vista.png	52.20.26.1
hxxp://wnpcdn.com/images/footergrad.png	52.20.26.1
hxxp://wnpcdn.com/images/social-icons.png	52.20.26.1
hxxp://wnpcdn.com/flags/flags.png	52.20.26.1
hxxp://wnpcdn.com/images/buttonbg.png	52.20.26.1
hxxp://wnpcdn.com/min/?g=js&4	52.20.26.1
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js	216.58.209.170
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.174
hxxp://crl.globalsign.com/gs/gscodesigng2.crl	108.162.232.198
hxxp://aia1.wosign.com/ca1-tsa.cer	54.229.101.94
hxxp://www.google-analytics.com/ga.js	216.58.209.206
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	212.30.134.174
hxxp://www.secondofferdelivery.com/www/images/de0ae333c183355452cb397cf09eeffb.png	23.21.214.217
hxxp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot	216.58.209.163
hxxp://www.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585	23.21.214.217
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt	212.30.134.174
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=www.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~	216.58.209.206
hxxp://fonts.googleapis.com/css?family=Asap	64.233.164.95
hxxp://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe	216.58.209.206
hxxp://www.googleadservices.com/pagead/conversion.js	216.58.209.162
hxxp://www.secondofferdelivery.com//www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://www.winportal.com/google-earth/thanks&cb=b54e227aa9	23.21.214.217
www.google.com	216.58.209.196
flex.atdmt.com	131.253.12.190
www.google.com.ua	216.58.209.163
googleads.g.doubleclick.net	216.58.209.162

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET USER_AGENTS Suspicious User-Agent (DownloadMR)
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM ESTABLISHED packet out of window

Traffic

GET /root.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.globalsign.net

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Fri, 25 Sep 2015 03:33:53 GMT

Content-Type: application/pkix-crl

Content-Length: 649

Connection: keep-alive

Set-Cookie: __cfduid=d397aa8013c82ce98553480a71ffa202a1443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.net; HttpOnly

Last-Modified: Tue, 07 Jul 2015 00:00:00 GMT

ETag: "559b1680-289"

CF-Cache-Status: HIT

Expires: Tue, 29 Sep 2015 03:33:53 GMT

Cache-Control: public, max-age=345600

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 22b3ab90de4e0c83-AMS
0...0..m...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA..150707000000Z..15101500
0000Z0..0*.........D.....141125000000Z0.0...U.......0*........)E.....1
41125000000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......
0*........,^.....141125000000Z0.0...U......../0-0...U......10...U.#..0
...`{f.E....P/}..4....K0...*.H.............{...........(.'o.../..c. ..
,~..m....]yq.6....X..........P...O..!v...b..A.2~..m.O.t....~&\9R7P.V..
.e..H.[n.0......{.M....~YerR."...0..([email protected]
f..F.g.tSt.J..P.....<...>....M.'..m7d.6;....u..?..Ch....r.....|.
..T,I.ex...8...wB...J.u'.HTTP/1.1 200 OK..Date: Fri, 25 Sep 2015 03:33
:53 GMT..Content-Type: application/pkix-crl..Content-Length: 649..Conn
ection: keep-alive..Set-Cookie: __cfduid=d397aa8013c82ce98553480a71ffa
202a1443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.g
lobalsign.net; HttpOnly..Last-Modified: Tue, 07 Jul 2015 00:00:00 GMT.
.ETag: "559b1680-289"..CF-Cache-Status: HIT..Expires: Tue, 29 Sep 2015
 03:33:53 GMT..Cache-Control: public, max-age=345600..Accept-Ranges: b
ytes..Server: cloudflare-nginx..CF-RAY: 22b3ab90de4e0c83-AMS..0...0..m
...0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U...
.Root CA1.0...U....GlobalSign Root CA..150707000000Z..151015000000Z0..
0*.........D.....141125000000Z0.0...U.......0*........)E.....141125000
000Z0.0...U.......0*........ ...h..141125000000Z0.0...U.......0*......
..,^.....141125000000Z0.0...U......../0-0...U......10...U.#..0...`
<<< skipped >>>

GET /s/asap/v4/7U2WVQLzYo7fqCE9hsW0CA.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Thu, 28 Aug 2014 20:43:23 GMT

Date: Wed, 19 Aug 2015 05:22:26 GMT

Expires: Thu, 18 Aug 2016 05:22:26 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 9590

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 3190297
..........e.UX......k........S....[......;...EB..)...Z..D<...\...\.
.....r....6.`.....K...(&...... ..?...C.........\[email protected]
...<.#~..Z.......W.7..?#!.?@...._....PM......l..~.d..&H:.J.Y 6..y..
.....0..%.Y...U..:r.B.O.WT....g._.......h.4.t.........c...t..a..I..wG.
`Y..BwC.&.,4;. .........|7Dn.{.v.......tI....veR...'y8...I.x..^....x4R
9....lO.-.5..8Mq.(.c..0.......~.*J.;n....z.......A.)j.d...X...K.S..$f.
._h.$.{.W%.&.OK.8.C...]r...w.Sx........y_.YH.5..ISR.a....."..Z.9..7R..
-._.'...8............YC.6T...;J...........W..s....A...:^p|yL#.<Z.tx
..l.y|....._G..Vkm0...D.UB./..J.>..B..$.....b.q.... ..d..".E ..w.&l
t;[.......v....{Zn.....N...8r.q.c..k.....~\...:.*O....T{.v..!v.Q.z../.
...N..7R..Cf.....i..J.$..0s.F.w'..../T{..Y.:.T...v..GY{:3.hL.......B..
W ...LBp~..9>....(..7.Y|....9...Es..........AV.QL.....;z.X}.$..j.;h
.........Q.Z...F...?.65..5y..d......W.....@.}m]$.T%Q...F..m$,B...7..W.
.8y.n2.......n6...T=..`...]......l.xY.Eu.......[<.k...?I.r.G...*/._
.......f.O,.8....~.\.w..kh.........//Uf.^...m....b.....e..c.....oG....
a.l....X%d.-....pO..1'.... .9..&.c....x5.'....Xg....r..Ov.U...$.......
.2).!....uW.'..}5.l..M......./.r7...&.dGu)......_.#U..n.N._...)....2L.
...J..q.....%p.....dj.Q....Z...e..JVz.......cf..[.M....q_u..Mgm..Y...j
a.K....Vdp/Ws.q....G...d.8.K.I........>..E.%......^Jue.F5..t...... 
[email protected].._......%t..SPI..x.z....Ew..H......u.L..a(-%%).......
.,..{.y....Q..T0&.O.5.m.*sy..L...a.N.n.....[b..9..Za..X."........Y....
.v.u6.y.......XP.B@./...j..* ....8'1gI..s.S=\..%..U W..[.`.*.E_-..
<<< skipped >>>

GET /ca1-tsa.cer HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: aia1.wosign.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/pkix-cert

Date: Fri, 25 Sep 2015 03:33:53 GMT

ETag: "555f0960-57a"

Last-Modified: Fri, 22 May 2015 10:48:00 GMT

Server: nginx/1.5.13

Content-Length: 1402

Connection: keep-alive
0..v0..^.......^h..q.cPV.h.>...0...*.H........0U1.0...U....CN1.0...
U....WoSign CA Limited1*0(..U...!Certification Authority of WoSign0...
090808010001Z..390808010001Z0U1.0...U....CN1.0...U....WoSign CA Limite
d1*0(..U...!Certification Authority of WoSign0.."0...*.H.............0
...............V.{k\z..k.....#.....1.>..)o.=.k..@_.9..z..MT}."x....
......Kt..~......I(D...2.%.S.........q'......gh..]..]p.....SA.....6fz~
V.._..h 6..$,,G.Yvf0..........0.....,.....(..T....v..h..Jl.........\..
~.2.^..*B..N..Y..z~...Z....i..'.{..T..{..TzQhnw...RJfF..g...Ow..]..V.C
rw.....9........./0B7!.0p.....XM..}...7...2..:cq$..7..t.7....F`...?P6.
.z..bjn..j!Zi....p9...n......;q..R.....w..o.B.mJ..4H......"..1.?.>.
. y...dd.1...R..Ei..*.U...FK.J..[9(.......HK&.0L.X..D.O...3..........q
).vO.%...../..../'.J....|[email protected]....
...0....0...U.......f.....K.. ........>0...*[email protected].~
{..d.2{.<.]F..,.p]....}...!..Y$.....}.#.4..|r....T..Rp....;.:.2.!9.
....Oj...?/|.X...9.>.=Js.@z. a.g..$..mU,Z..%r.....Ub...c.aD#.......
.M..#N!.[9[W./].^.y.|..M......y.3....0.>...C?.Z..D..|.H.3.......>
;.]q....t.aY...Z..r..]6....<[email protected]{,.V.G......!..f
..%0.\...g..m....O...'........H......>LQ:.......&.:...i...)dQoh....
A.........=..h..g..`.U.a.W|...aI:.u....?g...(.1..W...|..~.....6|[~'.z.
....R...Tp1.C....>..~0dP....3gMhO..........%:..Y..\F.g,.F..H..[...Q
......7"... t.-..k....!..y.D.........
<<< skipped >>>

GET /s/applicationIE6-app.min.css?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 25 Sep 2015 03:33:58 GMT

ETag: "5603ac7a-1633"

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 5683

Connection: keep-alive
div.data{margin:10px 0 0 0!important}#app{position:relative;width:728p
x;height:428px;margin:0 auto;text-align:center;background:#eee;border:
1px #abc4e0 solid}#app div.publisher-logo{background:url(winportal.png
) no-repeat 0 0;position:absolute;left:20px;top:10px;width:150px;heigh
t:50px}#sidebar{text-align:left;width:160px;height:375px;z-index:100;p
osition:absolute;left:2px;top:0;overflow:hidden;margin-right:0}#sideba
r .logo{width:140px;height:40px;padding-top:5px;text-align:center;vert
ical-align:middle;margin:0 10px;margin-bottom:10px}#footer div.sidebar
{float:left;text-align:center;width:160px;position:relative;right:135p
x;top:0}#footer div.sidebar a{color:#777;font:bold 10px Arial,Helvetic
a,sans-serif;text-decoration:none;display:block;line-height:10px}#foot
er div.sidebar a:hover{text-decoration:underline}#abw{background:#ddd;
margin:0 12px 10px 12px;padding:10px 10px 7px 10px;text-align:center;b
order-radius:7px}#abw div.icon{background:#fff;margin-left:4px;margin-
top:15px;width:100px}#abw p,#abw a{font-weight:bold;color:#777;line-he
ight:15px;height:27px;overflow:hidden}#abw img{width:64px;height:64px}
#topics{margin:0 0 0 5px}#topics ol{list-style-type:decimal;list-style
-position:inside}#topics li.active{background:url(iconos-ie6.jpg) -253
px -325px no-repeat;border-right:1px solid #f2f8ff;color:#333;font:bol
d 12px/34px Arial,Helvetica,sans-serif}#topics li{color:#444;font:norm
al 12px/34px Arial,Helvetica,sans-serif;margin-left:7px;padding-left:1
0px}div.publisher-link a:hover{text-decoration:underline}#footer{p
<<< skipped >>>

GET /s/iconos-ie6.jpg HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: image/jpeg

Date: Fri, 25 Sep 2015 03:33:59 GMT

ETag: "5603ac7a-1a3e"

Expires: Sun, 25 Oct 2015 03:33:59 GMT

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 6718

Connection: keep-alive
......Exif..II*.................Ducky.............)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:083E11C9A93A11E38238EC1A77F349F6" xmpMM:DocumentI
D="xmp.did:083E11CAA93A11E38238EC1A77F349F6"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:083E11C7A93A11E38238EC1A77F349F6" stRef:doc
umentID="xmp.did:083E11C8A93A11E38238EC1A77F349F6"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d................'..'2&.&2.&&&&.>55555>DAAAAAADDDDDD
DDDDDDDDDDDDDDDDDDDDDDD.... . &..&6& &6D6  6DDDB5BDDDDDDDDDDDDDDDDDDDD
DDDDDDDDDDDDDDDDDD........].."........................................
........................................R.!Qa.....S....1...A.2r.Td.q..
"b.....B3.4.#Cc......................!1A.Qaq...BR.............?...N{..
9e..D...'.$*.S.'e..7i.*g.Jl.JJ^.f=..s{...vL...u.'j..{-j5.....g]..?.D..
G ..@.................................................................
.......=*_.2..mj='..d..V1...bP..C.....................................
..................................................................
<<< skipped >>>

