Trojan.AutoIT.Injector.AV_aa1d565a00 – Adaware

HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.AutoIT.Injector.AV (AdAware), Trojan-PSW.Win32.Zbot.6.FD, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Backdoor

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: aa1d565a0070bef7366abe3824bf049a

SHA1: cb438dac3143311468ce781ba7e842a1389f32f1

SHA256: 7c0edcf1bb536ad72a98b4437e86dff897e383c87830222889af6d5c514b1887

SSDeep: 12288:K6Wq4aaE6KwyF5L0Y2D1PqLUjL QT9zXpTl2WCAOVFripV2G:othEVaPqL27FDWAsI6G

Size: 525567 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6

Company: no certificate found

Created at: 2012-01-29 23:32:28

Analyzed on: Windows7 SP1 32-bit

Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

WinMail.exe:2824
%original file name%.exe:1024

The Trojan injects its code into the following process(es):

taskhost.exe:252
Explorer.EXE:284
Dwm.exe:528
TPAutoConnect.exe:2068
conhost.exe:2076
conhost.exe:3452

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process WinMail.exe:2824 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (42552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.log (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml (1924 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol (608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\tmp.edb (1728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.log (18592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.chk (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml:OECustomProperty (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (3466 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (2712 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.pat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb00001.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\edb00001.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2.ui (0 bytes)

The process %original file name%.exe:1024 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmpbe57d30b.bat (179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe (1053 bytes)

Registry activity

The process WinMail.exe:2824 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\IdentityCRL\Dynamic Salt]
"Size" = "330"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows Mail]
"Compact Check Count" = "2"
"Settings Upgraded" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows Mail\Junk Mail\Block Senders List]
"Version" = "327680"

[HKCU\Identities\{C692FCB0-9162-422E-94A4-4CD072B19CA9}]
"Identity Ordinal" = "1"

[HKCU\Software\Microsoft\Windows Mail]
"LastBackup" = "E0 07 0B 00 05 00 04 00 16 00 22 00 0A 00 7F 00"
"Running" = "1"
"V7StoreMigDone" = "01 00 00 00"
"StoreMigratedV5" = "1"

[HKCU\Software\Microsoft\Windows Mail\Junk Mail\Safe Senders List]
"Version" = "327680"

[HKCU\Software\Microsoft\Windows Mail\Mail]
"Welcome Message" = "0"

[HKCU\Software\Microsoft\Windows Mail]
"SpoolerDlgPos" = "2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\IdentityCRL\Dynamic Salt]
"Value" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"

[HKCU\Identities]
"Identity Ordinal" = "2"

[HKCU\Software\Microsoft\Windows Mail\Mail]
"Secure Safe Attachments" = "1"
"Default_CodePage" = "28591"

[HKCU\Software\Microsoft\WAB]
"NamedPropCount" = "1"

[HKCU\Software\Microsoft\IAM\Accounts]
"ConnectionSettingsMigrated" = "1"

[HKCU\Software\Microsoft\Windows Mail]
"SpoolerTack" = "0"

[HKCU\Software\Microsoft\IAM]
"Default News Account" = "account{CE54EE8F-8454-4E11-A69C-0E6F9BED6C0A}.oeaccount"
"Default LDAP Account" = "account{5F33D8D7-3326-4E0C-969F-F201824EF068}.oeaccount"

[HKCU\Software\Microsoft\Windows Mail]
"lastrun" = "77 71 87 92 EB 36 D2 01"

[HKCU\Software\Microsoft\Windows Mail\Mail]
"Safe Attachments" = "1"

[HKCU\Software\Microsoft\IAM]
"Server ID" = "2"

[HKCU\Software\Microsoft\WAB]
"NamedProps" = "04 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\WAB]
"NamedPropCount"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Identities]
"Changing"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Identities]
"IncomingID"
"OutgoingID"

[HKCU\Software\Microsoft\WAB]
"NamedProps"

Dropped PE files

MD5	File path
4288a5845ff2cb1b9348e1d633475293	c:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExW
InternetReadFileExA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoA
InternetCloseHandle

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in USER32.dll:

SetCursorPos
ReleaseCapture
SetCapture
GetMessagePos
DefDlgProcW
CallWindowProcA
DefMDIChildProcA
DefFrameProcA
GetUpdateRgn
DefFrameProcW
DefMDIChildProcW
DefDlgProcA
GetClipboardData
GetMessageW
TranslateMessage
PeekMessageW
EndPaint
BeginPaint
GetDC
ReleaseDC
DefWindowProcW
GetWindowDC
GetDCEx
CallWindowProcW
PeekMessageA
GetMessageA
RegisterClassExW
RegisterClassW
RegisterClassA
DefWindowProcA
GetUpdateRect
GetCursorPos
GetCapture
RegisterClassExA
OpenInputDesktop
SwitchDesktop

The Trojan installs the following user-mode hooks in WS2_32.dll:

send
WSASend
closesocket

The Trojan installs the following user-mode hooks in kernel32.dll:

GetFileAttributesExW

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
ZwCreateUserProcess

Propagation

Removals

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):
WinMail.exe:2824
%original file name%.exe:1024
Delete the original Trojan file.
Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (42552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.log (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml (1924 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol (608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\tmp.edb (1728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.log (18592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.chk (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml:OECustomProperty (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (3466 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmpbe57d30b.bat (179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe (1053 bytes)
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 8, 1File Description: Comments: Language: Language Neutral

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
UPX0	4096	524288	0	0	d41d8cd98f00b204e9800998ecf8427e
UPX1	528384	274432	270848	5.49606	4c66c69384c417c7b84c11e4868e3bc6
.rsrc	802816	73728	72192	3.16803	06c162120b40019c928b252bae8d32f7

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://acgplug.org/protected/data/serve/config.bin
hxxp://a1363.dscg.akamai.net/pki/crl/products/CodeSignPCA.crl
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://cs3.wpc.v0cdn.net/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://crl.comodoca.com.cdn.cloudflare.net/AddTrustExternalCARoot.crl	104.16.92.188
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg=
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://crl.comodoca.com.cdn.cloudflare.net/UTN-DATACorpSGC.crl	104.16.92.188
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://gpla1.wac.v2cdn.net/PublicSureServerSV.crl
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH
hxxp://cdn.globalsigncdn.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV
hxxp://cdn.globalsigncdn.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw==
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za
hxxp://a1158.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE=
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y=
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c=
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=	23.43.139.27
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i	74.125.232.226
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE=	23.43.139.27
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I	94.31.29.96
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==	23.43.139.27
hxxp://ocsp.globalsign.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV	104.16.26.216
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO	74.125.232.226
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11	74.125.232.226
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl	74.125.232.226
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	212.30.134.167
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy	74.125.232.226
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za	74.125.232.226
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	212.30.134.167
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI=	93.184.220.29
hxxp://tg.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU=	23.43.139.27
hxxp://evsecure-ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg=	23.43.139.27
hxxp://sf.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys=	23.43.139.27
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC	74.125.232.226
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM	104.16.26.216
hxxp://mscrl.microsoft.com/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl	93.184.221.200
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y=	5.45.205.235
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.174
hxxp://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw==	104.16.26.216
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	74.125.232.226
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=	93.184.220.29
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss=	93.184.220.29
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	212.30.134.167
hxxp://crl.comodoca.com/AddTrustExternalCARoot.crl	104.16.92.188
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://vassg142.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/	2.21.89.35
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe	74.125.232.226
hxxp://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl	212.30.134.167
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF	74.125.232.226
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=	93.184.220.29
hxxp://crl.omniroot.com/PublicSureServerSV.crl	93.184.220.20
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	212.30.134.167
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH	104.16.26.216
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	74.125.232.226
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR	74.125.232.226
hxxp://crl.comodoca.com/UTN-DATACorpSGC.crl	104.16.92.188
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c=	5.45.205.235
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+	74.125.232.226
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI=	23.43.139.27
hxxp://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0=	23.43.139.27
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA=	93.184.220.29
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso	94.31.29.96
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl	93.184.220.20

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1

Cache-Control: max-age = 564348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1362

content-transfer-encoding: binary

Cache-Control: max-age=482178, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 12:27:47 GMT

Expires: Thu, 10 Nov 2016 12:27:47 GMT

Date: Fri, 04 Nov 2016 22:34:50 GMT

Connection: keep-alive

0..N......G0..C.. .....0.....40..00.......j.#.p.e$.\ps.*.. .j..20161103122747Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20161103122747Z....20161110122747Z0...*.H...............A....(Ew.x.5......0.._...'F...*.n..O....N49.G.#j..z......|........\R.X.KPP-k.%;..X.......Y.B...3.^.w~...Y...lu.].^.c.-....\..=.....g.....)..x.Y.tr..\:}..]....L...z.*.L........t....&.,.~......&.%.8J.J<.....e?..E...qP.=.F.)P.T.........G...o/...,..b{.R.X.......0...0..|0..d........:.0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...151203170230Z..161214170230Z02100...U...'GeoTrust Global CA TGV OCSP Responder 40.."0...*.H.............0.........[.c.#zj......RME.....,......(..U......!-.l..R..E.~..%."./8mv..D...*...Rx........mw.~2..Q5T\.H...Wk*..a.z.$._..T......;T.S.r(._*.G....^.P.!.3..t.......s......P....C._.g.b.oK...EV..>...>.|.o.~quo.............v4..Tt....Q.]A.Y......... w.E..=.%.n7.......{" *C........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0 ..U....0...0.1.0...U....TGV-C-670...*.H...............aEc<..'R......]C.ri.Zm.....|..B.$..76..h....l...Xbxua...C.X.S....~K..A..._.T@$.....9(.... ......\.*.....5.b.x...[QM.._9P.=..l...gf..L.?..3 ......Z....._...20R;...x.......C..0....l.G.A..5TS>d.U......w.(\....v..9.z7.....J..;..'...u.Y...BB.@.2u.e..eW..J.U....

