HEUR:Trojan.Win32.Generic (Kaspersky), Trojan.AutoIT.Injector.AV (AdAware), Trojan-PSW.Win32.Zbot.6.FD, GenericInjector.YR, BackdoorCaphaw_QKKBAL.YR, TrojanPSWZbot.YR (Lavasoft MAS)Behaviour: Trojan-PSW, Trojan, Backdoor
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: aa1d565a0070bef7366abe3824bf049a
SHA1: cb438dac3143311468ce781ba7e842a1389f32f1
SHA256: 7c0edcf1bb536ad72a98b4437e86dff897e383c87830222889af6d5c514b1887
SSDeep: 12288:K6Wq4aaE6KwyF5L0Y2D1PqLUjL QT9zXpTl2WCAOVFripV2G:othEVaPqL27FDWAsI6G
Size: 525567 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2012-01-29 23:32:28
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):
WinMail.exe:2824
%original file name%.exe:1024
The Trojan injects its code into the following process(es):
taskhost.exe:252
Explorer.EXE:284
Dwm.exe:528
TPAutoConnect.exe:2068
conhost.exe:2076
conhost.exe:3452
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process WinMail.exe:2824 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (42552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.log (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml (1924 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol (608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\tmp.edb (1728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.log (18592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.chk (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml:OECustomProperty (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (3466 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (2712 bytes)
The Trojan deletes the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.pat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb00001.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\edb00001.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2.ui (0 bytes)
The process %original file name%.exe:1024 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmpbe57d30b.bat (179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe (1053 bytes)
Registry activity
The process WinMail.exe:2824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\IdentityCRL\Dynamic Salt]
"Size" = "330"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
[HKCU\Software\Microsoft\Windows Mail]
"Compact Check Count" = "2"
"Settings Upgraded" = "10"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"
[HKCU\Software\Microsoft\Windows Mail\Junk Mail\Block Senders List]
"Version" = "327680"
[HKCU\Identities\{C692FCB0-9162-422E-94A4-4CD072B19CA9}]
"Identity Ordinal" = "1"
[HKCU\Software\Microsoft\Windows Mail]
"LastBackup" = "E0 07 0B 00 05 00 04 00 16 00 22 00 0A 00 7F 00"
"Running" = "1"
"V7StoreMigDone" = "01 00 00 00"
"StoreMigratedV5" = "1"
[HKCU\Software\Microsoft\Windows Mail\Junk Mail\Safe Senders List]
"Version" = "327680"
[HKCU\Software\Microsoft\Windows Mail\Mail]
"Welcome Message" = "0"
[HKCU\Software\Microsoft\Windows Mail]
"SpoolerDlgPos" = "2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF"
[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"
[HKCU\Software\Microsoft\IdentityCRL\Dynamic Salt]
"Value" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"
[HKCU\Identities]
"Identity Ordinal" = "2"
[HKCU\Software\Microsoft\Windows Mail\Mail]
"Secure Safe Attachments" = "1"
"Default_CodePage" = "28591"
[HKCU\Software\Microsoft\WAB]
"NamedPropCount" = "1"
[HKCU\Software\Microsoft\IAM\Accounts]
"ConnectionSettingsMigrated" = "1"
[HKCU\Software\Microsoft\Windows Mail]
"SpoolerTack" = "0"
[HKCU\Software\Microsoft\IAM]
"Default News Account" = "account{CE54EE8F-8454-4E11-A69C-0E6F9BED6C0A}.oeaccount"
"Default LDAP Account" = "account{5F33D8D7-3326-4E0C-969F-F201824EF068}.oeaccount"
[HKCU\Software\Microsoft\Windows Mail]
"lastrun" = "77 71 87 92 EB 36 D2 01"
[HKCU\Software\Microsoft\Windows Mail\Mail]
"Safe Attachments" = "1"
[HKCU\Software\Microsoft\IAM]
"Server ID" = "2"
[HKCU\Software\Microsoft\WAB]
"NamedProps" = "04 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46"
The Trojan deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Software\Microsoft\WAB]
"NamedPropCount"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"
[HKCU\Identities]
"Changing"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
[HKCU\Identities]
"IncomingID"
"OutgoingID"
[HKCU\Software\Microsoft\WAB]
"NamedProps"
Dropped PE files
MD5 | File path |
---|---|
4288a5845ff2cb1b9348e1d633475293 | c:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
The Trojan installs the following user-mode hooks in WININET.dll:
HttpSendRequestExA
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExW
InternetReadFileExA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
The Trojan installs the following user-mode hooks in CRYPT32.dll:
PFXImportCertStore
The Trojan installs the following user-mode hooks in USER32.dll:
SetCursorPos
ReleaseCapture
SetCapture
GetMessagePos
DefDlgProcW
CallWindowProcA
DefMDIChildProcA
DefFrameProcA
GetUpdateRgn
DefFrameProcW
DefMDIChildProcW
DefDlgProcA
GetClipboardData
GetMessageW
TranslateMessage
PeekMessageW
EndPaint
BeginPaint
GetDC
ReleaseDC
DefWindowProcW
GetWindowDC
GetDCEx
CallWindowProcW
PeekMessageA
GetMessageA
RegisterClassExW
RegisterClassW
RegisterClassA
DefWindowProcA
GetUpdateRect
GetCursorPos
GetCapture
RegisterClassExA
OpenInputDesktop
SwitchDesktop
The Trojan installs the following user-mode hooks in WS2_32.dll:
send
WSASend
closesocket
The Trojan installs the following user-mode hooks in kernel32.dll:
GetFileAttributesExW