GET /min/?g=css&14 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: text/css; charset=utf-8

Content-Length: 5672

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Vary: Accept-Encoding

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

ETag: "pub1435676311;gz"

Cache-Control: max-age=2592000

Content-Encoding: gzip
...........=...6....n.\.g..^%.T.*...>..i_f.R..I.)RKR.n../.-.e.;....
n'....bw.............u.......e.=..E..j....D..MYo?.wu..m.........n....z
[b..6uwX.p.?t...'....Y..._......Z.......(.?[...5..Z............uY7..8.
..............v.X....M......#..-.oQ..-n....{. ....:...v.'...ys,.......
....)....P..;...s.....u...._..P?.R...*.MY..M.?.....oj...n..y..|.......
..Ay....;..'.:...z~B.{...t:...1f.......?h.y*........n.6...dN..........
.K....i.....b.........F.....b..a..JT/...U6g.i(;....|.(P.....lP...&X).&
lt;00.\s.f..P....!{.w.......p..m.......t..P..r.....!.?.=d......=./p0..
...2...7>..TusD%......mF..S.r...u.R:....3.[[email protected]
.0..fm.....0.........Ce...H..!Z\.....\S$...-)..L.m.2....bJ....Y..Z.zn.
b.l....5eG_....>.}Y..,>.?\...YY.[...W..DxR...ij%....)....e_.....
.^a.O.|m.K..L.w.....Tb....,..D[..P....,.=..~...l>....?.. ......./S.
.Mt.NGE..l.w'&^z..|!.b...B@,bJ..1 ......^......G.3.e.6%.$..PG.!'"Ft.rC
b.....J..M[........>.....8...x....*R...bqAAY.k ..3.>w.U......H./
.....t#T...*G..C...Q....j>"..}....\.......ul...<)...:].Alm.%...M
;p)[.....a.z{.7=\6.~.2....H..dqr...b...i...Lk...m...?......b..|g....CW
.B...}.O...:..<v.s.tOE7.BW.FT...>..>o...].....%..............
z!...B..8. *..ah.8`)..!.V.......0j.O...M.L..f.R............0.D..%.fF.R
..e......w....x....mON?)..<..c.G.aA..E..t......s..F....T6E.....Z$..
.{.~..........C.].t 0.....f..r..0....|qx/`[email protected]
T...EnFK..j..7!..A~Y.d'.....(2][email protected].>7.9.RE'
.Dd.n..&..l.....U...1....*.O.."...t.d....c`.e\...%~j.fM...B.m.#..0
<<< skipped >>>

GET /images/logo-en.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/png

Content-Length: 7622

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-1dc6"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......<........f....IDATx...y...}.?..^..zUw..Z[...
.........C..0"...8..ll..$3.6....A.L6&6...C..H8........;.$...F.Z..-=...
Z..Q.^.W]o.ZZ".wN..Wu.....o..{KH)iP...F......,...\[email protected].
.....?S..P.`..`...|.KC..=..j.......n...zT....H9../.../...A......7..u.m
.=.r......2u.4...6...c..5..A...........z.. .......)..........C........
...?.._...X".i.Un.H..xy@"..i$..D..i..V.=......Jc..t>....=..(...7-..
.....g...iL#.{.'.,.w3sg.......x...^r..x..2l....a....E...C.O....5h..p..
.......N.....7.ri......g<w0VCH..=..e.o.....{...C....C.M.<..'.C8^
...... .....%...............t.....7g5.q..c[.%px~.!D. I........=.K{S/..
....ex.e.F.bh.)Nf...K.Lc.R5W............. 0$....g\/....y.e...p0.._....
.pE.A.....J....ON.......kX.y.oYr..2.....e.._.-.`.I,...5..O..........A.
.......F....]..1Mv....u...e..(8.Xf:...tiI....f..7I"......I...9........
v...v.}...k.a`.......... ...<.....(.~...`.........8^.U.}.y.W1.=....
e`....]...._`q..hI...^..C.......Y.%....\.............. .......7.[f.O..
...Q.?.\..j...M.r.>..T.."m.E...4'.....;xm...M?] [email protected]....
..8.f......^[email protected]..`04.M.y~. .}..wy...1<
...lF.D...>.t.r...jY..;.....p\.D........be...^.)K.......q.:G4L..5..
p..j.6.~. .../0........./22....TK...Y.... .|..u..GJYv.*I...E.#.;...k..
.O.u....4.):.|..%..........6>.>...^..q.........dh.gJ#.......}\..
E|_.K.L..!....a.8?.s.}..^t....[......^.}....*..(.q..(.\.q.{... ..YK.&.
...,....;......._..7ie......,%..}..k`R.......{Q.&=.SG....."e..7.z.*./.
2.....{..6..l....T.....t.w(.......qt..N..........m....VM..R.....~p
<<< skipped >>>

GET /icon/648m/apli-master.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/png

Content-Length: 2405

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:55 GMT
.PNG........IHDR...0...0.....W......,IDATh.....dU..?.s...]U.=..0......
....`4Q....Dw...t. .].n. t..h...AL4.P. `.3...G=....>.V.......%.....
{..w~.s....S.*"....W7..x.............._.y._......<S..bZ..U]X....I.n
..gj..c..A.Hm..ej.Q...5..i^....R....2......q..(.8..N|.T.%..r..%@......
.........e...>.T.4...*........CQ.9...Y.5.iZ...t..2.......<P .U..
O*7........jx.....U..h.....1...eiK.!s..g[.`aF.yu.5m]NK....7^*g.W."{{.E
.."...&h.."L.p.."....n....>.@#.?(s......../......L.V.y........Y.e.t
.|..|.{....X}.i..~....H&..f.=.c..wV....HV...J......."..*..$.i..D..YKLf
b.K....7I.U...<%Hb.TI...F.!1.U.K..4!v=..u....`p.N.c..JA..`...S"QR.S
._AD..C|.<.....uA-V.F..3...A.G......g..A..).M..r....m..3?$....../.A
sk.T.;..8...L.}....W^.{..l.....t.^.w...J!.)Qf%Q..!.s.C....7..|..'WIJ..
9x.-..k..O.<[email protected]..._.....:...l..k.....[M.x.oc......G
....("I....Q(7...O..k..T..-.C...f.......>.. ..Mf,8.>.........S..
......e.......).......mG%...I........~..s..c...O.~.....h>.0C..V.qDr
.*.k.rG..[,N....fj....Jf.K).|..`l,.=_C..PUF.}....D....{.".f3/......=?.
.k?x*. NHwv.(....ts.:m_.K.y`1Me.E.T3LC....#......8n..D.....>M*.....
...1...\.D.....o.Z...4.N..b.=.4'Y.=G...uafRE..Z.^....2[.N?. ....<..
....\.....t!6/........F./.p'.....|S.7B......g.8.....".y`.u.....b0w.!&l
t;{6...C.^{.....O}......h<.....f9.D....llmc..0t..T"8..q... I.......
Z._....T..)2.B*......C....^.d......{;....]0..em<A.}..=.....q.XDqTq.
...K.9....>...#..A..QD...d....R."........{..,..eFj.a...6P.?I.\.ER.0
...>..N."QL.z.F......7I.|.b.{...F.r e.U.....Db...hH3.s....#..}.
<<< skipped >>>

GET /icon/1195m/petousb.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3965

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:30 GMT
.PNG........IHDR...0...0.....W......DIDATh...k.eWU..k.s.}u.~.f.33.L&..
......A4.B(...B...R..7.R?R~....h>P%.E.P......Bb.L...2a.=.........s.
^~...GwO@..]..{.>.......k_Q..B......z..?...@@.=........9....k..b.t.
.....h..A...O....V..{..A....m-U.aTE...ncW...i.|.m..~"....}.w.....J...^
.).-...............v....o.J...X...W..W....!...t....7...........N..h...
...v.S..x.>....G..P....:e....r..)Z..".T..T.0..#S.0.5$.....e...\A...
#e..1...G......5.(.......O?...>.j.BT.....:.v....<.....H%......R:
.....oa.dbp&...>.^...5........ad[F.K......o....n.Q.<B<8N.%..y
..'."..v.5X]P1........i.p'.G..%.>MEAp...../ ....s...\.....ocq. ...\
:....'>.^n.7...........=........4..S...g....?.uj..6,lWEp.....?~...&
gt;...7.V.D5. ......~.K...9&WOS....x.l$.,.\O.g...]..........{........u
.6*.W`n.*O..@i..$.{....X.....2JY.#.Nx.Vv..K....S_...Bz.~ZQ..2....c....
....2F}....S..e..WXz.<.6W...C.M..3g.....n........... mK<0..T1. F
1........M...............C.&.O..qp.E6..$..Gi....6.?.oL=.)F.....d...4..
[email protected].[jpx...>.V.S2bJI.....j..m.n.T....Kv..x.
....6.:...._cf.....].......w...2.~..o=.......-....r...............~...
.{6/....P=x..&f.....Q.....1.D...h..H.C.$4.......F...*Ys...}\...d...(..
[email protected]..{.C....Nj4}. G,.9.....4e..K..=N4.g.W......(y.W..
....(0dbP..Z..W..h....X..0..%.bM..2....t.J{....A..=.Mv.I.Z.*v.*.r5...P
k..s/"..AR...n.K.do~...f..[.A,X#X.F..2........>W.jR.."&.`V=../2..?.
..y.Q..[y..... ....S..P.................*..&.....x..S.N.....g......Q.7
.... >..C%..X3. V...b...Dh..i...pWs."..DW.|..:KQ9.....U.?......
<<< skipped >>>

GET /icon/892m/stardock-mycolors.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 4220

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:04 GMT
.PNG........IHDR...0...0.....W......CIDATh...kl\.u..g..}r..(..i.Q.J...
..M#W.. -PD..8**.MQ8.. .b.h........u. @........M..).'v.(~..e.....$>
.]r..1..w...Cr......sg..3.1g.b....nX.V.%  ....,?.......u.......(u"..cj
5.....$q.$..L.......%...8.%.....k5.f..6.o.s..3.2SO......W.g.&..C....;w
....vt...(.YWR.!.........>.ub......1..s...QJ...k-...&b8mm$..h.s;..}
$w..f2....t....L......|.7...C..NL`D..b......y.m{..r...w..M.1@.\&..Q(..
}.i .u.d2....L&....Zj6`-.H....)....?......6}.ZC...."......(...........
.B...".r.6H.]"........v...]w....;ikk[ ....Z.j:..5..~....N.R........2..
[email protected]%.=6.!..<...~.......>:;;._.........)..9L.
.3XQ...T.Q..JaH5...>A...N...x.uy'.....L.......i..9....I&.k\e3.f;P..
...J..u....B..c#..D.....|.p.2..}F..t.....\A.;@.P..G..._.*'O.\....0.bj.
....M.F.Rh..k.u[X&_..K.\XZ..2..-...D.T.... ..D...1.|.A^|...m`.^d[.8.f.
...!.\.Q.......k.N.|.....9......t.K.].fcq|...4....f.|....X,../}...d...
F....u..\.:[email protected]..|q..F...,....U.....Er..5..5......
... .......r...k.vV&....r....5. .........."P5)..../s{{;.g2Lj.xh.6!E..Z
...iM&...j...O.`...s..Q.....w...........)...].T.c.;I...._..1d..i.<v
.R........ .Fi..B..2..bViW..<...<...tww.K@Im=.)x..6.%...d.0r[X..
...#.gS:EW"AZ)..3.....R8J.Zc../...y.X"^...|R...?Z.1eB.0 ../..9}.4.=..J
d_%k....1!..o...>J)B..8.'n.. (........ .._.sq1...S.W4..5"...B.(...3
.(.....J.E......<....8p.[n.eMdt..%ZYb....W.}.d..E.....U)1..........
.....Gu\h=c.=.gh....%...\..R...p.....x.j..B.......K,.ql...mC.<.c...
[email protected].!....|.n,!..{.F.Rc..f..1H}.0.3.9.
<<< skipped >>>