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA= HTTP/1.1

Cache-Control: max-age = 500864

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 02:06:23 GMT

If-None-Match: "57feec1f-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=503521

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581c9786-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 14:13:26 GMT

Server: ECS (vie/F398)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......Z..{*....q..`.-.eu.X..20161104132000Z0s0q0I0... .........G.h...#......Vm.Q....Z..{*....q..`.-.eu.X....Z...I{.I..h.&.....20161104132000Z....20161111123500Z0...*.H...................PQ....X.R.....6.......Qw.......3WMY6QNIUR.O.....$.:..............3V.g..#......g....G...c.R..5p......W.$..%"..[t.`5..t............5..Nl{n..............E.U:L7U.f.....,R..q......~m#X..H.e.P12..=....f..Zk.....0q._.....H......Lo..%hG.-.})R..F..l.q..!rd#.o....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI= HTTP/1.1

Cache-Control: max-age = 507829

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 03:40:21 GMT

If-None-Match: "57ff0225-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=499845

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cabe7-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 15:40:23 GMT

Server: ECS (vie/F2D3)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......q.7.s.......4. Z.....20161104145200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z.......c.Y..6. Y.<..b....20161104145200Z....20161111140700Z0...*.H...............L..mU.d.._..D.....0.......yh...s.sny.......O.k.IJW....0..{M....G..9.#f#.>....w.......g>B^..B...~..lt............A.].=w.::........M6.....BWJ^...\..9..a.q.w.I..y:..n.1n$.o&9.2.u%..uV^Z..0).....e.R`K..MnJ..bP.......c/..P..P/.CY...A.t...J......,...v.}9. ..C.....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= HTTP/1.1

Cache-Control: max-age = 510963

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:45:35 GMT

If-None-Match: "57ff116f-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=505362

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cbc70-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 16:50:56 GMT

Server: ECS (vie/F2AD)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0......E.......1-Q...!..m....20161103210000Z0s0q0I0... ............@..D3=?..Mn8...Q..E.......1-Q...!..m........_..fuSC.o.P.....20161103210000Z....20161110210000Z0...*.H.............,...U..~a.@..%n.....d...U..).t..d(.W.".!.....uN...&.-w...X.......... .B...........g....'..j....t ....@..J1./...a..SR. .F.._k,.:u-E.......m...?H..D....,......~.H...*.y.$cR...;.......9N.^.j.e...W'......s...-%...AZ..8..jn.".&V.5..N<..2.......S...Kp........7......

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT

If-None-Match: "57ff143e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=505028

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cbbcf-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 16:48:15 GMT

Server: ECS (vie/F2D5)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20161103210000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161103210000Z....20161110210000Z0...*.H...............a......^gY..!.L......"....UE.M..`i~...o.......!....5sI.......C.L...nM..:..."...u..h.|..........]..~f.r.7.J.@.....iF......I^.Loo......ZB...rY..u........V...._=cO).u.%.....,53......J.........e......8...8..Z.g.p..6..A6S5...;....w$G.l.b....4{.O...W....Le........

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Cache-Control: max-age = 512045

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:41:33 GMT

If-None-Match: "57ff1e8d-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511624

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cc8b3-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 17:43:15 GMT

Server: ECS (vie/F38D)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0........P5V.L.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U...........z....@7....20161103210000Z....20161110210000Z0...*.H..................}..]...u..*.....Y)o..'.h..b.....J=0R..[....).....<(_.w....7FE..Hi.d.K....Zt...X...un....v.....B .......m...,.D:..(....J73.2.Wi..*.).m%v~h..{T.V..P?..n1YQ...H.,c.......%<......q1.%.. ..v])>./.....s......._.L.iP...g....n........:12.f.]M.ke.F..S.....<XoQ....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o= HTTP/1.1

Cache-Control: max-age = 513888

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:42:27 GMT

If-None-Match: "57ff1ec3-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=508884

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cc8f8-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 17:44:24 GMT

Server: ECS (vie/F3B0)

X-Cache: HIT

Content-Length: 471

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss= HTTP/1.1

Cache-Control: max-age = 516225

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:53:02 GMT

If-None-Match: "57ff2f4e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=517072

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cdb1e-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 19:01:50 GMT

Server: ECS (vie/F3B1)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......q.7.s.......4. Z.....20161104181200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z.........A0#o(....}......20161104181200Z....20161111172700Z0...*.H.............5....)...E.$...5<..........g#...,y0.H.h;...o......b.7L.......V............d.(.\..#...t....N~Y.....%2*..4\.....!.8.3.@go..4X@..l.q< .....8...I...t.d.Wd./.S..3..m.......u...........?.....:...) ...!Q.. .....9j.F..T......(>..I......M@.........<Q.O...v....>.M..nt>....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= HTTP/1.1

Cache-Control: max-age = 517590

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:25:50 GMT

If-None-Match: "57ff28ee-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511615

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cd30d-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 18:27:25 GMT

Server: ECS (vie/F3C2)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0.......>.i...G...&....cd ...20161103210000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ....y.D.... .a_.k......20161103210000Z....20161110210000Z0...*.H...............].........A....V.lCI..ga,W....\D.R:cP.....\6..}.......\..w...,E.8..l.....QM..xW.6.....dP...t.u..l....Z...../.J[.P'|..............]..`..@w..*.._x.<....M`..gi.s;]...?.bj....rA...h...[2....7..PE.....?.. ...1.......y..].).j&D@.^...v.a/...n.2...G...&..3....<2....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE= HTTP/1.1

Cache-Control: max-age = 518191

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:43:19 GMT

If-None-Match: "57ff2d07-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=512053

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cd6bf-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 18:43:11 GMT

Server: ECS (vie/F2BA)

X-Cache: HIT

Content-Length: 471

0..........0..... .....0......0...0........P5V.L.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U......n.u..C.rK.......20161103210000Z....20161110210000Z0...*.H..................H2V...1L#..0:.#$....$.om..t...tp>LV(^.b...p9..Pg...H.a...~h.rN.-..cq1D........?B.qD..#!..D...u.7...!KKo....L.u]>f.@.O......C..}. ]..=1.t..i...? ik.Q...#;p..u).....-......%#...?.HQ.........!...Rkr.|...5.$=.... T.X....,f..F.2.5.z..|Y..N/...b'7.0..]...?.HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=512053..Content-Type: application/ocsp-response..Date: Fri, 04 Nov 2016 22:34:50 GMT..Etag: "581cd6bf-1d7"..Expires: Fri, 11 Nov 2016 10:34:50 GMT..Last-Modified: Fri, 04 Nov 2016 18:43:11 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0........P5V.L.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U......n.u..C.rK.......20161103210000Z....20161110210000Z0...*.H..................H2V...1L#..0:.#$....$.om..t...tp>LV(^.b...p9..Pg...H.a...~h.rN.-..cq1D........?B.qD..#!..D...u.7...!KKo....L.u]>f.@.O......C..}. ]..=1.t..i...? ik.Q...#;p..u).....-......%#...?.HQ.........!...Rkr.|...5.$=.... T.X....,f..F.2.5.z..|Y..N/...b'7.0..]...?...

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:30 GMT

X-Varnish: 206488259 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 5

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= HTTP/1.1

Cache-Control: max-age = 432038

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 10:05:24 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=377941, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 07:30:43 GMT

Expires: Wed, 9 Nov 2016 07:30:43 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive

0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161102073043Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..=x..vI`.a}.....*....20161102073043Z....20161109073043Z0...*.H................X.~.......cNyt.......E.^...</........ .C.7.r. .. ..:.I.?6.9.<.2..g|....M.....p.G...gX. ;yb.V....{.......fX.n8..cR.`m.x*..I.[........>.3l...uP....3.H...$.~.4....Q.O...`........Oi~..SsE4"...G.,..l...j..]R..D.?/X.. i....]T...tg..z......).wL...{..6.....pu>.....0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= HTTP/1.1

Cache-Control: max-age = 487662

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 01:30:20 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=384805, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 09:26:17 GMT

Expires: Wed, 9 Nov 2016 09:26:17 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive

0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161102092617Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..~.Joo....?.eM:......20161102092617Z....20161109092617Z0...*.H.............Lw....UP...-T=....<.H...j.5....../.wx./m..|.'..W(...=Ujz...yWn{k.....J.F.5W0. .RVr..3{.........(JO...xk.Wh....vI..C..1r......8..J2.$...&.......,...X.i...0..l.....?..m..' .=n...K.6.6...~b..D..{s5....P.......H"V..9T.G.T .. ....to....^..'.....$...MS\^..7.z.......0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:14 GMT

X-Varnish: 206487045 206485799

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 3

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Cache-Control: max-age = 86400

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT

If-None-Match: "8017f9a85f10d21:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.download.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/vnd.ms-cab-compressed

Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT

ETag: "8017f9a85f10d21:0"

Cache-Control: max-age=604800

Date: Fri, 04 Nov 2016 22:34:50 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2

HTTP/1.1 304 Not Modified..Content-Type: application/vnd.ms-cab-compressed..Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT..ETag: "8017f9a85f10d21:0"..Cache-Control: max-age=604800..Date: Fri, 04 Nov 2016 22:34:50 GMT..Connection: keep-alive..X-CCC: RU..X-CID: 2..