The Trojan installs the following user-mode hooks in ntdll.dll:
LdrLoadDll
ZwCreateUserProcess
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Scan a system with an anti-rootkit tool.
- Terminate malicious process(es) (How to End a Process With the Task Manager):
WinMail.exe:2824
%original file name%.exe:1024 - Delete the original Trojan file.
- Delete or disinfect the following files created/modified by the Trojan:
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (42552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.log (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml (1924 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol (608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\tmp.edb (1728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.log (18592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.chk (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml:OECustomProperty (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (3466 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmpbe57d30b.bat (179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe (1053 bytes) - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Product Version: Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: 3, 3, 8, 1File Description: Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
UPX0 | 4096 | 524288 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
UPX1 | 528384 | 274432 | 270848 | 5.49606 | 4c66c69384c417c7b84c11e4868e3bc6 |
.rsrc | 802816 | 73728 | 72192 | 3.16803 | 06c162120b40019c928b252bae8d32f7 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Network Activity
URLs
URL | IP |
---|---|
hxxp://acgplug.org/protected/data/serve/config.bin | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/CodeSignPCA.crl | |
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= | |
hxxp://cs3.wpc.v0cdn.net/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl | |
hxxp://crl.comodoca.com.cdn.cloudflare.net/AddTrustExternalCARoot.crl | 104.16.92.188 |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg= | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl | |
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY | |
hxxp://crl.comodoca.com.cdn.cloudflare.net/UTN-DATACorpSGC.crl | 104.16.92.188 |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon | |
hxxp://gpla1.wac.v2cdn.net/PublicSureServerSV.crl | |
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM | |
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH | |
hxxp://cdn.globalsigncdn.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV | |
hxxp://cdn.globalsigncdn.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw== | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za | |
hxxp://a1158.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI= | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11 | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys= | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy | |
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= | |
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE= | |
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== | |
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0= | |
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= | |
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y= | |
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso | |
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I | |
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c= | |
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl | |
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= | 23.43.139.27 |
hxxp://crl.geotrust.com/crls/secureca.crl | 23.43.133.163 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= | 93.184.220.29 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i | 74.125.232.226 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE= | 23.43.139.27 |
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I | 94.31.29.96 |
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== | 23.43.139.27 |
hxxp://ocsp.globalsign.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV | 104.16.26.216 |
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= | 23.43.139.27 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO | 74.125.232.226 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11 | 74.125.232.226 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl | 74.125.232.226 |
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl | 212.30.134.167 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE= | 93.184.220.29 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy | 74.125.232.226 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za | 74.125.232.226 |
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl | 212.30.134.167 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI= | 93.184.220.29 |
hxxp://tg.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU= | 23.43.139.27 |
hxxp://evsecure-ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg= | 23.43.139.27 |
hxxp://sf.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys= | 23.43.139.27 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o= | 93.184.220.29 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC | 74.125.232.226 |
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM | 104.16.26.216 |
hxxp://mscrl.microsoft.com/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl | 93.184.221.200 |