GET /icon/11653m/idm-scan.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3759

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Mon, 03 Dec 2012 18:20:31 GMT
.PNG........IHDR...0...0.....W......vIDATh...i.#.q....n4...{j..L..(9..
._..P.").;[email protected]..\... b.Q.%[email protected]....^.....a.(
.q...`......)[email protected]..^..........H.>h.....|.J.`...Y...`Y.. -.....
.8DM/...|X.9.W*.k/.........nxP..jIQ/.....5.{ZBH.q$IJ.L..9..b......j.7.
`....V....a.>.%..G.bW=.....Z...1....6o...:.Ip6%..&...hAj.8;E..*.&..
`..y..G.~1..z..........R...;.....#.EU...3.G.`...... ..v.d.`>.$KOqv.
....C......Y......_....{Tr..h.....j.h.A.....UPj....&..PGb'...,f/......
.......sG.z...;=E.4.ix...........f\..3....O.E..P9V....]...)e.#/...%e.C
M.....U.&...d.,f..L..L@].Q.F}~....uB..P4 ~z.K..ZRs...o..W.T...*_.....R
-Fgd.%......YM..X.......'.....l..]y..r...kNg.p2C...G....Fp.*G..x).[..'
G..&.>.Wf.5...?}[email protected];.|..u.a..e..H.lA*..R >&
gt;mxX.......o.2P.<[email protected]}R.(......D.M.X.c.].WK>-..}...fP-...:
&..NF.......M..N.Z\p:.G^>..~`W<.. ..V|z../.xy.%V...T.W...z.,!DA 
9...*%.0I.8..d...v.W*.B....B.Q.K...e.a.-upsxOUA....l.${..zd..a...j..`U
...{^]|Mb......... H....'....d./^. .......*....j.P....'..d....cQ.#..}.
...V...7L/...w...#..PiY......g.`...z..L$......J.W....Q...J..L...-..za.
\s..'......vxt.vx...A.`5c6z...?1...ac....l........"..(.g_/.E..u,...-..
.-....[@A<..#{....I..4..{...=r...>".....VNxu.5.;...9...........S
.a.............XU....l3s......9...^...^`.}.T.|.~Gd.w.b.sy..C.J..z...(.
.....J..l.GT<..b~.j.........0..\....A.........Y{.D..A1.?...Zf.k....
....).....JH..^Q7y..1.lLQn.....cH..W...1G.#...[...}_U{Oy...E}..]r...1.
[email protected]. .......I9..#e.. '~.N.!..Q?..\.......1...`
<<< skipped >>>

GET /icon/9277m/winusb-maker.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3759

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:07 GMT
.PNG........IHDR...0...0.....W......vIDATh...i.#.q....n4...{j..L..(9..
._..P.").;[email protected]..\... b.Q.%[email protected]....^.....a.(
.q...`......)[email protected]..^..........H.>h.....|.J.`...Y...`Y.. -.....
.8DM/...|X.9.W*.k/.........nxP..jIQ/.....5.{ZBH.q$IJ.L..9..b......j.7.
`....V....a.>.%..G.bW=.....Z...1....6o...:.Ip6%..&...hAj.8;E..*.&..
`..y..G.~1..z..........R...;.....#.EU...3.G.`...... ..v.d.`>.$KOqv.
....C......Y......_....{Tr..h.....j.h.A.....UPj....&..PGb'...,f/......
.......sG.z...;=E.4.ix...........f\..3....O.E..P9V....]...)e.#/...%e.C
M.....U.&...d.,f..L..L@].Q.F}~....uB..P4 ~z.K..ZRs...o..W.T...*_.....R
-Fgd.%......YM..X.......'.....l..]y..r...kNg.p2C...G....Fp.*G..x).[..'
G..&.>.Wf.5...?}[email protected];.|..u.a..e..H.lA*..R >&
gt;mxX.......o.2P.<[email protected]}R.(......D.M.X.c.].WK>-..}...fP-...:
&..NF.......M..N.Z\p:.G^>..~`W<.. ..V|z../.xy.%V...T.W...z.,!DA 
9...*%.0I.8..d...v.W*.B....B.Q.K...e.a.-upsxOUA....l.${..zd..a...j..`U
...{^]|Mb......... H....'....d./^. .......*....j.P....'..d....cQ.#..}.
...V...7L/...w...#..PiY......g.`...z..L$......J.W....Q...J..L...-..za.
\s..'......vxt.vx...A.`5c6z...?1...ac....l........"..(.g_/.E..u,...-..
.-....[@A<..#{....I..4..{...=r...>".....VNxu.5.;...9...........S
.a.............XU....l3s......9...^...^`.}.T.|.~Gd.w.b.sy..C.J..z...(.
.....J..l.GT<..b~.j.........0..\....A.........Y{.D..A1.?...Zf.k....
....).....JH..^Q7y..1.lLQn.....cH..W...1G.#...[...}_U{Oy...E}..]r...1.
[email protected]. .......I9..#e.. '~.N.!..Q?..\.......1...`
<<< skipped >>>

GET /icon/40m/norton-removal-tool-xp--vista.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3997

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:46 GMT
.PNG........IHDR...0...0.....W......dIDATh....ST...?w........(...T*..r
...fav.d..#...&....,R&. .*..T.q.Q)..B.F...64..p.wA=On....{......>..
.=.{..x..........([email protected].=..)....7-..6..<
...."%\.%...H$XXX .J.....y....ix........iTVVRSSCkk ....B!TU.g.{..... .
y....-.L...3...)))......&....D"....-...r..i..4.....y...9r...h.@*..(...
.oa...E...y..%...tuu...H ......G ....r.m....011A"......G.R]]..i.......
~.Y[[[email protected]............$BkkkLNN.H$.......P
($.-..M..............o.&..r..I.......r9...X]]e}}...u...D...h.F(.".....
)--.0......KEFGGq]........!.zo..p.EQ......~.......S^^N.P`yy.D"A*.bmm..
...~.......f....u......m.x<..........Q.T..[!................G0.$.J.
...........`...-&..d......&..H.V.E...............g.....y.....O?q..YN.8
.i.,,,011.....mc.......-.n...............{....:..>.......1.C..u....
......p......333<y..d2).........?....r..q<..4M.?.N4.e..=8...8...
211... .htg.s..H.L&..................CR.T..~.nw..0dp.D&..u....:::(--..
mFGGI.Rh.Fgg'mmmx..eY$..677.t...`P...*..wEQ.m..w.....O.F.4......>..
.E..w..a.D.Q....F..B!.....m677YYY!.....Fcc#...8.SSS,,,..*.i211.......M
....cdd.X,..c..........SSS...SYY......?frrR.._p........P__/.^...PQQAss
..D...H&..b1.|..c.&ccc...PSS.............&...(...B......F.477.L&...bxx
....,K&.|>O.P..<..;.......x.'.9.,..,....{<z..l6K.P..,....i...
._...eY.......S)<.*"....,,,H.K$......f.m[.o.&.e..:......S...8..aQ..
..?.(......<O.E.,.....&....jiiadd.L&.O......c***.F...i........ ....
....g)  .q.\.%...i.,..;..=..YW...8tvv...[d}..........A..#...i..X..
<<< skipped >>>

GET /images/social-icons.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 2227

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-8b3"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...%.........FI.N....PLTE..........y.Kf..!1-D{d..)....
.......Xt./-..u..{.*.....lkk......Ts.c........&$%j.R...857.bs.........
.....?AX....fffF^....Ql.'..y.....>........[y....JZ....1...M^333...h
......F}...*))h}..........Jc.B........M..Lh. ..Uq....R...y........':..
.;9:......,..!..xNS2....TSj....0I....u........"!!f....................
...*..%...}.........`xoMJ........:.!v..t..C[....<...*A. 3...,......
..utu......Jc.........tRNS.@..f....bKGD....H....pHYs.................t
IME.....3/..(.....IDATh...._.F..S.sE2..=.f..."_.5Eg 2...68.1....m"....
 .O.s..%....G_.......}.PJj.i^9..D..i.V.{..\Y....K....>.it=Y...`}L..
.......2..n..F..l....1k.7...8,H....6,;......nY..u..T....v...,8..E%....
.K ....X,.5n...V...P<99Y[S.j.[j.......ZD0 .....i...r)n.$.3...U.Ev..
...pn.X.n-.|ii......NkIAZjMd....W.....w.#[email protected]...
...p..Z....Vg=... F`.......|gV~\ j8.WX.k'.........<...Y";....d.!...
.G.a...=z|z.Gn'........|%....'.F.}.k..w...d.A.i.u{[email protected]".;..Fn....~.
....$.:`0....GGGp.M..../(..I.r....%.\rN.......g......n.n.....u....|...
nU.. .K.`....[...p ..R...`whU:.....y..p..G...^&.Tn.....$...2].....,..&
lt;_...Q.YA.p.......:|.y....Z:...%Q......l...X..*.6...|.O.bq6.........
..N..-;T...q...oFN.........x.-%......-;..K.. .'.X...Jl/<.`.5G..B8m.
..7[hnnn.N.Y..W9..Id....$zo<=z|.d...O......N=....SO!jybkk..dqq.=...
.X.h..-(.rW...w.Z...D.....B...p/f).20...Un..&...*.k...H....b<.sQ...
...f...%..c.<....3.....R;.x.Q&s....o...U.4Z8.}.....'..........5....
{......(...j.5-(];...q........$..NT......2KXw#...%l...}p_.6...N...
<<< skipped >>>

GET /images/buttonbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 127

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-7f"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR................(...FIDAT...........h...........=...=q
.... s...'skV..x...!..IKl....4.-3......C ...F....IEND.B`.HTTP/1.1 200 
OK..Server: nginx..Date: Fri, 25 Sep 2015 03:34:04 GMT..Content-Type: 
image/png..Content-Length: 127..Last-Modified: Tue, 30 Jun 2015 14:58:
31 GMT..Connection: keep-alive..ETag: "5592ae97-7f"..Expires: Sun, 25 
Oct 2015 03:34:04 GMT..Cache-Control: max-age=2592000..Accept-Ranges: 
bytes...PNG........IHDR................(...FIDAT...........h..........
.=...=q.... s...'skV..x...!..IKl....4.-3......C ...F....IEND.B`...

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 20 Aug 2015 18:11:19 GMT

Accept-Ranges: bytes

ETag: "803dac9c73dbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Fri, 25 Sep 2015 03:33:53 GMT

Connection: keep-alive

X-CCC: AT

X-CID: 2
1401D0DB739CEE64E9....