GET /gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw== HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 06:16:22 GMT

If-None-Match: "4a49c69908e933f536cd8546fd48854f6c2b3f7b"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:48 GMT

Content-Type: application/ocsp-response

Content-Length: 1570

Connection: keep-alive

Set-Cookie: __cfduid=dd54cb12f4cf270e57e9576c0a18640351478298888; expires=Sat, 04-Nov-17 22:34:48 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 19:32:48 GMT

Expires: Tue, 08 Nov 2016 19:32:48 GMT

ETag: "45aeec04cf5f75fd5535651bd4cd9a873159ef92"

Cache-Control: public, max-age=334680

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb891212d1401a-SOF

0..........0..... .....0......0...0.......M........u....%...G..20161104193248Z0o0m0E0... ..........M.=......r......{.....a....)S...};..@..|..........q."W....20161104193248Z....20161108193248Z0...*.H..............".....d.6..2V/.B.{........*"8_l..!..Yt...t}.7.....1............TS!v._.......<c.../...m..5SU.6.B.Y..\.p..&....H...`.O-A..*[-.........VT}.....@C......y...i....O.Q.E...7...<D2..j..M@.9 ..R...1./..~......v|.1....AE..4.} .]#...:..........sz5.W..z...;.....~rb0....K0..G0..C0.. .......*'....?...F$0...*.H........0f1.0...U....BE1.0...U....GlobalSign nv-sa1<0:..U...3GlobalSign Organization Validation CA - SHA256 - G20...161019091216Z..170119091216Z0..1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....2016072511411M0K..U...DGlobalSign Organization Validation CA - SHA256 - G2 - OCSP Responder0.."0...*.H.............0.........C..0j..R........0.".e.&.6'.d..._.....8...Y..../..z..-hi.k.......D.........u..>h....T2..~..*;...v.^.!d.......8.p.e..me...>..V...l...P.6.V..G..;X.......12U.)D.E(ldQ...67..@......l...A.>l......m..e;.....n.~..Wb.?..gE.......a.KM.F...}.qo;S...`/..s....6....G.a........0..0...U.......M........u....%...G0...U.#..0.....a....)S...};..@..|0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...U...........0...U.%..0... .......0...*.H.................v.bV.......)...c..}.....y=...........L.G%...N.<...8Qi..Y...........\.fd-.<V=.;0".4..h:v*j..N<M..*...i.Hz{?..[....ML..I.Y....r.x.n.dS...J......d.JXT..:..P..B..~.KD....b..&..........."..oELo..I

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:14 GMT

X-Varnish: 206487057

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: MISS

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "bb4969ca5216e65f52a965c1ad15f69b:1478298631"

Last-Modified: Fri, 04 Nov 2016 22:30:31 GMT

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl

0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161104222300Z..161114222300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............Z.Ry.&R...$.?. rLL*&,.......w2....4......W......:K..=iY..]...n.@P..M>...X.g.......j.....^...I.;b=WH.!.... ......%..0...7.E..,...HTTP/1.1 200 OK..Server: Apache..ETag: "bb4969ca5216e65f52a965c1ad15f69b:1478298631"..Last-Modified: Fri, 04 Nov 2016 22:30:31 GMT..Date: Fri, 04 Nov 2016 22:34:51 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161104222300Z..161114222300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............Z.Ry.&R...$.?. rLL*&,.......w2....4......W......:K..=iY..]...n.@P..M>...X.g.......j.....^...I.;b=WH.!.... ......%..0...7.E..,.....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI= HTTP/1.1

Cache-Control: max-age = 356574

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 10 Oct 2016 12:54:45 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1612

content-transfer-encoding: binary

Cache-Control: max-age=479257, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 11:42:05 GMT

Expires: Thu, 10 Nov 2016 11:42:05 GMT

Date: Fri, 04 Nov 2016 22:34:48 GMT

Connection: keep-alive

0..H......A0..=.. .....0......0..*0......jwG.8s...r:ts.0.:.I...20161103114205Z0s0q0I0... .........H/..O.4..{.......:Q...l..`.....>.t c...Y...64....&i.V.l..q2....20161103114205Z....20161110114205Z0...*.H..............n..s.G...G.f..[H&Y ......h.......k..WF.......WB..*.k....P...O.iO...V1p-.oQ...S\..l;8..o,.pg.g}..Eh.:. *.kN$..C...G.1g.._.........i..Oy~...d.2..V(...`......I@.......=..P'.}.w.6....5...cJ..."......!.]...k..u.q......Ry..E.....J..}z......n%`.??B/.\.'V...^(x.$...q0..m0..i0..Q.......h`(V......*....R0...*.H........0..1.0...U....US1.0...U....thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2008 thawte, Inc. - For authorized use only1$0"..U....thawte Primary Root CA - G30...151124000000Z..161214235959Z0..1.0...U....US1.0...U....thawte, Inc.1(0&..U....Certification Services Division1503..U...,thawte Primary Root CA - G3 OCSP Responder 40.."0...*.H.............0....................Zs.8..W.D..c...H.....p.4I.........n..E...T.3...):w].s\`..t2........G.Gj|w).~i18J`....D....'t..e&q.Ga]>tw...0s.|I.R..!o.-.....G.. F-.s.......O..7_p9.:.............^..i..}.K..S3.1.9Z..N|w...u...Ay.*|%....y.nU..U.q.y.y. ....\.w.j........Cu{.!k............0..0...U.%..0... .......0... .....0......0...U.......0.0...U...........0 ..U....0...0.1.0...U....TGV-C-650...U......jwG.8s...r:ts.0.:.I.0...U.#..0....l..`.....>.t c...Y.0...*.H...............A...../W.....x.V.Km.H7Q.[..(..i..Y.........ÃŒ....eI..j...|..O...k....X>r/{..\h.<..N.G...........Y.8..@i`..>..W...?..{...^G.)0S.>;..;4a#..)(.O{..t.h.8...z.'.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU= HTTP/1.1

Cache-Control: max-age = 360742

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 10 Oct 2016 14:02:11 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: tg.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1451

content-transfer-encoding: binary

Cache-Control: max-age=516299, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 21:57:32 GMT

Expires: Thu, 10 Nov 2016 21:57:32 GMT

Date: Fri, 04 Nov 2016 22:34:48 GMT

Connection: keep-alive

0..........0..... .....0......0...0......|.....Q.......Uh..z...20161103215732Z0s0q0I0... ........U..2....i.*Y......[K.. .5...80.pz...v.........8U.h.....v^yPu....20161103215732Z....20161110215732Z0...*.H.................Hr..9DL.&o....$c'i k4......T-.q.J...:"@.\.;{Fs...l...>.....X(.J..M.7...*...).\.S...#vzE...].....:......2...VD..;.T......y..(.Ax......"\.a\..@"...."....o 'R..6.......h..Y.WbfB.U1'...c.....}.P-...eLL.....o.:.D..%.d....wi`m&.h.... .....hqr.... 3:3$.sz.'......0...0...0..........e......L.B......0...*.H........0C1.0...U....US1.0...U....thawte, Inc.1.0...U....thawte SHA256 SSL CA0...160829000000Z..161127235959Z0O1.0...U....US1.0...U....thawte, Inc.1)0'..U... thawte SHA256 SSL OCSP Responder0.."0...*.H.............0................#.....]......F#...Q...b:k.._n.X..!a.;<..a.......c....|.OsP..f..p.2r"2c&...8.:>vq.........2P..U....r..2.."N.!.gN....8.Y......D2.zF......Ln...Z..J..)..B{.1.p#|...e...$.A{...n.B.....o......L1...g...].......$cpYK.vC.D=.N..F2..j...=.....Yi.......u..r...........0..0... .....0......0"..U....0...0.1.0...U....TGV-D-17700...U.#..0... .5...80.pz...v.....0...U......|.....Q.......Uh..z.0...U.......0.0...U.%..0... .......0...U...........0...*.H.............C..7...X}.(.w9 9..*9.0x^Q.h....o. ..J...B.dc.6.%a_^?Z...8V.....O.aMh..I...1u.......v.VE7..h....t.o.m.=......U.@.V..'......v....4.......!.xV.es.....\......eM...C.|....$..I...-.. ...n.c*......Tz..6T..gU..XQ.^....P.LB..H....y.o}.i...I.......5...j!.g.D's........