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Thu, 20 Aug 2015 19:08:01 GMT

Accept-Ranges: bytes

ETag: "803e6c887bdbd01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 50006

Date: Fri, 25 Sep 2015 03:33:53 GMT

Connection: keep-alive

X-CCC: AT

X-CID: 2
MSCF....V.......,...................I..................G.` .authroot.s
tl.W....8..CK...<T.....c.5(..=..!Ev"..d'..c-iTBWI.H%..V.........E.%
)...f....uo...~/.3..s..y>...=..l...dbUH4M...1....&J.}<...#.L..\.
x!F.t.^......q..l8p.i.J'3.........J.5v....z-...A4U.T.E...h...}$.....5.
=.....VnU..E.[.[a(.."..G..P..k.m.3.....EP>.g..?.kY|..L.v...qDz...T.
&p.&..:.f....T.b..\...Af\..J..I.....tN09.......|,[r._..x..Y.e.(d..o...
`3........(... .$...V..e.y.s$p...u...........W..~...A.B....GoOV.....JT
.."VF.<.A....3...r.......addf`.....ph.J:r.E..[\L.X.:....?.. .....b.
..l....St...U.N;..a.h-W....4.Uqb.MbF=.X.C..DX..............V.U..P.....
'[email protected]:...5..j7[.!Yb|.....l...G.
F.E..?lg..m-n.(/6I..........._......5........n.t.<.'....Nim..;.!{..
......N.h...u.....x`... gR..B..V{.'..=}..=|.hg.9.6....j..w.[P`.G.....d
..............!..t./..........*.@(8(v1....'..Z. ....R.r....1Jn.j.[p..A
t..W;F.(..a...N...X....=.[..'.r.....^$B.a...9....,v-...%.2...:...[..6.
j...1..!{.....n..={.U....%...y,.....>a`..0..6..SJda.)9x...zqc..X..V
q.1z.....'^.....^sU|$.u...~.Lgf...Y...V..(f.(...m...-..-&,..c&z...-...
..fGO..6...N.y<.z..,...g|.....!..$....<....q......q8.<t.k.p.=
......z.}.Q.U....&J..-T......[...........}u...T.......>.y.e..CF".VX
$;&T.>..].3.H....7k..w.m...(..#[email protected]....[..l..w.e.2..3..(y. ...
|K9>...o..Uz.....V..W|.k.|...,..V.xPmV...X......!.........Jj.%.N_.9
T.~...v...C.!.4.5a.!...(..../[email protected]....
......D~...%y.....i....a.$vu.7...{.6.{Y3....5.YD.d>,.....b...H.
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/B1BC968BD4F49D622AA89A81F2150152A41D829C.crt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Content-Type: application/x-x509-ca-cert

Last-Modified: Thu, 23 Jul 2015 23:16:35 GMT

Accept-Ranges: bytes

ETag: "80b4b9e9dc5d01:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 889

Date: Fri, 25 Sep 2015 03:33:53 GMT

Connection: keep-alive

X-CCC: AT

X-CID: 2
0..u0..]..............KZ..0...*.H........0W1.0...U....BE1.0...U....Glo
balSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...980901
120000Z..280128120000Z0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...
U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.............0....
............O.~....%k.H..*.......c..gf.....H ......).e...-....Lp..=.0.
..O....P...P......R..}.m.50.^Cs.A..j...:V98o.<.i[*M..T.l....<...
...<.x...tn.Da...F.u......ml.x......8..$.OsT...:...4.....w.... ...S
n..{7t.pG."Qc.y...A&... .F.H.d*..4.,*.l.CJ....|.!h...R...........B0@0.
..U...........0...U.......0....0...U......`{f.E....P/}..4....K0...*.H.
.............s.|Ov.......4.(2.|.l., ...S.k^..H......=aM.F..>...cU..
...9.C.8../.&;..PV....8...pQ......_.....A..]ud...U0......,.cF.....i...
Hd......).........i,i$x....qb......]...G.n*.V1..g.. .l.]F......Q.p..V=
a.j.\...=.A...cR.SS. ......_..A..........o. .......fU..H.)&i.HTTP/1.1 
200 OK..Content-Type: application/x-x509-ca-cert..Last-Modified: Thu, 
23 Jul 2015 23:16:35 GMT..Accept-Ranges: bytes..ETag: "80b4b9e9dc5d01:
0"..Server: Microsoft-IIS/7.5..X-Powered-By: ASP.NET..Content-Length: 
889..Date: Fri, 25 Sep 2015 03:33:53 GMT..Connection: keep-alive..X-CC
C: AT..X-CID: 2..0..u0..]..............KZ..0...*.H........0W1.0...U...
.BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign 
Root CA0...980901120000Z..280128120000Z0W1.0...U....BE1.0...U....Globa
lSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0.."0...*.H.
............0................O.~....%k.H..*.......c..gf.....H ....
<<< skipped >>>

GET /thanks/?q=Google Earth HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.winportal.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Content-Type: text/html

Date: Fri, 25 Sep 2015 03:34:02 GMT

Location: hXXp://VVV.winportal.com/thanks?q=Google Earth

Server: nginx

Content-Length: 178

Connection: keep-alive
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx</center>..</body>..</html>......


GET /thanks?q=Google Earth HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.winportal.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:34:02 GMT

Location: hXXp://VVV.winportal.com/google-earth/thanks

Server: nginx

Content-Length: 0

Connection: keep-alive
....


GET /google-earth/thanks HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.winportal.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:34:03 GMT

Server: nginx

Content-Length: 4931

Connection: keep-alive
...........].r.H..;y.YN.b._.. @.!ec'q6N....n*.....u!.0&.y......oF..-..
..V... ....7==.=../{.;.....A.......\;...J.0.n..x<.........i.5 Sbe.n
.#.B.._y^..d_...y.SJ...k{..-F%.n;4..Q8....u.*u<7.n(.N..D..W....Pd.&
lt;'[email protected]....... ...Y.I...<.............
.....V..Vw.Z..i}.....?..-....n....\...L...-w...nW....\..e.....^....oo.
.^..W.AjA%......7..EOw,{....a..P...M...a...y..%.......w........_.[(...
....R....R.d4x(W".5-.U.....a..".....CJ..I...n..h.F../.Z...~..i.>...
....g......m....YQ].Wzt..&.J..y_.BZ..?..O.....X.......9...ax#7,?#...A.
Ku.!.....y.;. ...u..eT.b..3....`.o.........G.pe.q..Fo.......oP....A...
#....q.C.oS.k..1Y.|N.z.u....."(..z0q.....e..V#......`.LZ..l...1.......
.....b..e.....Yy.....9#..nOB..f.z...Q.l,.,G}......S...zh..'..s.T...~.y
[email protected]..<.n..g$...ms...b$..S|.ui.3'..O.M.....@..}}8..a7n.eK.Vx.'.#
;...d..OX](..z@mj..,....m..m...b., .~. ......Iu.V.........0p9.....O...
z.....U1...S.c9.X vA.e.o... 'C......y)e)y......:..i...;.E .:...~,}...|
.p.......%/.a..~.4.<bq...}E}Gw.... ...z:.> .>...>[[email protected].
...\D....#........ .......O..FA.C.y1......#....s.......'P......W...gp(
.Hb.r.4c!3...O..U#.B.X..~..vx....|..VI....6..e,?...r=U...."P.D........
.........5.......*.. L...0..3%..._J.d..8-....t...4..kfd.r5..m!.u.6'...
..l....u....N..>..1..?$o...*....]j...$...kF....<aJ.X..LE..tm....
.........Y.c.~..o...)7..."WV`...'.$..{A..GD<..g{6{.....L..V....e..z
[email protected]....`....R._......TUV.&..}..,Ke
..../p.*.^..-3.....Y&.j..a..I.t...$..S....\...r........snr./f.,...
<<< skipped >>>

GET /gs/gscodesigng2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.globalsign.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Fri, 25 Sep 2015 03:33:53 GMT

Content-Type: application/pkix-crl

Content-Length: 1802

Connection: keep-alive

Set-Cookie: __cfduid=d228cb2a9e0427670368786a53e6746e51443152033; expires=Sat, 24-Sep-16 03:33:53 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: 015432

Expires: Thu, 01 Oct 2015 23:00:00 GMT

Last-Modified: Thu, 24 Sep 2015 23:00:00 GMT

Cache-Control: public, max-age=588367

X-Cache: Hit from cloudfront

Via: 1.1 b47ef3766a859c0c1ae31872e114e497.cloudfront.net (CloudFront)

X-Amz-Cf-Id: jfhWD9UoHBaO17LVteJh2FL9nAdzdBBNmX6Dkfjxca6y3AQCzPp8ag==

CF-Cache-Status: HIT

Accept-Ranges: bytes

Server: cloudflare-nginx

CF-RAY: 22b3ab91b2ec1467-AMS
0...0......0...*.H........0Q1.0...U....BE1.0...U....GlobalSign nv-sa1'
0%..U....GlobalSign CodeSigning CA - G2..150924230000Z..151001230000Z0
..40#...!...z..g{g.Mt..G...121120180003Z0#...!5....u.H.5.n..K...121121
154803Z0#...!a. ..5.Q.....g.Y..121127202406Z0#...!.9...^............13
0118021202Z0#...!.g.|.d..-,...A....130201163603Z0#...!......R..B.....h
..130212223046Z0#...!....oL$Ds.|...IN..130327184808Z0#...!,oYM;.LlE.I.
.D.k..130328114802Z0#...!Im..y..j.|-.`[....130515143603Z0#...!y......"
y/9r.;b...130828141203Z0#...!...r!d....%(...I..131111162403Z0#...!H...
...w.X8...(...131121104802Z0#...!.........G.5g-....131121104805Z0#...!
....d.z% C....(...140117143602Z0#...!z.....V....U..N...140117144802Z0#
...!/,.Hr.;...u..0C...140123114803Z0#...!.$u^.......O......14021208360
2Z0#...!........1..ITc.a..140224104803Z0#...!yx.mo`...L.s.1....1402241
04805Z0#...!.....u....e..!Kz..140303102402Z0#...!mv\......"........140
313101202Z0#...!M......Y.......f..140318134803Z0#...!%.t...Y.w.&e..^M.
.140326160003Z0#...!..8..Y.j.-.. .G...140610120003Z0#...!.l@[email protected]
w._..140831091203Z0#...!..../.....[.dCC...140831100002Z0#...!..d.8...|
..x,F....141203205323Z0#...!../..X.js..a......141204022544Z0#...!...r;
.'.....'.....141204022710Z0#[email protected]#...!7
..]...q.F...6t...150225074259Z0#...!..l.~...&n........150407141403Z0#.
..!.N0.,.............150422200911Z0#...!w.S......FP.ee....150512133508
Z0#...!. D.......*.Y.?"..150616081204Z0#...!.d....C.q.|)..5o..15090218
2412Z.10/0...U.......T20...U.#..0....n......>..t]..../Pz0...*.H
<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 25 Sep 2015 02:44:58 GMT

Expires: Fri, 25 Sep 2015 04:44:58 GMT

Last-Modified: Thu, 10 Sep 2015 10:52:20 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16022

Cache-Control: public, max-age=7200

Age: 2945
...........}kW....w~........pk..f......ZZ(O.,.!$$!q.....gft...>{...
.%.G..>..fF~2........;>..i...&.9.....v*.|x.|$....L.....y. 5.....
!..R*i..........>[email protected]<_-.|aa.......F.p,...
.yA.....Q.{'...kyA....^.S...'o.2......5K..2o'~.....F#....*.7...c.#.l.P
. >.L.j.4....h...L~-....JW.Z..bm.I.9....s..;...=..Ue...b....r......
...........).......dO.c....v.f...^:....=.}.N'.-4.5m|h..tb.6v..W..r$.@.
8................v......e...T.t.h.c:..(....~.e0.].....{[email protected]
Z.q.s.8...T...9..1r...u.KS..(xa!..{0!..5.4.^...7..."..........J8... ..
...O....t...q...|...a......a.V.q.5.e.([2..F[.........E...W.|....5a...0
..0...Ma.ML.....d....3.....=/.z`....i....ku#.4.b.Ra.^.:.-.j.*..L......
.A.;...Q.{2i.....}l..H.....T...Y._.Q!q [email protected]..!x!...p.e4...
'$c......x....'..AF&*i.../..@...!..zx..bq.{<..9...~..]...cW.Q....@A
...........U..}. .ihA..n..KK0:[email protected]>...-=...|..E.
._.W.pS..5....4.Ma..|.B......w...b>X. ...a....gV.1...ra!ZX.).,...[.
.*[.....)s8.. .....X8.c..D6'ai.6..Q.u10..N...p...>V.............!V.
......p#.....#.j...b......C....^........#..>E.`.........y.....%..M.
D.e...Y.HB.....a.G(.b.P.=.......'...&.T._.B..C......T....8..Ra.5.o.*..
.!.o..t ....`"@...='..<.Z.n..}`...m...TY...-...&".!.p....j...H....z
........|....H.....*...4"...K.0D8..2...`.O..R......../`2.6.F.W..,...2.
....I..Y....o...8..yA].....G.....8..8[..U.*x..).]...=.\...0<.pu....
7%.e?".P..f../.C??.h..8|Y.....W.j...^.O(.O.....3W\Q....~.N.G.Z.3.OO..W
.....7i(....c...!.Az....*...*..pdo.c4.k.%..}.......". ..f...{_.z..
<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.7&utms=1&utmn=862046335&utmhn=VVV.winportal.com&utme=8(page_type)9(thankyou)&utmcs=utf-8&utmsr=1276x846&utmvp=1256x693&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Google Earth Free Download&utmhid=518216089&utmr=-&utmp=/google-earth/thanks&utmht=1443152044410&utmac=UA-260627-63&utmcc=__utma=175431332.5609660.1443152044.1443152044.1443152044.1;+__utmz=175431332.1443152044.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=687375126&utmredir=1&utmu=qQAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 25 Sep 2015 03:34:04 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Fri, 25 Sep 2015 03:34:04 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