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:08 GMT

X-Varnish: 206486611 206485799

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 1

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: subca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1651

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: MISS

Server: NetDNA-cache/2.2

X-Cache: HIT

0..o......h0..d.. .....0.....U0..Q0..-........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service..20161104222830Z0r0p0H0... ......y...bOm..(y.Y6B...}n...C..m.....i..J.`.:........@.eq_..(....(....20161104222830Z....20161111222830Z..0.0... .....0....0... .....0..0...*.H...........=.$...../.\J.!..b3` q..Dd.}M.u.p.s..b.......[g...=V....@...Y_0...?D.<..pB....Dz..bQ.j...........`O.Q...g.$...........*..9...$...R.e#/v....'...(..e......1 .)P{.;Fe...G...>.n.(..7... .{.n.".*hOF.-....I....h}...b.7NF..c.h..<P.\...N.h.&. ......62.....B.....n......0...0...0............Y\T..f..Y....HV0...*.H........0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA0...160107125922Z..170206125922Z0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service0.."0...*.H.............0..........3..>......]{7..\...$vl.....V......T...-.:.....y..'...X..}.fA\...._.Uxl6.ti %.SS..#. Z.5.G"..S.....)Q...!..P....~0..32...Bmd...%.2...D.....J.........6....O.u..vm.l..V.'.L.4.._....\.eK...MI.F.;H.;..%...KZ...H;e ..9.2..A.b......F.T..._........DY2...2Z#L.D0)........0..0...U.......0.0...U.......L.oh.....2......|.=0R..U.#.K0I.B.@0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA.... 0...U...........0...U.%..0... .......0... .....0......0...*.H.............0.r._(...,.QowB....:......p.....ju.:..-."...e.......Y.b....<.[..m...qO.A.}....n^..w...=.f...]..mR....j..5...C.(....:a.f.

<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: subca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1663

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: HIT

Server: NetDNA-cache/2.2

X-Cache: HIT

0..{......t0..p.. .....0.....a0..]0..-........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service..20161104223038Z0r0p0H0... .......:L..!..O'...Q.)..&....v....$.........7Fu......G...dR.oz5I..H....20161104223038Z....20161111223038Z..0.0... .....0....0... .....0..0...*.H.............b...$:..........5. ...F.bm08..Y x.).h..|W.....g.y(.....}....w......ha.Oi..I...[c?:>c.....q....m5:.[.UIHZ.#....oO$..W.....x,.OtF\..n<..../.U.(....3.S..Kc;%L.&....)..6..os.....b...^. ....#3\..=e..[.(123...f.~......T....i.0(5...6.L?K&....l.....|jEW.?.W.........0...0...0..........x....4P^..o.@oz.0...*.H........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Trusted Network CA0...160107130439Z..170206130439Z0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service0.."0...*.H.............0..........AB...I....z..#U......oD.L.....UX....j.....S.K......".>w.;.r8....C...Zc...U.}%.....@Ff..`.&.j.`.......ci.Io........pW...........#.s............tR@...N.......L....U..t.>su...OyH.E...v...r.]."m..7.... ....@.....>.X......M.P@......./.......k...O....@v7.d............0..0...U.......0.0...U..........Lw..l..n..n...~.0...U.#..0....v....$.........7Fu.0...U...........0...U.%..0... .......0... .....0......0...*.H.................Rg.....O~y.G G...XJ..S.e.Z0y.h..Np8.=&.P.?....R...t..>.2........P.......l}..;=c....@C..9..[..^.?:.yFSu.r.D.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0= HTTP/1.1

Cache-Control: max-age = 588368

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:31:11 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: sv.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1611

content-transfer-encoding: binary

Cache-Control: max-age=541165, public, no-transform, must-revalidate

Last-Modified: Fri, 4 Nov 2016 04:50:17 GMT

Expires: Fri, 11 Nov 2016 04:50:17 GMT

Date: Fri, 04 Nov 2016 22:34:50 GMT

Connection: keep-alive

0..G......@0..<.. .....0.....-0..)0......H.S.......J.?x.7T..a..20161104045017Z0s0q0I0... ...........C%.......`M.....B...;S.y3..}... .....rf..*.!...:<X..2 .......20161104045017Z....20161111045017Z0...*.H..............P..71O.].~..?l.(s'yVNS]....A-..q..fq.N..7..."..g..9e.Sn7...J{..U.s.......P.U S....I.x.o.m.&.P.a.;..&.Z...~@?.9N.l.{4.{k.4.a..Y..p.. yw...v......!.G#...'.Fq!.(......!....P...2..U.......\....5...T.N.b'<Y.#M..'V.?...`.....V.1.2...y......>L...i|.....9`y.to1d....p0..l0..h0..P.......jVl_wg...'.i....0...*.H........0.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'Symantec Class 3 SHA256 Code Signing CA0...161002000000Z..161231235959Z0A1?0=..U...6Symantec Class 3 SHA256 Code Signing CA OCSP Responder0.."0...*.H.............0............y.....l..f.......m./].j..mysU[d......:..!...9......-._k..V.%.B'...'..e.S.....>....3..3..?../.hO#.c.L.......T...<,..-....Bt...U..G.A%|..E..y=jf....%.Y*..x.b..F...'~.,.g6......?..@e.v.|!...R..8....:.N..,;zG.WN..{\c.Q.V!..l.....!h..d...T..Ik....Nu.S.WK"...........0...0... .....0......0"..U....0...0.1.0...U....TGV-D-22120...U.#..0....;S.y3..}... .....rf0...U......H.S.......J.?x.7T..a0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://VVV.symauth.com/cps0*.. .......0... hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0...*.H................a..).B.>@.`...-.1..0..LJ.(S...s...U.'.;...N..Kp[..... B...&...K.|K..xd.....db....."\2..J......l.....U.I..t C.8B...B.... .....v.!#.1.v7$..j......6>.....j.7

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys= HTTP/1.1

Cache-Control: max-age = 444549

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 13:33:22 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: sf.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=386656, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 09:55:44 GMT

Expires: Wed, 9 Nov 2016 09:55:44 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive

0..........0..... .....0......0...0.......].[ .A.|1.rC_H.5F....20161102095544Z0s0q0I0... ...................F....0.yV......{&.K......&.......L@......zW.Et.......20161102095544Z....20161109095544Z0...*.H................L;.;..*-...6......T...P.4..%?.aS@"kD...=7..<.|t.|.H..d.'..8p......,.....y.j.._.0..G$......d.....\.iP.(.3^.......a.K..k/.....vE.m.>..AW......r.....b...0...P.....)..M.Cp....G.....XG.Q....}o......km7...B..9.....{....L.v.{p.9....V.}.]w.1C.n-...:..".I{....^ ....0...0...0...........3..-......F....0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...160928000000Z..161227235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0..........0CTS.....D7.=.s/..|..P...mS.....,.,).?C..r8.H...]....R.&....#..}.[G8C.|P.Z...[........Y.m..5...#.{yp^d;..^.=c~}P5.....=0...U..."!j.1.(.Q...n....O3.-:.R.;..A...............}.......JN..1E....I..!.y.:u.Jw..S......8.s..P..d........ ..t.u......X.cM...N:."a ...........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-D-21700...*.H.............h.S...i..v...l.p,'JO....*.mGF`...(..MU|.vn.....*.^.2..._.$..j

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:08 GMT

X-Varnish: 206486617 206485799

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 2

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT

If-None-Match: "200da-5b6-4eb453c33260e"

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Date: Fri, 04 Nov 2016 22:34:45 GMT

Etag: "200c0-b1c-53fb55344ca83"

Last-Modified: Tue, 25 Oct 2016 19:15:02 GMT

Server: ECS (arn/45CB)

X-Cache: HIT

Content-Length: 2844

0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..161025180751Z..170120180751Z0.._0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...150603184605Z0....'k...150603185020Z0....'k...150603185058Z0....'k...150603185131Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:19 GMT

X-Varnish: 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: MISS

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1

Cache-Control: max-age = 547348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 21:12:41 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=512823, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 20:57:28 GMT

Expires: Thu, 10 Nov 2016 20:57:28 GMT

Date: Fri, 04 Nov 2016 22:34:45 GMT

Connection: keep-alive

0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...20161103205728Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5..........^.3@..cL.1.......20161103205728Z....20161110205728Z0...*.H..............?....eGB.!...w.}d..5y..!3P..j...1oL..v.......8&...8.i.].4..Z.?..<............Kh.....4.LT%.%Jh ..../.....u.s4QP54.}.5.].b.5.}w..%...<...9y..Lp*].........n1..Nz<..Hc..P....................P.L.$.}......,.....a$..._C..7k.s.p...VS^P.?@...^......l......Q.9RZ..z...#0...0...0..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0..........&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m......@U...T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. ....J].M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd..*o..&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.............0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........https://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TG

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= HTTP/1.1

Cache-Control: max-age = 363986

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sun, 17 Nov 2013 16:06:48 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1452

content-transfer-encoding: binary

Cache-Control: max-age=404268, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 14:50:27 GMT

Expires: Wed, 9 Nov 2016 14:50:27 GMT

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0..........0..... .....0......0...0.........Yt...........z.(...20161102145027Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..%...0a.. ...M|......20161102145027Z....20161109145027Z0...*.H.............$...4.x..a .*$=v<.g..t.......]..9.U:"......!o.a....vK.D....%.....%...9..._'.....Y........_<m..H..;......2 .b..1....#;.&aX...V..x....l-....*..ed.z...*P3.E..t......[. ..y..x...U.....'l&.;..$....4..I.M....ULHX...J..=...0.x.$W38e...I..;7/ .^..-....:......u.B......0...0...0..2.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 40.."0...*.H.............0..........K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.by.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?......g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H............o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd........#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`8......