GET /icon/810b.png HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:33:59 GMT

Content-Type: image/png

Content-Length: 7611

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:33:59 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:00 GMT
.PNG........IHDR...@[email protected]..;@l... ...(...
.(J.fi.D.yO..8N..=..C...Bf.&5....8....GN......h.,...............w>.
.~. ...^.......{..9..Xk.....o"B....<.~.Z.....E.9..k..'...z.T...G..E
.U......[kAlHG.q.DF.Xjr..........(P.0>..SE.._btl.B.. .S)...ikn..&Am
.....<,j.P.4F..."[email protected]/.9..TL. ..e|....<GN....3.>
?...<.....M`tH..C...TB.....*Vww.i.jzW6.T..&...P.A.X.....}.h..P..K.M
t.[.0X40[..}..:6. ..9|j...".t....mM9.k.Tg}Z.S..*..K.....g|......Cc\..$
.I......t...nz......EU..{i........C..TX~..-.6.. Lk...9.|....=...,U5..^
......jK.....6Cu.'.C.!..J"....J%.L....4g..9x.<o.......-k..m....M.4'
.('..Q.\.o.........r7F.....c...O.._.....32'.....l.\....._.\_E]M..l..].
i.I..,E..Z.j.....H8}...(.L.-.........]..JE..m ...jV...Q........&P.W|AY
..k. X....[~....}.8G/.P..,....".....X....O ..... ...iK.aU#.o\CwK..g...
^..50W.v.=......7........7.{..T.....|(M.cL................<....9..N
..$......<......X7.5`u.1(...%.JS......{o....ki.M..M.i` ..|.w......5
g.....].......,..~).!....G.j..e......<.......wq.o..M!..{..X/.U>V
|D...9'k.F.......S....'.\{E.....m.:i.._.0..mN....'v..3o..g%....|t}3ikY
....b..Kz.............?}.....l...V...I....N04>..T."I./.../.h.....1`
.;.%'.].. &...2E.......K._K....0..j..al../.?.w.z.e....o....md.../...&-
..(.0.X~..a~..;ds9..q-w.p%.... ..T........c..Y......xe...k,.h.......X]
..%T(.t.).....?...l......X..U....W....{...../..'?....`d.m..}.{.P.0....
3|....mY....m<p.j:.}[email protected]... ...4.$..!(......J)D...... 
..F<.&..9~...zV..%..0Y._.. ..U7...{y...W.v...:t..B....!o,/....?
<<< skipped >>>

GET /css/ie7.css?v=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: text/css

Content-Length: 165

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-a5"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.col180 {width:180px;margin:0}..dl-button img.icon-download {padding-t
op:10px}.#searches, #software, #download {margin-top:30px !important}.
#categories {height:30px}HTTP/1.1 200 OK..Server: nginx..Date: Fri, 25
 Sep 2015 03:34:03 GMT..Content-Type: text/css..Content-Length: 165..L
ast-Modified: Tue, 30 Jun 2015 14:58:31 GMT..Connection: keep-alive..E
Tag: "5592ae97-a5"..Expires: Sun, 25 Oct 2015 03:34:03 GMT..Cache-Cont
rol: max-age=2592000..Accept-Ranges: bytes...col180 {width:180px;margi
n:0}..dl-button img.icon-download {padding-top:10px}.#searches, #softw
are, #download {margin-top:30px !important}.#categories {height:30px}<
/font>....


GET /images/blank.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/gif

Content-Length: 43

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-2b"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
GIF89a.............!.......,...........D..;....


GET /images/grad1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:03 GMT

Content-Type: image/png

Content-Length: 221

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-dd"

Expires: Sun, 25 Oct 2015 03:34:03 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...............u%....IDAT(.uQ[..!......%....~...n.q|@.
 ..!."!`N..H.3!..).....B..|'.W.K7yc.L\<.......U............>....
...W...K.U..._T.U."......Z7........._.{.......hM.....5..y.".9.~Ya...q8
..#......IEND.B`.....


GET /images/langs.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 233

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-e9"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......(......1......IDATH.c...?.51....3.....N.b.j.(..
..... Pj.....P6E^.0.....4.....0r...p.....?.;.....:@...u!..........20..
..(6p.p.5p..Q...8W..D.n...(4.>..4%...I$. p....h.5.6..Q.@.^..~.J..t8
j.`2.......N.h....IEND.B`.....


GET /icon/1383m/installshield-2010.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3081

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:31 GMT
.PNG........IHDR...0...0.....W.......IDATh.....T.u.?..73..]X.,,.kvY...
.qbS..];..X..CM.XQ..JREU........Jv.G. E..FQ..v..6vDc.ZIll.L!...`....b.
.3..=............^i........{...x#.9..8D....... .-.T.. ..@ .p(."....w..
..*...f=]ca.....i}`..E...}.|[email protected].].n.&f.w.....R..m|.R.....
q~..^H3..j...`;.).XU.S.l...par....8.......Q*.....m.D.....\......).....
..t..'.:.O.g..).j......L.h...z>[email protected]...{.....F'.%..
..I..y.....{G^..8...Ap.a...U......_%.<..J...A:Q.y......G.....G..b..
.cc[S?..#@,..2\..<...p...\...k....w.q,...;0.....5.[4._.$...}k.g.M..
s/r..W.m.Nfffq...q.k....^SN...Z......>|..=..r........3Fo.....93~.U.
s..1.q.B!u&Rv)WJT...I...`>5......I........J.. ii0h. .%.f.j....e*q..
.N....T.Yp..m...MkC....V....I..4.h.L.......J..7.0.....Z...3~n.K.....T.
..h.........p.J.V.SK.]l.Mk.p..l....J......>..0....7....O_.J5`...x.U
q..RS..R..t.a.^..)...`...............j...P.!........y.p....0...5...s..
.H.S..C..M.......".s,1..>6..wM'.%!...0=s.#4kK.U.....z....`M_'.F6...
.P. ...U.}.^...o3}.R.[...k.OG..l..R).\.Y.&.ZD.h. .P.4.\.|.......9~..].
...`pM/.?{........VQ.7n_..}[...syf. [email protected].......
.t...-...........neg....k.2.../N.i.......].y`..'..5h...H.9s..)>8...
....1..>9...^<.*.O.aeO...Ul..b..F............]..>p.e#..c7...Q
...@... G.}.....Z.k.!...UX.&.^.3~a..^.....\BL.......<L_W.Pv..eth5.N
...y..5.H..i..'..3....B.C$E{........$..m.f..G_`..M..U.........6.E^!,..
@[.....L.:b..lZ........Q.)......c.<......{._Qib%B...n....23.l-...eu
......i4o$.....Z.8ud..Tb.'...o..o.]....et.0.~........C........N.m.
<<< skipped >>>

GET /icon/875m/animated-inverse-cursor.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3635

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:39:03 GMT
.PNG........IHDR...0...0.....W.......IDATh...kl\ez.........xb;q. ..VKA
.PV*..H....RQ.J...ii..>..*[email protected]`!.J..$&...xm.v._...
s.......9.[.i.U..h........y.PJ).T. ...P...u.(..T4(./.......!.R..Q..z..
S..jPj.Mk:.*.PJ5h..X..._>....6.)..PpE..YC.PeV..o.....- ..Z...5..x.@
........R.......\H)|...k..{^..s..q.....~..G.....n.k...q...............
.....!.n........*.p]..]..u...1...I..8r..'O....0.L.../....244T...>G.
..j..*. .....U....3.G........85.).X^^..g..........<..#hZ....k..>
.(....aX.w.m.q.=........k....{..........o..{z..S`....=.o..."........._
gdd$n.%..r 9L...m..$J):;;.</2...<[email protected]*..
4.)%........y(.1;.#....#........"..0..R.G........155.......F.uD.PP....
....qH.R...........,.....,.t&..].H.R...`Y.W....:.......].9}.4mmm....H$
hkk..<...8w..---..EL.$.H.J........h......6m.....O?.....<...V\.e.
...0.......... ......v....Z..F............m..,.!.]D4.M.ih..p. ..R^u...
T.zeV ...5..q8u..o..6.....p.8.......\..hX`ii.......'N..[o5. [email protected]
J^}.UVWW...A....q.Zt..2....r..e.o.....%..<...~.ggj.0.....9|.p...|..
...4................h.#..X,r..a......Q..R..../...={..y3[.lY7.T....s...
....37...5....R,....o.t#[email protected]..).&...."..A.J%........a``.T
*....A.S,..........,..X,[email protected]]...H$..aH*....m...V.
.$.....P(.i.A.......i.W.\aff.D"AP..../.{.n&''...r.<n ......v..?.eY.
!p.....J...w.....mr..}}}...088...gI.R,//#.$...L&..m......N>.'.J....
....J.......5.@=.TSu.SIH....E..0.e.{5.pV?.....s..a...DT.U...aU...qa...
h.x.f.K..5p...H..m..}.....0==.......L&....O..O..]\...6..!D...G..3'
<<< skipped >>>

GET /icon/752m/pdf-download.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 3738

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:58 GMT
.PNG........IHDR...0...0.....W......aIDATh.....%.].?..z...e.g.,=.Z.!y.
!.2.....oDp..........p......`N>.D.........d)..G.f...=....2..!...{..
.dD.{U......._.xUE.b.*"R.....XS.....YEA...G....J.Q.....R.......?......
8D."b...G....{..~.....}I..$.....1..T1w..U.}.......$I.L&.c... HN.A"@...
?$b....T.Xd.$...2,G=.(... ]U..j..t.E.....~h.jd..G../..jp.......r/..e..
d...Gr...Ge?^...f..........Kx/.".z.B*...R`_..H..d<[email protected]....
....;P.8............p.D..GbFs.=..b.n.......f...K..!.E4....Adj...;"k...
Z\...s.|..2.M..9Y.2.....;...?......Cp..*........>g:.\~...n..=n0.^.c
.b.......5$...].{w.t....,^.N=..S...D.)w.s..ts.,.-<..Gl.k..........5
.......k .*........_e.;@GS...g...Y;{........;.. .....0....x.J$...ab...
.[..*....).=y`.E.$5.{)......x.FWu..<[email protected]/......._I_...K.
..D....v1x.EUs..A.*i..v.u.B...eJ...S.7wpm.rWj$....f..Hyu...J.QUb.....;
4K...>...'...c<.V...[....q.3.P.&....R......5..9...T.Z.......E..1
....L2.1..z.)..X..'3.w....5.#S2.#yv..'s.w~.....;.......o1.z......]&...
..S....\.>g..8...F..Z....3...]..y........N.......v..Ly...o..g=.D...
....1..~..>v2....G..F..n^.N..&."...!..Y.....|.ps.........;VUP.[..&g
t;...H..m.-.tE........Y./.'|s.C=....{.. ...V.../.hu.F... .. .oS4Mq....
. K....M.......S.<..3.drt.\.&....s.N.a.PW...*..3N...g......[@.....*
[..C.N...]~....,c....*...t6E.....[.;...*5..E.8B..Q...Y.....(*.6D....6&
lt;.a..q..V.....E...1X.C..*..aP7|.7..'...kmo1....?..;._...].......(P..
$@... ..T.QV.k..".....c. ..*[email protected] .c..F.w.....!...[.f....|}..F.
..;..oBA"....I...l..PJ....Vm...^...tc.S.7..N...a.``.o.X.e0r.......
<<< skipped >>>

GET /icon/1412m/stanza-desktop.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 4103

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Cache-Control: max-age=2592000

Pragma: public

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Last-Modified: Tue, 03 Jul 2012 15:38:31 GMT
.PNG........IHDR...0...0.....W.......IDATh....o\.u.?wyovr..H...J$%k.#.
..;Zl...8Q..i.&6.K....h....@.? iQ$..(.4I.....v\[.M J%Q....eI..........
f.3..7......}..{.9.{.Ka...B....47!D..F.....lD..X'.-...r.7..?[.x...}...
...>..g..h.y7;-.!..s.{.......K...x......;..|.....c.;.......u.h.h...
.v......>-Y..W....Xk. .w.v..i....UFl...E...c,.(..(..... .J.8.RH....
.H!At...........t.M!.B..I....-.'...X.1..P).....G..LLL..\..twu...>..
...H).B`........i.L.m..N...\...3..J.T.h.g.FI...........L_..w....m[.T*.
...a..._.......NmW....;.vg.*g...y!.I..Xk..a.a......k..Z>........i|.
..Y.z..F......={PH.....!O?..2.T...........b.R(,.)5.-aE#..-..1P..F..td 
.C^{.w.?y./?.$.d.|.....869...W.Z;....@h8{...=.m...A.b.!.MM..A.cBCWW.X,
...%]@.._.z(![.A...n......7....H.H.S..]=9v......9~....y....?...F ../~.
SO=E,.'.}. @J..W.B...........o.'...B..qZI.....2>[email protected].
.g?e..i...l...)l.sz..o......d.........`.RJ....|....2.X..4~V..........n
..`..X..!....#.*.A./(......x..../..rb...?....L.../.....7..............
..........EJI>.D.RAJI6....-..]d.rPCC!D$...O.o......1...\.a...}..Q.b
...<*U..7..5.;...._.H...}......`..&...............b..-.u..o...V...\
....;H.S$2i6.......z.GF>E.&c.y.!..p.U.....r.......;.._.X*.U ..Oh.q.
...x...\.r.m........0..p...(..v....=...u...=$...?y.R..G...............
.........5.T............x~.......78.w?......p...CbP.e~.._....t...>.
..?....z.5s....B?...i...A... E.....s...<..or..EN...W._......~.q._..
...1.......l.....{..E../oEM....[3.........(.........|.!AY.... /s...v..
.g.}...>........r=Y.6..Jd.X.1...c.X ...g....[..............>
<<< skipped >>>

GET /images/footergrad.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 192

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-c0"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR.......x......Z......IDAT..e.A..!.CK.:.?.....L.....i..
.[k...[...~.p.}..n.....mI....T.X..2l..G..D...c).,0D.ek..qp.<N......
r.`....O...E..r.J~.W...........3.....ll.F.e....IEND.B`.....


GET /flags/flags.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: image/png

Content-Length: 8050

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

Connection: keep-alive

ETag: "5592ae97-1f72"

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Cache-Control: max-age=2592000

Accept-Ranges: bytes
.PNG........IHDR...`...7.......Ow....bKGD..............pHYs...........
......tIME....../........IDATx...y.T...?.v..3.....0"...WL.....&......$
n...&.E....5.7&.$n?5.Q0... ...$Q.E@.}[email protected]..{..S...
S....).Er.x.p(.....q.....r...C.Ge..?......cZ.PJ.i.......".s.Sm.ED.jk-.
............'..I.B...L..k...>.9.O... .....8Gv[..l..C...".N...`%....
..$..../..... .@.....:.~...b...1............K.....~E..E. ......Db.MF.k
.......z.u...{..C.Uc-. ,-..P.1.........3..rT.5..U........ ...t*.V..v..
.h...x..^......".u........AX..16..3...VD...L...C.....X....=.C.._..~C..
.d-b5._..EkD .(Dk..N..V6.u'..~ .;...b.k.T.e..A....*..).?.....8..../...
[........(.p...0.i-;.k@;..z'^...."..\...."..;[email protected]...
.0<....y$w....s...h.AA.s..:&)..XDt..}Q.h\hGT..l........XZgYl^..Y.(.
j.(.....)]P....#...56a.[....F.oQ.... .....PY....K.....81...F.M.`..w...
..l..-..2bX..h..9...%....i........ ......7W...<l.....5u.WdT........
..{.^[email protected])...k.c...Uw...7,.:..s..*.....(]...^.)
.[.8..=.TN,[email protected].....'..U.sX.cG.W~_......./....s{.x .....Z:...
.K._../NCl.4..w....||.K..5-....V.....mgL!.p.a.`.Pm..}.......[.X...k.{.
%..........`[email protected]...........(....^f..I..Dx..,..%.Z.bA....
...=........iL.i.3...K..:M.7.X....-Za......SE.K..i..!c.......u|}...^..
....._.L....alL.mW.;.....e..J..D.. ?=..Z..w.*..........1G.O...m.......
..uU...s...v.e<......h..zW.&...^$.....K..)i.k'....' qSJ\.1.A.......
0..qX..o.0....[0.(.0s....B.`..p.{.. .......4...Q. FA...j.fn/P`....jnz&
...Vf...D....z.17e.....c......z.V.-..`...C.Sx.hp..5Do...;.._w.....
<<< skipped >>>

GET /min/?g=js&4 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: wnpcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 25 Sep 2015 03:34:04 GMT

Content-Type: application/x-javascript; charset=utf-8

Content-Length: 6049

Connection: keep-alive

X-Powered-By: PHP/5.6.12

Expires: Sun, 25 Oct 2015 03:34:04 GMT

Vary: Accept-Encoding

Last-Modified: Tue, 30 Jun 2015 14:58:31 GMT

ETag: "pub1435676311;gz"

Cache-Control: max-age=2592000

Content-Encoding: gzip
...........<ks.F... (9.."...K..i.e..[..v..m....@`H...........=.....
.]]U..3===......cE......d6O._.LWYT%y..U.EiX....u7wa. .....].~....K.s2K
N.QA.U...yR.4.....n.sp...<.hV...O.....d"...~zX. ....m.W...5..0]Qw.s
....0..&.....`.=9Q ...Sk.a......t........8.'.M.7Bf..l..U...$K..|....A.
.c.aEgy.0.....j..p}.8..$.r...%....'..L...8..YI.....^.h.2O..f....\.`.%.
i..........:,.M.Y.~.GI..'...3.-..C...p...b.v..f.IE.4.cG..fp...\* 8..8.
.............R\....q.6...3m...R6..y..< ..s}>.)_.....a^v...>.&
lt;. }......Vv.........4..F..j!.[.3Z.D...L'.=l.>^...f....Cx..B..V..
ji.........m..w2....v.y6....=..h.m..~...`X9......F.x...g.MA..q...eo...
....sR..>.b-.f4..l...&...x...b...@:.8.B.....?.........[./........Y#
.......yA......C.k.............:.z..........5x1.W....VH{. ..\].\...L..
....6.......#...@....^...VU....F|.>....J......i.p9......g...xb..2..
.a8....M..F...' .p........u........sy..O}.'Q.O....L..rYe?....eRe}T2...
8..Pd..Fq..%}...W.H .|9..B........2/bZ\'.........0t..4...`.U.\....!8.q
:$9..B.>..,.x..^.'..L...(.........Q.w.........=Fx...|..5...........
F...UX..../...#....'...e....]:]L`..`4..^IS....A.....L&....2.Q..f.. ..&
lt;.d............4X..`.u....B...r.*..f...8.z..UU$.:@.....^.|.T). W..i^
8(...z.A.(9;;............BwG.y.R....6..B"t.<.".<...3P$.c|.De...z
[email protected]^..]/....,...?<y...f^...)...e..v....a`..,f6....e..
.......;..{,..<k...B......D.  .c @...l* .,...*.(8!g.:..rF....?.Y.$.
d/.m.........e....G..u..F......... .^.^.q..F...........a.......pG.....
.CP...c0B...\.....y'a.eV..,..."..4.\...y.sx.$..C..p........[(h.aL.
<<< skipped >>>

GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Thu, 24 Sep 2015 21:50:20 GMT

Expires: Fri, 23 Sep 2016 21:50:20 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 32819

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 20623
............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.
~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f
.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.
T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4
[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l
.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........
../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..
w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V...
.....V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^
.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g
..Q...S_..Y.....G)..T.".......<......&...*..Z.t%[email protected].
h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;..
...3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE.
.,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q..
..v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_......
..j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)
....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*......
..H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v.
...n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f.......
...&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3...
...i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..
`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&
<<< skipped >>>

GET /ui/11d/en HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public, s-maxage=900

Content-Encoding: gzip

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:33:58 GMT

Server: nginx

Content-Length: 1558

Connection: keep-alive
...........Wmo.6..._..[.....n.%...I..}.Z..0..%Q...TI..W....f.v..h.4...
.=..Q.;g........../......S..4}.`..g.3.0....L...aR......d\..._JJ..Xd...
m.!.6.M...-3<..Pa......~.aC?...8EEM..&.L..c..%.44.J.....B2Q..."! ..
\.d....i2.MK..y...yv.t..zq...3.p:.].....(S.S.7.L\.Z.*..NI...&...O.....
G...#Ey..Ys.kJ.F.... .QCKF2L8w...rV..R.G..2...Z..*...8S....P...dI.,...
..8....>aC..`.|[email protected]_Q^H..!v.R<g...J.C6)N.t.Z.VL.R..
. ....k.>...xS.g.t.Nj.l2.e.F..0.......H....dT..$.|.&.....y1|Ds.tN..
.....!F...&.B...-.*.;...J..U..w. ....RS8IA.W...s.....wE,..J..h.....
..k........c$P.E.Y..1(...h..Z..h.JSg......Em.st....6.D*.lY......,....H
a.....A.................mF.}).LpIJ<9.O.......>w.yj}.$o.v<..Z.
-......p.z..q...M .....}C...>.Z0J...yas.Z.^.>&...:.Nf5E./..25..b
.e.Wu..k.Yx.f0N!"....o..A..Q&.KA.df.......A.jX.L.<b.......JSuOC..l.
H......'..k. .L..; .d.;>.....E.............j..|Ia..q]...c..ax.H.!.Y
R}.aD..'.(j.!...((..:z.T...D.G.........)...;QR.X9-.:.R.....u.;([%...."
.j...."*.D."M*..0<.......D.@.......,.A.@....,!|...Od..fU.Q5H.....W.
_=!. )!e!a.j d........"Xq....f^A...3..9.....Cd.(0.c.C5........h...#...
[MsY.;h......s.q\[email protected]%...7k.TlI.5...nm..nb.....O...?...T"...t.St.
.u.Mlg......)....6.:(.......BO.Q.g..pY... .....'.....;2."'.X..........
!8.-.t.kjwo....b.........f../.%....[j...._.. l.W..Uu<.R.^}..v.JH..1
.......3...x'I......,T].2.dK.....{[email protected].."...Y....Vs,..|w
.]...D...E..&.rc..}2*~.CI.E.....f....YAh^t.f....s....7r..pG....m2.....
.6......S...:...6.].~e3T.&:...i<..z...^!.....^....<u..7.....
<<< skipped >>>

GET /s/app.min.css?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: text/css

Date: Fri, 25 Sep 2015 03:33:58 GMT

ETag: "5603ac7a-2aa3"