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY= HTTP/1.1

Cache-Control: max-age = 512217

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 09:17:20 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 5

content-transfer-encoding: binary

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0....HTTP/1.1 200 OK..Server: nginx/1.4.7..Content-Type: application/ocsp-response..Content-Length: 5..content-transfer-encoding: binary..Date: Fri, 04 Nov 2016 22:34:46 GMT..Connection: keep-alive..0....>....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1452

content-transfer-encoding: binary

Cache-Control: max-age=557368, public, no-transform, must-revalidate

Last-Modified: Fri, 4 Nov 2016 09:20:23 GMT

Expires: Fri, 11 Nov 2016 09:20:23 GMT

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0..........0..... .....0......0...0.........Yt...........z.(...20161104092023Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20161104092023Z....20161111092023Z0...*.H................>@..W..=vlg..........Vy...m......wZ !Zl..../.z&..z.:.1......k.....c).....%..0...8....!li.~..w\.y..W...)F.....J......|...@..w1..C.IX........h...m[....v....o.i~.GE.'A:.......... ..... l.....cv.... .........O.l.E..S.dx9....bxV.,.M.#m......AF.......o.6..~......0...0...0..2.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 40.."0...*.H.............0..........K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.by.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?......g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H............o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd........#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`8......

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE= HTTP/1.1

Cache-Control: max-age = 589790

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 20 Nov 2013 09:32:32 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 5

content-transfer-encoding: binary

Date: Fri, 04 Nov 2016 22:34:47 GMT

Connection: keep-alive

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Cache-Control: max-age = 435806

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 11:05:46 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=401349, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 14:00:49 GMT

Expires: Wed, 9 Nov 2016 14:00:49 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive

0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...20161102140049Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5........M.s.Q~...@?j.......20161102140049Z....20161109140049Z0...*.H...............D..#i.F.Z....faQ.#...SP...n.~.....b.. ...J2e4...U.yC......E...g`6...7........W.....i.G.v...H.8.(.......T .).A\..Kd.q....].OK...zrrz.Y...4......dmV....,..G....cW....r......._...X3..!..`......*...S,.cC...1..;..._yN?Y....F2n=0...G..z..J)"{"~..%^!...5IJ.L......#0...0...0..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0..........&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m......@U...T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. ....J].M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd..*o..&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.............0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://www.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-D-21870

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Cache-Control: max-age = 584393

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:26:54 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=486074, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 13:32:39 GMT

Expires: Thu, 10 Nov 2016 13:32:39 GMT

Date: Fri, 04 Nov 2016 22:34:51 GMT

Connection: keep-alive

0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161103133239Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V.......K3.....20161103133239Z....20161110133239Z0...*.H................o.2.s.j).H.'8..`.?..b...,\...Qj..... . .f...@...:@f....LPq...=D.....W....././U.3b..!.... ......v..9/.2>......8y.Z0fB..(...)*oz......v.b. ...K...)_..........}#......f..d.P... ...U.e./...N%q.1.=....A_.../.~..~..36S\}.......n...,.VMp.4.xaC.c....W.O=~.W........0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.

<<< skipped >>>

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ HTTP/1.1

Cache-Control: max-age = 339923

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:41:21 GMT

If-None-Match: "c06e9a4e33eec9dd813b8faff15397229f914d2a"

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg142.ocsp.omniroot.com

HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1746

Last-Modified: Fri, 04 Nov 2016 22:16:08 GMT

ETag: "5fc52ba3045cb8822c18fe74c1700365587a44c6"

Cache-Control: public, no-transform, must-revalidate, max-age=339695

Expires: Tue, 08 Nov 2016 20:56:23 GMT

Date: Fri, 04 Nov 2016 22:34:48 GMT

Connection: keep-alive

0..........0..... .....0......0...0......\r...Ev.C..*....omJ...20161104221608Z0w0u0M0... .........-R...P:.B...9...0Q.......sw....KM...3..r...C...X.<1ya..w.2..^.?....20161104221608Z....20161108221608Z0...*.H.............}bkI.yrT......u....s..[.......V.gc6..Q2.CZ.....2......5...{.r..p....~}...s..-.V=..dK...rg.o"SS...8]...4.....i....{?U[.X.=)ry..U..&o..4..7...$.u.{....4.#.........X..v..G.j..f.=..._........@.....~.. ...`h3;/.V.Z*.'........?.....b....L.TA....../....Oe0...dX.A....0...0...0...........1....n.SsnC.K.]I.w90...*.H........0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA20...160407064154Z..170407064154Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1%0#..U....vassg142-OCSP Responder 20160.."0...*.H.............0.........w.;..Eu..'f.c^....Qe.O...U.....d.\?.....S.r'g.d..ES.NA.t....<.....#?.."...*Pm.<..s........v...<....8......A@.....7h...r$.T..8=......\....>......z=t3?(.....i.>t.^.....]7.9..j.E. ....{.$w..Y,...hf..6......L._9,.....i...S...)/.."^.K.O...bb^....V....'p...'V..........H0..D0... .....0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure.omniroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.der0...U...........0...U.%..0... .......0...U.#..0.......sw....KM...3..r.0...U......\r...Ev.C..*....omJ.0...*.H.............l/0j.Z.z.......n-..2.?.e.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg= HTTP/1.1

Cache-Control: max-age = 471678

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 28 Nov 2013 01:44:29 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: evsecure-ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=493882, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 15:42:58 GMT

Expires: Thu, 10 Nov 2016 15:42:58 GMT

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161103154258Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313...*.m7..o..|.........20161103154258Z....20161110154258Z0...*.H................b.B..... .7..n...].......q...X.[...Nb............".9..z.M.Cv#I....cbZ.,BW...$G....&{...9q...h[[....#...`.. ...VC.E.>.j=......s..]....aJ..l......).2.....s......Z.x.W..2.F...OY..,.\.T...8......1.........f.k.N.R.=......t..j...H..V.}.....or.]..*.....cm.........0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: yandex.ocsp-responder.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1548

Connection: keep-alive

Keep-Alive: timeout=5

Content-transfer-encoding: binary

X-Cached: MISS

X-Cache: HIT

0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..20161104213325Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M..."[.w..2............20161104213325Z....20161111213325Z..0.0... .....0....0... .....0..0...*.H.................... 7..m...w{......'`.%.%.....$...H.y.qTsGy..6....q%].=Q ....8;..~..ir..m)..yO..y...D#..yS......y...*..m.....}L5......T.5O5.........lR..d)..1.GV?....I. R.{,.p..t....)P....H.,.!*..\N.eB/.....;.S]Kx.....y....4.p.0....m/...._4$4.k0E.=..G...J;x.w(<.X........0...0...0..........F.......4..or"<i0...*.H........0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Authority1.0...U....Yandex CA0...161027084144Z..170125084144Z0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service0.."0...*.H.............0..........&@.L)=DbS.4...v.....v..U...1Vf.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H...B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..ji...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\.......N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0... .......0... .....0......0...*.H................ ....k....@.........xZ.v..a.0.h.$........K.....V.1'v.........H..A.V)*Pe..Q...:\FeJ.s%...........~:t......;..!...r.~...kxd...;.f>.I..5.....?.....L.uWQg........Ja.wt.U.'*$.J.!1....;`..XN....A...]...>.jO...?.eg...........

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: yandex.ocsp-responder.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1548

Connection: keep-alive

Keep-Alive: timeout=5

Content-transfer-encoding: binary

X-Cached: MISS

X-Cache: HIT

0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..20161104215138Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M...P..m....,.(t.?.....20161104215138Z....20161111215138Z..0.0... .....0....0... .....0..0...*.H...........4YBR...%.......F7......aGU...]....g.2x`D.G[1=.x.rU.!.4W....,.zZ......].0.?....45. c.q...1..H.....a.CEC..I{......D]y.C..Po.w.V6.$*.".WW....re..KG. Q.......(F>..~$F.@..c.y.....]p.}..........A(2.r..._..]d...X....C4.........}.g.,.yn. .Sn.6.zg..H......_.).T-.......0...0...0..........F.......4..or"<i0...*.H........0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Authority1.0...U....Yandex CA0...161027084144Z..170125084144Z0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service0.."0...*.H.............0..........&@.L)=DbS.4...v.....v..U...1Vf.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H...B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..ji...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\.......N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0... .......0... .....0......0...*.H................ ....k....@.........xZ.v..a.0.h.$........K.....V.1'v.........H..A.V)*Pe..Q...:\FeJ.s%...........~:t......;..!...r.~...kxd...;.f>.I..5.....?.....L.uWQg........Ja.wt.U.'*$.J.!1....;`..XN....A...]...>.jO...?.eg...........

<<< skipped >>>

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:45 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d75bbd26e58b4db91ab3b562b2f8660c91478298885; expires=Sat, 04-Nov-17 22:34:45 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT

ETag: W/"581bdf7e-227"

X-CCACDN-Mirror-ID: rmdccacrl7

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Sat, 05 Nov 2016 02:34:45 GMT

Server: cloudflare-nginx

CF-RAY: 2fcb8905462e401a-SOF

25a..0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..161104010814Z..161108010814Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H..............E3.l.3G...@O..G...G...}..X.X*Q.Xy./,Y...iR.q....3*U.kel.."..]..0|.( ..nd...0u.f.iu.n....i.......nJ....n.......2..]A....j.av .......(`.u.....)>.4S......;......I..._.\........&Vw..........d..^...(?gT~...Ti0...a..1-".pf.X....Bgi.?....M...WT.P.....v.8e\\.@h.O..0..HTTP/1.1 200 OK..Date: Fri, 04 Nov 2016 22:34:45 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=d75bbd26e58b4db91ab3b562b2f8660c91478298885; expires=Sat, 04-Nov-17 22:34:45 GMT; path=/; domain=.comodoca.com; HttpOnly..Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT..ETag: W/"581bdf7e-227"..X-CCACDN-Mirror-ID: rmdccacrl7..Cache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: Sat, 05 Nov 2016 02:34:45 GMT..Server: cloudflare-nginx..CF-RAY: 2fcb8905462e401a-SOF..25a..0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..161104010814Z..161108010814Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H..............E3.l.3G...@O..G..