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 10915

Connection: keep-alive
body,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,texta
rea,p,blockquote,th,td{padding:0;margin:0}table{border-collapse:collap
se;border-spacing:0}fieldset,img{border:0}address,caption,cite,code,df
n,em,strong,th,var{font-weight:normal;font-style:normal}ol,ul{list-sty
le:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-weight:norma
l;font-size:100%}q:before,q:after{content:''}abbr,acronym{border:0}.cf
:before,.cf:after{content:"";display:table}.cf:after{clear:both}.cf{zo
om:1}body{background:#eee;color:#333;font:normal 12px/20px Arial,Helve
tica,sans-serif}a{color:#11c}a:visited{color:#11c}#app{width:730px;hei
ght:430px;margin:0 auto;text-align:center;background:#eee}div.data{hei
ght:375px;position:relative;margin:10px 0}#sidebar{text-align:left;wid
th:160px;height:375px;z-index:100;position:absolute;left:2px;top:0;ove
rflow:hidden}#sidebar .logo{width:140px;height:40px;padding-top:5px;te
xt-align:center;vertical-align:middle;margin:0 10px;margin-bottom:10px
}#abw{background:#ddd;margin:0 12px 10px 12px;padding:10px 10px 7px 10
px;text-align:center;border-radius:7px}#abw div.icon{background:#fff;p
adding:10px 0 5px;margin-bottom:5px;border-radius:7px}#abw p,#abw a{fo
nt-weight:bold;color:#777;line-height:15px;overflow:hidden}#abw img{wi
dth:64px;height:64px}#topics{margin:0 0 0 5px}#topics ol{list-style-ty
pe:decimal;list-style-position:inside}#topics li.active{background:url
(iconos.png) -253px -325px no-repeat;border-right:1px solid #f2f8ff;co
lor:#333;font:bold 12px/34px Arial,Helvetica,sans-serif}#topics li
<<< skipped >>>

GET /s/ender.min.js HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: application/javascript

Date: Fri, 25 Sep 2015 03:33:58 GMT

ETag: "5603ac7a-7a40"

Expires: Sun, 25 Oct 2015 03:33:58 GMT

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 31296

Connection: keep-alive
/*!.  * =============================================================.
  * Ender: open module JavaScript framework (hXXps://ender.no.de).  * 
Build: ender build jeesh scriptjs morpheus.  * =======================
======================================.  */.../*!.  * Ender-JS: open m
odule JavaScript framework (client-lib).  * copyright Dustin Diaz & Ja
cob Thornton 2011 (@ded @fat).  * hXXps://ender.no.de.  * License MIT.
  */.!function(a){function c(a){var c=b[a]||window[a];if(!c)throw new 
Error("Requested module '" a "' has not been defined.");return c}funct
ion d(a,c){return b[a]=c}function e(a,b){for(var c in b)c!="noConflict
"&&c!="_VERSION"&&(a[c]=b[c]);return a}function f(a,b,c){return g._sel
ect&&(typeof a=="string"||a.nodeName||a.length&&"item"in a||a==window)
?(c=g._select(a,b),c.selector=a):c=isFinite(a.length)?a:[a],e(c,f)}fun
ction g(a,b){return f(a,b)}a.global=a;var b={};a.provide=d,a.require=c
,e(g,{_VERSION:"0.2.5",ender:function(a,b){e(b?f:g,a)},fn:a.$&&a.$.fn|
|{}}),e(f,{forEach:function(a,b,c){for(c=0,l=this.length;c<l;  c)c 
in this&&a.call(b||this[c],this[c],c,this);return this},$:g});var h=a.
$;g.noConflict=function(){return a.$=h,this},typeof module!="undefined
"&&module.exports&&(module.exports=g),a.ender=a.$=a.ender||g}(this),!f
unction(){var a={exports:{}},b=a.exports;./*!.    * $script.js Async l
oader & dependency manager.    * hXXps://github.com/ded/script.js.    
* (c) Dustin Diaz, Jacob Thornton 2011.    * License: MIT.    */.!func
tion(b,c){typeof define=="function"?define(c):typeof a!="undefined
<<< skipped >>>

GET /s/box.jpg HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Content-Type: image/jpeg

Date: Fri, 25 Sep 2015 03:33:59 GMT

ETag: "5603ac7a-1cef"

Expires: Sun, 25 Oct 2015 03:33:59 GMT

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 7407

Connection: keep-alive
......JFIF.............C..............................................
!........."$".$.......C...............................................
............................."........................................
....................}........!1A..Qa."q.2....#B...R..$3br........%&'()
*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................
......................................................................
..........................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.
....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.......................
.............................................................?....*.. 
.j....<...Eg.......u^......:..FG.U ..6.h..e..?:C".xUm.l......R....U
..6P..z..i...4..l.....)....I.............{...F..a.S.f......Rm.e.69..RG
.Z.Eq._J....9..j.......w.Z.Z.......&..Wk..A...98.x.:1.:V......&._OZ..A
 ...t4..m.mg.W.,%f..x..V...~....6..in.)..C..P .v.....?...4.........h.*
.f=I.....t.....4....U...d....)...MW...9.vO..go............_.......e.A.
... .k....\..B...jT%Q.cV.i.M}g....(......s...e..[.{Vy...JxhAZ..S.Rn...
M.f&...A.^)..c.1....d.|...o...D.`. ...,K.....#O...v5...7>...".V....
......8.......3Eo.?yX~."[email protected]...,./.v.CI. ..4VR.N.....
V.A..O..^.....U5.O.B>."........c.E.).4m....I.8....:.iY..q.._W..R..M
......g.,...%Gy;...1fb.I'.=.....fp.................PE....4gc......k...
....%.......|P......GE.. 0v7........y......VQ..iZVGS..e.Y....Eoo..o|(.
..*..G.6...t...m....h...u...^[email protected]._.y.r........pKf[.........e.
..,L.}..m<.Ud.....S.h=(....by...5.....z....b...PY..I...k..W9.wc
<<< skipped >>>

GET /s/app.min.js?2015041501 HTTP/1.1

Accept: */*

Referer: hXXp://northstar.393532df4f28.api.socdn.com/ui/11d/en

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/javascript

Date: Fri, 25 Sep 2015 03:33:59 GMT

ETag: "5603ac7a-a450"

Last-Modified: Thu, 24 Sep 2015 07:55:38 GMT

Server: nginx

Content-Length: 42064

Connection: keep-alive
var _gaq=_gaq||[];var _ev=_ev||[];var ERROR=1;var WARN=2;var INFO=3;va
r DEBUG=4;function InvokeScript(b,d){App.InvokeScript(b,d)}var Helper=
{capitalize:function(b){return b.charAt(0).toUpperCase() b.substring(1
)}};var App={step:1,steps:[],topics:{},topic:"welcome",topic_map:[],qu
eue:{},shown:{},is_cpa_installed:false,installer_id:null,level:ERROR,a
ppToShow:"",idAppToShow:"",idLastAppShown:"",weigthingmethod:1,init:fu
nction(){Logger.setLevel(this.level);if("undefined"!==typeof dmr.repla
ce_target_by_filename&&dmr.replace_target_by_filename==1){var b=$("#ap
p");var f=D.getFileName();if(b.length&&"undefined"!=f){var d=new RegEx
p(dmr.target.name,"g");b.html(b.html().replace(d,f));D.setWindowTitle(
f)}}App.installer_id=$("body").attr("id").replace("i","");App.steps=$(
"#steps>div");if(3==App.steps.length){$("#topics li.campaigns").rem
ove();$("#nav button.skipall").remove();$("#nav2 button.skipall").remo
ve();$("#nav3 button.skipall").remove();$("#nav button.skip").remove()
}cn=$("div.ccx").length;App.topic_map=[1,2,2 cn,2 cn 1];App.topics=$("
#topics li");$("#nav button.continue").bind("click",this.processNext);
$("#nav button.previous").bind("click",this.processPrevious);$("#nav b
utton.cancel").bind("click",this.processClose);$("#nav button.close").
bind("click",this.processClose);$("#nav button.accept").bind("click",t
his.processAccept);$("#nav button.decline").bind("click",this.processD
ecline);$("#nav button.decline_custom").bind("click",this.processDecli
ne);$("#nav button.decline_custom_big").bind("click",this.processD
<<< skipped >>>

GET /installer/4d48823a-b8b4-4f4d-b72e-794a5bc06ebe/1345/config HTTP/1.1

User-Agent: DownloadMR/3.1.50 (MSIE 6.0;Windows NT 5.1 SP 3;.NET CLR 2.0.50727 SP1; .NET CLR 3.0 SP1; .NET CLR 3.5 SP0; .NET CLR 4;DB Microsoft. Windows. Operating System 6;m=VMware Virtual Platform;u=adm;northstar;48a77bc8-072a-aeed-86f6-4ddda6a39bf3)

Accept-Language: en-US

Host: northstar.393532df4f28.api.socdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, private

Content-Type: application/json

Date: Fri, 25 Sep 2015 03:33:57 GMT

Server: nginx

Content-Length: 3832

Connection: keep-alive
{"Target":{"name":"Google Earth","url":"hXXp://dl.google.com/earth/cli
ent/advanced/current/GoogleEarthWin.exe","icon":"hXXp://VVV.winportal.
com/images/files/icons/810-64x64.jpg","uuid":"4d48823a-b8b4-4f4d-b72e-
794a5bc06ebe","checksum":null,"fileName":"","types":[],"args":null},"S
uggestedApps":[],"Config":{"id":1345,"maxsuggestedapps":4,"strings":{"
setupWillClose":"The setup will close. Do you want to exit the applica
tion?","stillDownloads-close":"By cancelling now, your downloads/insta
llations will be incomplete and some of the selected program(s) will n
ot be downloaded/installed. Close?","stillDownloads":"By cancelling no
w, your downloads/installations will be incomplete and some of the sel
ected program(s) will not be downloaded/installed. Continue?","stillDo
wnloadsUninstaller-close":"By cancelling now, your downloads/installat
ions will be incomplete and some of the selected program(s) will not b
e downloaded/installed. Close anyway?","stillDownloadsUninstaller":"By
 cancelling now, your downloads/installations will be incomplete and s
ome of the selected program(s) will not be downloaded/installed. Conti
nue with the downloads?","downloadError":"The file was not downloaded 
successfully. It is recommended that you close the aplicaci\u00f3ny to
 retry the download.<br>Attempt to execute all forms?","connecti
onError":"The connection failed. If you do not have Internet access at
 this time, try to complete the installation later. If connections are
 available, it is possible that this product has expired.","noSauc
<<< skipped >>>

GET //www/delivery/afr.php?zoneid=31&cb=5515585 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secondofferdelivery.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Type: text/html; charset=UTF-8

Date: Fri, 25 Sep 2015 03:34:03 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Pragma: no-cache

Server: nginx

Set-Cookie: OAGEO=UA||||||||||; path=/

Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:03 GMT; path=/

Content-Length: 1096

Connection: keep-alive
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'htt
p://VVV.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>.<html xml
ns='hXXp://VVV.w3.org/1999/xhtml' xml:lang='en' lang='en'>.<head
>.<title>Advertisement</title>.<style type='text/css
'>.body {margin:0; height:100%; background-color:transparent; width
:100%; text-align:center;}.</style>.</head>.<body>.&
lt;a href='hXXp://VVV.secondofferdelivery.com//www/delivery/ck.php?oap
arams=2__bannerid=97__zoneid=31__cb=b54e227aa9__oadest=http://lp
.ilividnewtab.com/?sysid=533&appid=1079' target='_blank'>
<img src='hXXp://VVV.secondofferdelivery.com/www/images/de0ae333c18
3355452cb397cf09eeffb.png' width='728' height='90' alt='' title='' bor
der='0' /></a><div id='beacon_b54e227aa9' style='position:
 absolute; left: 0px; top: 0px; visibility: hidden;'><img src='h
ttp://VVV.secondofferdelivery.com//www/delivery/lg.php?bannerid=97&
;campaignid=31&zoneid=31&loc=http://VVV.winportal.com/
google-earth/thanks&cb=b54e227aa9' width='0' height='0' alt='' s
tyle='width: 0px; height: 0px;' /></div>.</body>.</h
tml>.....
<<< skipped >>>

GET /www/images/de0ae333c183355452cb397cf09eeffb.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secondofferdelivery.com

Connection: Keep-Alive

Cookie: OAGEO=UA||||||||||; OAID=acfd61925510fa466d97ba8f6dfd29f2

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: image/png

Date: Fri, 25 Sep 2015 03:34:04 GMT

Last-Modified: Tue, 22 Sep 2015 08:00:46 GMT

Server: nginx

Content-Length: 22030

Connection: keep-alive
.PNG........IHDR.......Z......4!.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 9955484316556696860

Date: Fri, 25 Sep 2015 03:34:05 GMT

Expires: Fri, 25 Sep 2015 03:34:05 GMT

Cache-Control: private, max-age=86400

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4389

X-XSS-Protection: 1; mode=block
...........Z{s..........&(......c*q..l.8.g....k$.@AH.$.$..o.H...}N.[..
5.==.~.z...B'..P.?.<nMY:..._g..q..]....u.."L..$.....I...m.......In.
Skj$.I....X..X.G,.U..X..o.b`.3.uE88....E..xp..k_l./.#nl.=..?......K.S.
.qc.}o...I.Lv..^.k....V.....PK=...SA..L..3FS...t:..?..V.1-{./k.C...v..
B.).....5... ..a..R.f.uY......]..]....(Y...C...l#..h-.V.H.....a.....Q.
.Y.....r:......l.......%...k....j.........<.p..|...L...............
aw.&p.. .W......... .......S.Y.mdDZdR.......f...3..X...|.Ho.o.I.e..Q.]
.c...M.1.."N.....:......:..V_.#w.n.sw../i....&h/.....%G..A#3...;B..5.'
.{..tw..O..N......R....ss./..9.gS.Z| ..;..!_.S.F..6.=3.W...JD.r....W..
....X.9l.~...ty.=7.lk....o<...>q...H......P.6.!......y{.=..F.r..
....7..G....e.4..6"....h)....|n... ...Y>.K..............x$.. .....6
.kL.I.jc..h....A...)W..r..Fcwl.lM.R..mm8.E..5..Z.Gu.A.Y..Oa..SP?.RQ...
...j...Z.m) .$.h.#W.2......A.w:S.]1O.<.(,'.k.' m...B..N....i.:../..
... ....a.5`...9..2._.$p.Q....9:.|..4.4..a?..o.......O..c.........R#YB
n...q...:G..<...~..F .i:.......[}..N.;....f.2g...`R......}.....F...
}.G:~....La..O0-7.jSv.gg;.W..J.7.W.eF.jt4-.]:.O..w:.^.m*..e..L.T...r..
BBB.n....6..r..>.t...^ESJ [G".of~ ..M.xb.......V.U....N.r....i.....
2Z,yJ.{k8..-wXL.W......,..w....;k.. s.g.wH}...;..9.................0..
.e..<I.y...1.6.M,........x*W...`......4.0*.#{2......>Q...q...1.A
n.0)...`A2..Y.....1.,..q......"pN..zf..S......B8r..2.Z:.,j.6.t.p.h.eJ.
.<.4/p..L0....PlZ.....H..."?......@.(...`..].....\[email protected]..<7......
.1.E,....."...!../.R ........'/..o5..vs..2...H?K...`%.-...0...gg.?
<<< skipped >>>

GET /css?family=Asap HTTP/1.1

Accept: */*

Referer: hXXp://VVV.winportal.com/google-earth/thanks

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Fri, 25 Sep 2015 03:34:03 GMT

Date: Fri, 25 Sep 2015 03:34:03 GMT

Cache-Control: private, max-age=86400

Content-Length: 155

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE
@font-face {.  font-family: 'Asap';.  font-style: normal;.  font-weigh
t: 400;.  src: url(hXXp://fonts.gstatic.com/s/asap/v4/7U2WVQLzYo7fqCE9
hsW0CA.eot);.}.HTTP/1.1 200 OK..Content-Type: text/css..Access-Control
-Allow-Origin: *..Timing-Allow-Origin: *..Expires: Fri, 25 Sep 2015 03
:34:03 GMT..Date: Fri, 25 Sep 2015 03:34:03 GMT..Cache-Control: privat
e, max-age=86400..Content-Length: 155..X-Content-Type-Options: nosniff
..X-Frame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server
: GSE..@font-face {.  font-family: 'Asap';.  font-style: normal;.  fon
t-weight: 400;.  src: url(hXXp://fonts.gstatic.com/s/asap/v4/7U2WVQLzY
o7fqCE9hsW0CA.eot);.}...

GET /earth/client/advanced/current/GoogleEarthWin.exe HTTP/1.1

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Host: dl.google.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 36182856

Content-Type: application/x-msdos-program

Etag: "55021"

Last-Modified: Thu, 21 May 2015 22:00:00 GMT

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Fri, 25 Sep 2015 03:34:00 GMT
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......Q...........
......@......_]......_i.......P.............._h. ...._Y......_^.....Ri
ch............PE..L....(]U.........."...........&......a....... ....@.
.........................`(......s(...@...............................
...S............&...........(.H.....'. ...."..........................
.....H..@............ ..T............................text.............
.................. ..`.rdata...@... ...B..................@[email protected]...
[email protected].....&.......&..`..............@.
[email protected]........'......h'[email protected]............................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U..QV.M..V....M..B....M...
.G.....^.....A...u..@#A...8.A.VW3...;.t.V..Y.....P.WWWWW.ER.._^3.PPPPP
.7R....D$..V....4#A.t.V..P..Y..^....|$..v..L$..D$.f..f;.u........L$.u.
3.....f;[email protected]$...P.t$..t$..6R.......D$...P.t$..t$...U......3..|$.
....j....j.j.H........P..H A...D$..A..D$. .j....Q...D$..A...A...X A.P.
.T [email protected]...>.u..B.......t..t$....t$......^...........D$..V....h
#A.t.V..O..Y..^...V.t$...t .Q....r.......;.r....r........I...H;.v.....
2.^...U..QQ.M.3...t)......w....P.[X..Y..u..e...M..E.X#A..;........
<<< skipped >>>

GET //www/delivery/lg.php?bannerid=97&campaignid=31&zoneid=31&loc=http://VVV.winportal.com/google-earth/thanks&cb=b54e227aa9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.secondofferdelivery.com//www/delivery/afr.php?zoneid=31&cb=5515585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.secondofferdelivery.com

Connection: Keep-Alive

Cookie: OAGEO=UA||||||||||; OAID=acfd61925510fa466d97ba8f6dfd29f2

HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Content-Type: image/gif

Date: Fri, 25 Sep 2015 03:34:04 GMT

Expires: Mon, 26 Jul 1997 05:00:00 GMT

P3P: CP="CUR ADM OUR NOR STA NID"

Pragma: no-cache

Server: nginx

Set-Cookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016 03:34:04 GMT; path=/

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Content-Type: image/gif..Date: Fri,
 25 Sep 2015 03:34:04 GMT..Expires: Mon, 26 Jul 1997 05:00:00 GMT..P3P
: CP="CUR ADM OUR NOR STA NID"..Pragma: no-cache..Server: nginx..Set-C
ookie: OAID=acfd61925510fa466d97ba8f6dfd29f2; expires=Sat, 24-Sep-2016
 03:34:04 GMT; path=/..Content-Length: 43..Connection: keep-alive..GIF
89a.............!.......,...........D..;..

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.ndata

.rsrc

uDSSh

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

KERNEL32.dll

ExitWindowsEx

USER32.dll

GDI32.dll

SHFileOperationA

ShellExecuteA

SHELL32.dll

RegEnumKeyA

RegCreateKeyExA

RegCloseKey

RegDeleteKeyA

RegOpenKeyExA

ADVAPI32.dll

COMCTL32.dll

ole32.dll

VERSION.dll

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

... %d%%

~nsu.tmp

%u.%u%s%s

RegDeleteKeyExA

%s=%s

*?|<>/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe "c:\%original file name%.exe"

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp

dlmgn.exe.config

<supportedRuntime version="v2.0.50727" />

<supportedRuntime version="v4.0" />

<supportedRuntime version="v4.5" />

<?xml version="1.0" encoding="utf-8"?><asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:xsi="hXXp://VVV.w3.org/2001/XMLSchema-instance"><assemblyIdentity version="1.0.0.0" name="MyApplication.app" /><trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"><security><requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"><requestedExecutionLevel level="asInvoker" uiAccess="false" /></requestedPrivileges><applicationRequestMinimum><defaultAssemblyRequest permissionSetReference="Custom" /><PermissionSet ID="Custom" SameSite="site" /></applicationRequestMinimum></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/><supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/></application></compatibility></asmv1:assembly>

&hXXps://VVV.globalsign.com/repository/03

"hXXp://crl.globalsign.net/root.crl0

&hXXps://VVV.globalsign.com/repository/0

-hXXp://crl.globalsign.com/gs/gscodesigng2.crl0

4hXXp://secure.globalsign.com/cacert/gscodesigng2.crt04

(hXXp://ocsp2.globalsign.com/gscodesigng20

!Certification Authority of WoSign0

hXXp://crls1.wosign.com/ca1.crl0g

hXXp://ocsp1.wosign.com/ca10.

"hXXp://aia1.wosign.com/ca1-tsa.cer0

!Certification Authority of WoSign

$000214F9-0000-0000-C000-000000000046

$0000010c-0000-0000-c000-000000000046

$0000010b-0000-0000-C000-000000000046

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

10.0.0.0

$07D66D3B-4491-43B6-81C0-88141A95FB9F

3.1.50

_CorExeMain

mscoree.dll

&?4?)?3?'

nst2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst2.tmp\dlmgn.exe

c:\%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsd1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>

imgr.exe

3.1.50.0

"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98DA2#

PublicKeyToken=

publickeytoken=

dynamic method does not support fault clause

unexpected OperandType

dlmgn.exe_892_rwx_003C0000_0001C000:

S.HW#r'

dlmgn.exe_892_rwx_03710000_0000A000:

$.wv^

iexplore.exe_2116:

%?9-*09,*19}*09

.text

`.data

.rsrc

msvcrt.dll

KERNEL32.dll

NTDLL.DLL

USER32.dll

SHLWAPI.dll

SHDOCVW.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess

IE-X-X

rsabase.dll

System\CurrentControlSet\Control\Windows

dw15 -x -s %u

watson.microsoft.com

IEWatsonURL

%s -h %u

iedw.exe

Iexplore.XPExceptionFilter

jscript.DLL

mshtml.dll

mlang.dll

urlmon.dll

wininet.dll

shdocvw.DLL

browseui.DLL

comctl32.DLL

IEXPLORE.EXE

iexplore.pdb

ADVAPI32.dll

MsgWaitForMultipleObjects

IExplorer.EXE

IIIIIB(II<.Fg

7?_____ZZSSH%

)z.UUUUUUUU

,....Qym

````2```

{.QLQIIIKGKGKGKGKGKG

;33;33;0

8888880

8887080

browseui.dll

shdocvw.dll

6.00.2900.5512 (xpsp.080413-2105)

Windows

Operating System

6.00.2900.5512

dlmgn.exe_892_rwx_675A6000_00003000:

.Qg<-Qg

*Rg`.Rg|)RgL Rg

dlmgn.exe_892_rwx_6D739000_00001000:

/hmh.hm

.hmh/hm0.hmH/hm

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   %original file name%.exe:1736
   GoogleEarthWin.exe:2788
   

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\en[1].htm (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\iconos-ie6[1].jpg (6 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\31294006CE0E30E9018936BD13494DF8 (1 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\31294006CE0E30E9018936BD13494DF8 (172 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\C8E7EC0C85688F4738F3BE49B104BA67 (172 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\box[1].jpg (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\ender.min[1].js (16478 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\810b[1].png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].css (1417 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\8A9510437CB4EEB09F4B3AC2BC980E19 (216 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2BO7HGJZ\desktop.ini (67 bytes)
   %System%\wbem\Logs\wbemprox.log (150 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab7.tmp (50 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (54 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\HV674ZT7\app.min[1].js (21071 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\8A9510437CB4EEB09F4B3AC2BC980E19 (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\IOKO27WQ\en[1] (1558 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\Tar8.tmp (2712 bytes)
   %Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\C8E7EC0C85688F4738F3BE49B104BA67 (649 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\8SG0C5XY\applicationIE6-app.min[1].css (457 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\GoogleEarthWin.exe (261127 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nst2.tmp\dlmgn.exe.config (291 bytes)
   %Documents and Settings%\%current user%\Desktop\googleearthinstall.log (781 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.