<<< skipped >>>

GET /UTN-DATACorpSGC.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:46 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=dab2b16133ff7d811973ec1520f4f1a221478298886; expires=Sat, 04-Nov-17 22:34:46 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT

ETag: W/"581bdf7e-22d"

X-CCACDN-Mirror-ID: rmdccacrl8

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Sat, 05 Nov 2016 02:34:46 GMT

Server: cloudflare-nginx

CF-RAY: 2fcb890a32fe401a-SOF

239..0..50......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertrust.com1.0...U....UTN - DATACorp SGC..161104010814Z..161108010814Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S2........].N...E..O0...U........0...*.H..............'H....6..;.;phx.....i....&........F[..c...W.....q..@U...g./.k....Q.YHa.Yr......u...c..Q..T..&.7.~;..u..v.....K..Y<-.....k.../.J.uNzS$.U..@OO..W....r)~...'..I..GU..~zA...,.z2....ry{.Z.......al..(...t....a..X.'........<c._.H<}6.w.....#... ?Y...=..G..i.L95.d..0..HTTP/1.1 200 OK..Date: Fri, 04 Nov 2016 22:34:46 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=dab2b16133ff7d811973ec1520f4f1a221478298886; expires=Sat, 04-Nov-17 22:34:46 GMT; path=/; domain=.comodoca.com; HttpOnly..Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT..ETag: W/"581bdf7e-22d"..X-CCACDN-Mirror-ID: rmdccacrl8..Cache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: Sat, 05 Nov 2016 02:34:46 GMT..Server: cloudflare-nginx..CF-RAY: 2fcb890a32fe401a-SOF..239..0..50......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertrust.com1.0...U....UTN - DATACorp SGC..161104010814Z..161108010814Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S2........].N...E..O0...U........0...*.H..............'H....6..;.;phx.....i....&........F[..c...W.....q..@U...g./.k....Q.YHa.Yr......u...

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 19:03:25 GMT

Expires: Tue, 08 Nov 2016 19:03:25 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 12683

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161104070222Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...0A..%[.....20161104070222Z....20161111070222Z0...*.H.............@K.n..f.......w3D..%..Z.r*.........c...(..ds.=..)......oii...H.8.<E.........h.....2=(.oN...l..).......6/......D.......M.\.Y....nu..{........`......_J.Y...#..Bi.}.|k2....Y.H.t0N.;M..1H.7Y.W....RR. .*j.#K.#62....h..f..;...&pa.8.h,.aX.A.N`...K.m9..,..@...........

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 03:43:33 GMT

Expires: Mon, 07 Nov 2016 03:43:33 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 154275

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190348Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..u...5:......20161102190348Z....20161109190348Z0...*.H...............3I..-b`O..\..........`.............q......O.g..%6.xo........`.7.d.../..v.~......I.!X...'._.....\.....L...@HGs..u\...n.TE.g..1..b.^9.A.);.Y`S)&..y..}..F..N\>.&..~....t.9.{....Y.............*M.?.:.....Ug*^}.a.TA..tHN_.G.oDL<#../..UUQ..6B...B.R.K........ ......

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 13:58:35 GMT

Expires: Sat, 05 Nov 2016 13:58:35 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 290173

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070311Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...../.5......20161101070311Z....20161108070311Z0...*.H.............RL....U..WQ..<..@.6*...`-..........6.`..kXh.]w..zk. ....#!...[.L.......Da|MZ......".Y...%..v...[.......oQ../QL...vH..........J.T?..c.3.dC...tn.hL.Ps.6..4Q)d[..k.........t...~.hq.n..dc_..Z"K....t,.....9Q......R.$..s.W.l]kf.}.z......].%>...8.....(.-.b.O...9.....

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 02:51:47 GMT

Expires: Mon, 07 Nov 2016 02:51:47 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 157381

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190122Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..fb....$.....20161102190122Z....20161109190122Z0...*.H.............|_..X].*......p&.........K}......G...K.W.\f..g,".Q0.&..(.......8........cc.`....`EV....].w..1....|......W..Z8..?R9.'.x.R..:.....h.....a...|."......$Lv..........=.(.=..BKuy#.$.,...3%..A....%....!/.#.z...I.#i@.Ni.g.........W.....gw.$}...V.= ...V....kn......B....

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 02 Nov 2016 12:38:49 GMT

Expires: Sun, 06 Nov 2016 12:38:49 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Cache-Control: public, max-age=345600

Age: 208559

0..........0..... .....0......0...0......J......h.v....b..Z./..20161102010418Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...[..D7fZ....20161102010418Z....20161109010418Z0...*.H..............y.ze.*H...........t`D...2....j. ..0...C..!..j5..r...r..V.3{.......m.j.&Z... .7.{.!MZd...~:'.)....D.7...muOZ..a.b..L..F...;.m....--..rC$..~.%..o..a.}.....c...%.......?N..v0|.D..}....#a..|;C..k.5..q.F..L..%u..'..`.y..J.._uFgzj..... .<hyEv*....6.g.@...8.Z...HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Wed, 02 Nov 2016 12:38:49 GMT..Expires: Sun, 06 Nov 2016 12:38:49 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 208559..0..........0..... .....0......0...0......J......h.v....b..Z./..20161102010418Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...[..D7fZ....20161102010418Z....20161109010418Z0...*.H..............y.ze.*H...........t`D...2....j. ..0...C..!..j5..r...r..V.3{.......m.j.&Z... .7.{.!MZd...~:'.)....D.7...muOZ..a.b..L..F...;.m....--..rC$..~.%..o..a.}.....c...%.......?N..v0|.D..}....#a..|;C..k.5..q.F..L..%u..'..`.y..J.._uFgzj..... .<hyEv*....6.g.@...8.Z.......

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 04:58:50 GMT

Expires: Mon, 07 Nov 2016 04:58:50 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 149758

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190248Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..#. o..>b....20161102190248Z....20161109190248Z0...*.H..............E;`.'{.._$}...ig\.^....].......ux2n..@.j..3..5Ix..Zy"..bc~....2.........'.........=.=\..C......./eF......K=....B...0../z.....N....^;.e...NO7!EsBzO....... *U.8.2.<?..F.L/m....6.....^...%/.....v$.*o1..KO...N.1......'.')_9a(ws;...b9_..i./...L&`k%'.p.[ ..%...HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Thu, 03 Nov 2016 04:58:50 GMT..Expires: Mon, 07 Nov 2016 04:58:50 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 149758..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190248Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..#. o..>b....20161102190248Z....20161109190248Z0...*.H..............E;`.'{.._$}...ig\.^....].......ux2n..@.j..3..5Ix..Zy"..bc~....2.........'.........=.=\..C......./eF......K=....B...0../z.....N....^;.e...NO7!EsBzO....... *U.8.2.<?..F.L/m....6.....^...%/.....v$.*o1..KO...N.1......'.')_9a(ws;...b9_..i./...L&`k%'.p.[ ..%.......

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 14:10:59 GMT

Expires: Sat, 05 Nov 2016 14:10:59 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 289429

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070302Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..CM.{...N....20161101070302Z....20161108070302Z0...*.H.............J^..8. .GU...*....=..7O....X.\*..<...IcC...z....Ie;E.>...).....F.kp....|..2...C.?.....).....dp.....w...........}...Q...).......ll.\...`R#.E# zJ.[}..d..0.........|tu....LY...?.~!...$.d4Z.I...........,...1..J.nO#.^...R9.....6\.........Y.T.3f.........S.8....$....

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 14:21:58 GMT

Expires: Sat, 05 Nov 2016 14:21:58 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 288771

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070030Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..).(.I.0^....20161101070030Z....20161108070030Z0...*.H................N.].[...=...AL|./....%2. .s.:...y1.....|.A.O<..X..T_....fh..o.....2hAM....P.&.. ML>.....m......m.......z....JV#.....r..Z.u..P..c._... Q...%...$/_...1......r....2.[.j.......IYpa.s .il..-z..&2~..wX...........bq....&).....cf!.={....x3.GG.W.67...=......S.. HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 01 Nov 2016 14:21:58 GMT..Expires: Sat, 05 Nov 2016 14:21:58 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 288771..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070030Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..).(.I.0^....20161101070030Z....20161108070030Z0...*.H................N.].[...=...AL|./....%2. .s.:...y1.....|.A.O<..X..T_....fh..o.....2hAM....P.&.. ML>.....m......m.......z....JV#.....r..Z.u..P..c._... Q...%...$/_...1......r....2.[.j.......IYpa.s .il..-z..&2~..wX...........bq....&).....cf!.={....x3.GG.W.67...=......S.. ....

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11 HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 02:26:35 GMT

Expires: Mon, 07 Nov 2016 02:26:35 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 158894

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190208Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..<...k..u....20161102190208Z....20161109190208Z0...*.H.....................m..c..!..C..N....w.1.........:d&.hq...#.....G'.m.>...Jz.u..........-...i.|r..7,RY.3.:.....WKH J....By.v.6d...}J...n.[[C...f..0S..j..56;...n.}...P....97...F(.WBRH..........CY..#9Iv..c...XW....wVm._E....I..P{.......'6.u.\4mQNT..X...fp..-.C.q..jv[.huWHTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Thu, 03 Nov 2016 02:26:35 GMT..Expires: Mon, 07 Nov 2016 02:26:35 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 158894..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190208Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..<...k..u....20161102190208Z....20161109190208Z0...*.H.....................m..c..!..C..N....w.1.........:d&.hq...#.....G'.m.>...Jz.u..........-...i.|r..7,RY.3.:.....WKH J....By.v.6d...}J...n.[[C...f..0S..j..56;...n.}...P....97...F(.WBRH..........CY..#9Iv..c...XW....wVm._E....I..P{.......'6.u.\4mQNT..X...fp..-.C.q..jv[.huW....

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 10:27:55 GMT

Expires: Mon, 07 Nov 2016 10:27:55 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 130014

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161103010227Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..x.L.-.).....20161103010227Z....20161110010227Z0...*.H.............<.X.g....S.....$.......#.."b.1Bh..R.....[..G...{y?<.a..........si......K7%......'W.f.... !_...]<@..d...<>/<.p....Y_..b...H>...E........<...,<.t..;.....-2.u%./......7..0...6...lG|...'...$6.?l..u.d9vA..~Kq`.....x c..(.>].....H..TC...)ea.......C....... .3I.......

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 21:41:58 GMT

Expires: Sat, 05 Nov 2016 21:41:58 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 262371

Cache-Control: public, max-age=345600

0..........0..... .....0......0...0......J......h.v....b..Z./..20161101130128Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..D.....V.....20161101130128Z....20161108130128Z0...*.H.............B....\..=s...$.EO&=.6.. K.?...J.wQ..P....P$..(..b....B\...7.u..m........ .l.A......&...n\. ...=......|@...Z...g....T@N..N....@..{..s.s.-<......{'.K...X.k...V8.g.]......Q.......U.(\...N.bp.L....P.....DN...S.PQ...0.......Q('..'..)1........c.2..b..h.. ....4.HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 01 Nov 2016 21:41:58 GMT..Expires: Sat, 05 Nov 2016 21:41:58 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 262371..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161101130128Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..D.....V.....20161101130128Z....20161108130128Z0...*.H.............B....\..=s...$.EO&=.6.. K.?...J.wQ..P....P$..(..b....B\...7.u..m........ .l.A......&...n\. ...=......|@...Z...g....T@N..N....@..{..s.s.-<......{'.K...X.k...V8.g.]......Q.......U.(\...N.bp.L....P.....DN...S.PQ...0.......Q('..'..)1........c.2..b..h.. ....4...

GET /PublicSureServerSV.crl HTTP/1.1

Cache-Control: max-age = 150326

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 20 Nov 2013 09:46:05 GMT

If-None-Match: "2b0037-c0d1-a6553140"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=864000

Content-Type: application/x-pkcs7-crl

Date: Fri, 04 Nov 2016 22:34:47 GMT

Etag: "4029b-51347-5407ce3d0400e"

Expires: Mon, 14 Nov 2016 22:34:47 GMT

Last-Modified: Fri, 04 Nov 2016 17:20:25 GMT

Server: ECS (arn/46BA)

X-Cache: HIT

X-Cntnt-Length: 332615

Content-Length: 332615

0...B0...)...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybertrust Public SureServer SV CA..161104165625Z..161114165625Z0...z0......... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I..101116165848Z0.........,U./...101116173007Z0.........,U.h...101116172944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0.........,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..101116195619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0.........-..4...110315204303Z0........../P....120206141831Z0..........I..@..120124180322Z0..........JP....110222182509Z0..........Jf/Y..120213142815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0..........YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu...120220131416Z0..........^..^..111007192320Z0..........`.w...120213144727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0..........hlG...120213145015Z0..........h.....120130140408Z0............j...120110213653Z0...........}....110406160143Z0............$...110401005006Z0................110401005536Z0............W...120308151704Z0.............h..120228141105Z0................110314145902Z0............`...110322142311Z0................110322142551Z0............lb..120110213802Z0.............0..130201130700Z0............OB..110321165802Z0.............o..110321172720Z0...........g.:..120221183148Z0...........Ud...110516131110Z0............h5..120229174140Z0................1202

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:29 GMT

X-Varnish: 206488254 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 4

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:24 GMT

X-Varnish: 206487949 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 3

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 08:39:04 GMT

If-None-Match: "06a163dbd612a346836873636bdef55a96277740"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 21:35:50 GMT

Expires: Tue, 08 Nov 2016 21:35:50 GMT

ETag: "a44b6f2498f2c689d96d5918d635d092ebfa0fcb"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb891095574050-SOF

0..........0..... .....0......0...0.......ue......$I1......dO..20161104213550Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K......../N.E.....20161104213550Z....20161108213550Z0...*.H..............y..#H....T...A=..R..;*K.V/4.}....O.2........s..x.........].....n....!...7U.u....LZ.........o..F..b....)....[s.r|L....:6..k...aBh...p.......$e...vu.'.a.a........xy`3....K..%nB..OS.%..... ...n.=..n..S.E#._.W...`L@ ..._|f.d...c.K.~0.S!O...'.W69.7......NV.o.)....0...0...0..........H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z..161115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.........ga..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU....@...h.3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#.M.vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p.6.E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U...........0...U.%..0... .......0...U.......0.0...U.......ue......$I1......dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H..............$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..k,....f...K....A...a..@...b.qZ....Z......4.L.i...=.C.....0(*....................1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..P...H. .s7..s.~..P..@...S...l..9.....$.....3....P6.'.$...........

<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 07:50:34 GMT

If-None-Match: "6b9ba9eca642c891cc02365fc6161341647bd9fc"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 20:07:29 GMT

Expires: Tue, 08 Nov 2016 20:07:29 GMT

ETag: "116835402ed3e6687ea7e1347babccca0ce09762"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb8910e5ad4050-SOF

0..........0..... .....0......0...0.......ue......$I1......dO..20161104200729Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.BG....20161104200729Z....20161108200729Z0...*.H..............w.sqWkRJC#QVx....8N/. R.).vx...'.F.t.g..9{.y.......6%GN...*LU.._n....8x.....OQ..v..Sx..A....y.*r............?...HE.......#Xj5.E9y....K....ql..n........3...8......."...GX.B......6..A.d......G>.[..X....<......z.n..J....g/>MG2.13.p...pH.G.!...<3X...d....4.&P....0...0...0..........H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z..161115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.........ga..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU....@...h.3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#.M.vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p.6.E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U...........0...U.%..0... .......0...U.......0.0...U.......ue......$I1......dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H..............$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..k,....f...K....A...a..@...b.qZ....Z......4.L.i...=.C.....0(*....................1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..P...H. .s7..s.~..P..@...S...l..9.....$.....3....P6.'.$......

<<< skipped >>>

GET /rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 08:41:57 GMT

If-None-Match: "682f048b8d31cb3f1cc888edf96fec2777d7e64b"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: application/ocsp-response

Content-Length: 1507

Connection: keep-alive

Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 19:40:47 GMT

Expires: Tue, 08 Nov 2016 19:40:47 GMT

ETag: "9a5e0e2eda739d824031f795d956a4198eca2c4e"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb891136044050-SOF

0..........0..... .....0......0...0...........1.IVp*.@N~.......20161104194047Z0n0l0D0... .........\.1n........U.:.yB......Wg...j..Y..-.............DN.JU....20161104194047Z....20161108194047Z0...*.H..............X{[}...Y.6ab..e....p..b.F..7.F(..\rp....#>......./>........4..0d.DZ..........).....r6_..>..<.. ...........8...*.h...Gem....&.:.S.t.....L\.c#=-....*<jn..#V...C.5..%V....\*w.>v..)ih.F.....m`..1...Lc.9.........!.:..w.T./b_....oXv.QXQ....u....._...7.....A...R....0...0...0..........H.j...N... .<i0...*.H........0L1 0...U....GlobalSign Root CA - R21.0...U....GlobalSign1.0...U....GlobalSign0...161007000000Z..170115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R2 - Signer 1.10.."0...*.H.............0.........N.......B>.|..S...@.......C.a.C.........V...Cf|G.....,......|.b..K.T.x<L.K...6Q..zeh.....Zd.n...0km86...\...n..v..O.......9...)...|...#.....j.......%W..vH`..Z.=..1[.d.y...)..n.&3,Z...#..Q....A.&...i..r"0.!6.g._..7...&.]..4 .$........IG..sw.....c.J.../.7b.........0..0...U...........0...U.%..0... .......0...U.......0.0...U...........1.IVp*.@N~.....0...U.#..0......Wg...j..Y..-.....0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............s2..o"..2]=~.=..K.D...{n......,hd.....~TKr.R...K..u.&....lx...^.G...n9.x..~..o.R..:...\I..c<.]I..Ps..uh...<.(..HnJT....m..o.f%..'4^.)...z.-...$s.iI......M....B..3y./..3. .]2.......v.-.l...,..r.k.{^.OW!.......b.k......_Px'....IF............m.(.~.:...r#t

<<< skipped >>>

GET /pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl HTTP/1.1

Cache-Control: max-age = 6793

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 23:37:31 GMT

If-None-Match: "b61f5b26b7e4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: mscrl.microsoft.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=7200

Content-Type: application/pkix-crl

Date: Fri, 04 Nov 2016 22:34:45 GMT

Etag: "ad925b8a3c1d11:0"

Last-Modified: Wed, 08 Jun 2016 16:35:08 GMT

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

Server: ECAcc (arn/46C8)

VTag: 791539655600000000

X-Cache: HIT

X-Powered-By: ASP.NET

Content-Length: 163018

0..|.0..{....0...*.H........0..1.0.....&...,d....com1.0.....&...,d....microsoft1.0.....&...,d....corp1.0.....&...,d....redmond1.0...U....MSIT Machine Auth CA 2..160608162453Z..160616164453Z0..z.0)....=.........130522112904Z0.0...U.......0).....3........130522112904Z0.0...U.......0)..M.\.........130522100146Z0.0...U.......0)....K.........130522100145Z0.0...U.......0)...........Z..130522100145Z0.0...U.......0).....j.....I..130522100145Z0.0...U.......0)....q.....q...130522094611Z0.0...U.......0).....C....q=..130522055646Z0.0...U.......0)..P.......j...130522055646Z0.0...U.......0)..c.......:...130522053344Z0.0...U.......0)..[..x....F0..130521142635Z0.0...U.......0)..[.......F...130521142635Z0.0...U.......0)..`.ii....9...130521142635Z0.0...U.......0)..`.X.....9...130521142635Z0.0...U.......0)..[.......F/..130521142143Z0.0...U.......0).....9....p...130520132837Z0.0...U.......0)..Q.4u....]...130520115050Z0.0...U.......0).....p....p...130520110806Z0.0...U.......0)...z......fQ..130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U.......0)... K.....p...130520094519Z0.0...U.......0)... H.....p...130520094519Z0.0...U.......0)...zF,....o...130520070955Z0.0...U.......0)..f..E....P...130518074816Z0.0...U.......0...\,jN....FD..130402211200Z0...../w....U...130328232900Z0...p.R.....G1..130226223400Z0....e......?...130220163500Z0....[......*...121221223500Z0...A......."...121206221900Z0...A......."...121206221900Z0...A......."...121206221800Z0...A..\...."...121206221700Z0...A.

<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:19 GMT

X-Varnish: 206487540 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 1

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server: - Web acceleration by hXXp://VVV.unixy.net/varnish

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:24 GMT

X-Varnish: 206487941 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 2

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 20 Sep 2013 05:02:11 GMT

If-None-Match: "96d8890beb5ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Nov 2016 05:01:26 GMT

Accept-Ranges: bytes

ETag: "82c52e2ac634d21:0"

Server: Microsoft-IIS/8.5

VTag: 438100426000000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:45 GMT

Connection: keep-alive

0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..161101211705Z..170131093705Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......:0... .....7......170130212705Z0...*.H...............j!f......L..W.O...i..4...(cZ...x?y...........-a.N.q..............O.$l.....>........]........Y>.....^..99&I..{;a....{.X.c..........>K.9..lp.....u|..N] .l...;..a...y.q.c .......9....f.....B..:....).#..x.IN.."s..s.P<b*3!nw.i.....CnWe...gZ .............#6.._HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 02 Nov 2016 05:01:26 GMT..Accept-Ranges: bytes..ETag: "82c52e2ac634d21:0"..Server: Microsoft-IIS/8.5..VTag: 438100426000000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 550..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:45 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..161101211705Z..170131093705Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......:0... .....7......170130212705Z0...*.H...............j!f......L..W.O...i..4...(cZ...x?y...........-a.N.q..............O.$l.....>........]........Y>.....^..99&I..{;a....{.X.c..........>K.9..lp.....u|..N] .l...;..a...y.q.c .......9....f.....B..:....).#..x.IN.."s..s.P<b*

<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Dec 2015 18:30:06 GMT

Accept-Ranges: bytes

ETag: "0cb60772f2dd11:0"

Server: Microsoft-IIS/8.5

VTag: 791804826200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 530

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p............<.J0... .....7.......0...U......90...*.H..............I...MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D.........g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt.}......X......H.....|d...s..`.8F.l.......R.C........

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 29 Oct 2013 05:02:50 GMT

If-None-Match: "b8b5df1d64d4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 27 Sep 2016 05:00:38 GMT

Accept-Ranges: bytes

ETag: "773de167c18d21:0"

Server: Microsoft-IIS/8.5

VTag: 279261256600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..160926163316Z..161226045316Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......a0... .....7......161225164316Z0...*.H.............&............G.$.-..dc.....7.m..N.`.U......^F.V....%ej..p4...>.[)0.......Z..v.../..b-.....v.A$......z.k.U....@S.._...I.........h*@6.)WM..u....I....ew.7...._.....Y...iFWaQ.}....X.........Y.!..J.j*............<L......L,...Y...c...:.WE..C..Q..|G....j<..z~6q......

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 808

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT

If-None-Match: "9c3f3dbaacc4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 06 Sep 2016 05:01:54 GMT

Accept-Ranges: bytes

ETag: "6b18dc9fb7d21:0"

Server: Microsoft-IIS/8.5

VTag: 279107828100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive

0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..160905204847Z..161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......00... .....7......161204205847Z0...*.H.............".....s..B#.bK..Hv...m,x..e.ec..j...y....6.e......Cp.....7G.0..AH..A.e......I...j....W.obU0.?.....Q.#.\.t..v.4E.......jF.Zm....u...P....88.....nC./.._2&.. .h....Q..z{wl.....?...M..'..s[..\M.t....J.Vb..,G..t....nk._...t.T.c[...kKW&D...#.."9.....X./.w.....%..0....K%.H...x.%..'..}.....P.3;.Y...pe z.!...:X..f..r..i1...F...0.......2.~x.n.R.E...' ..>.)...}GT...>...P.^..]....{..> 2..N.m....!..1gL..jl@...B..5.o....s..6...d..N.u...|%.q..-../.....(.Xm.X...r9...........[.DQ.......Y..;.. U.......xu-%*.-....~..$U.../...HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Tue, 06 Sep 2016 05:01:54 GMT..Accept-Ranges: bytes..ETag: "6b18dc9fb7d21:0"..Server: Microsoft-IIS/8.5..VTag: 279107828100000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 813..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:46 GMT..Connection: keep-alive..0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..160905204847Z..161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......00... .....7...

<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 04 Nov 2016 22:34:46 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

<<< skipped >>>

GET /pki/crl/products/CodeSignPCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Mon, 16 Apr 2012 23:49:48 GMT

Accept-Ranges: bytes

ETag: "0f6669b2b1ccd1:0"

Server: Microsoft-IIS/8.5

VTag: 438195957300000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 558

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:14 GMT

Connection: keep-alive

0..*0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 2000 Microsoft Corp.1#0!..U....Microsoft Code Signing PCA..111110211944Z..420416234935Z.7050...U.#..0...%. K].rT....*.....S.0... .....7.........0...*.H...............&..%PIu@.....\0KF....0..^.h9=.1jT,5.L....Ed ..6.......i.6.xva....oX.^f'....s...!......O...h.1a..Ud);.?....J_...Fu....<v.zx..t..h.0JU%.nk;..B[4.?&Zm^..M.!.'...w.u.\T..Tr..Ch.[.z:....#...T.4Ct.......,...c..}F..U....:..7J...%.#..D6 . ....G..#....T..G;......HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Mon, 16 Apr 2012 23:49:48 GMT..Accept-Ranges: bytes..ETag: "0f6669b2b1ccd1:0"..Server: Microsoft-IIS/8.5..VTag: 438195957300000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 558..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:14 GMT..Connection: keep-alive..0..*0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 2000 Microsoft Corp.1#0!..U....Microsoft Code Signing PCA..111110211944Z..420416234935Z.7050...U.#..0...%. K].rT....*.....S.0... .....7.........0...*.H...............&..%PIu@.....\0KF....0..^.h9=.1jT,5.L....Ed ..6.......i.6.xva....oX.^f'....s...!......O...h.1a..Ud);.?....J_...Fu....<v.zx..t..h.0JU%.nk;..B[4.?&Zm^..M.!.'...w.u.\T..Tr..Ch.[.z:....#...T.4Ct.......,...c..}F..U....:..7J

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

taskhost.exe_252_rwx_003B0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;

71.(5;4=

(203,2$0

/?./,5

:>(

8%/

%/>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4;

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso\vixih.zel

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso

vixih.zel

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

Explorer.EXE_284_rwx_039E0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;

71.(5;4=

(203,2$0

/?./,5

:>(

8%/

%/>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

Dwm.exe_528_rwx_010A0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;

71.(5;4=

(203,2$0

/?./,5

:>(

8%/

%/>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

TPAutoConnect.exe_2068_rwx_00550000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;

71.(5;4=

(203,2$0

/?./,5

:>(

8%/

%/>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4U

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

conhost.exe_2076_rwx_000D0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;

71.(5;4=

(203,2$0

/?./,5

:>(

8%/

%/>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

conhost.exe_3452_rwx_00070000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;

71.(5;4=

(203,2$0

/?./,5

:>(

8%/

%/>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}