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y= | 5.45.205.235 |
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | 212.30.134.174 |
hxxp://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw== | 104.16.26.216 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY | 74.125.232.226 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= | 93.184.220.29 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss= | 93.184.220.29 |
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl | 212.30.134.167 |
hxxp://crl.comodoca.com/AddTrustExternalCARoot.crl | 104.16.92.188 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= | 23.43.139.27 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= | 23.43.139.27 |
hxxp://vassg142.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ | 2.21.89.35 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe | 74.125.232.226 |
hxxp://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl | 212.30.134.167 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= | 93.184.220.29 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF | 74.125.232.226 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= | 93.184.220.29 |
hxxp://crl.omniroot.com/PublicSureServerSV.crl | 93.184.220.20 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY= | 23.43.139.27 |
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | 212.30.134.167 |
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH | 104.16.26.216 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon | 74.125.232.226 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= | 23.43.139.27 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR | 74.125.232.226 |
hxxp://crl.comodoca.com/UTN-DATACorpSGC.crl | 104.16.92.188 |
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c= | 5.45.205.235 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= | 23.43.139.27 |
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ | 74.125.232.226 |
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI= | 23.43.139.27 |
hxxp://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0= | 23.43.139.27 |
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA= | 93.184.220.29 |
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso | 94.31.29.96 |
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= | 23.43.139.27 |
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl | 93.184.220.20 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1
Cache-Control: max-age = 564348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1362
content-transfer-encoding: binary
Cache-Control: max-age=482178, public, no-transform, must-revalidate
Last-Modified: Thu, 3 Nov 2016 12:27:47 GMT
Expires: Thu, 10 Nov 2016 12:27:47 GMT
Date: Fri, 04 Nov 2016 22:34:50 GMT
Connection: keep-alive
0..N......G0..C.. .....0.....40..00.......j.#.p.e$.\ps.*.. .j..20161103122747Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U....... ...:.....20161103122747Z....20161110122747Z0...*.H...............A....(Ew.x.5......0.._...'F...*.n..O....N49.G.#j..z......|........\R.X.KPP-k.%;..X.......Y.B...3.^.w~...Y...lu.].^.c.-....\..=.....g.....)..x.Y.tr..\:}..]....L...z.*.L........t....&.,.~......&.%.8J.J<.....e?..E...qP.=.F.)P.T.........G...o/...,..b{.R.X.......0...0..|0..d........:.0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U....GeoTrust Global CA0...151203170230Z..161214170230Z02100...U...'GeoTrust Global CA TGV OCSP Responder 40.."0...*.H.............0.........[.c.#zj......RME.....,......(..U......!-.l..R..E.~..%."./8mv..D...*...Rx........mw.~2..Q5T\.H...Wk*..a.z.$._..T......;T.S.r(._*.G....^.P.!.3..t.......s......P....C._.g.b.oK...EV..>...>.|.o.~quo.............v4..Tt....Q.]A.Y......... w.E..=.%.n7.......{" *C........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U...........0...U.......0.0 ..U....0...0.1.0...U....TGV-C-670...*.H...............aEc<..'R......]C.ri.Zm.....|..B.$..76..h....l...Xbxua...C.X.S....~K..A..._.T@$.....9(.... ......\.*.....5.b.x...[QM.._9P.=..l...gf..L.?..3 ......Z....._...20R;...x.......C..0....l.G.A..5TS>d.U......w.(\....v..9.z7.....J..;..'...u.Y...BB.@.2u.e..eW..J.U....
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA= HTTP/1.1
Cache-Control: max-age = 500864
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 02:06:23 GMT
If-None-Match: "57feec1f-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=503521
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581c9786-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 14:13:26 GMT
Server: ECS (vie/F398)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Z..{*....q..`.-.eu.X..20161104132000Z0s0q0I0... .........G.h...#......Vm.Q....Z..{*....q..`.-.eu.X....Z...I{.I..h.&.....20161104132000Z....20161111123500Z0...*.H...................PQ....X.R.....6.......Qw.......3WMY6QNIUR.O.....$.:..............3V.g..#......g....G...c.R..5p......W.$..%"..[t.`5..t............5..Nl{n..............E.U:L7U.f.....,R..q......~m#X..H.e.P12..=....f..Zk.....0q._.....H......Lo..%hG.-.})R..F..l.q..!rd#.o....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI= HTTP/1.1
Cache-Control: max-age = 507829
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 03:40:21 GMT
If-None-Match: "57ff0225-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=499845
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cabe7-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 15:40:23 GMT
Server: ECS (vie/F2D3)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....20161104145200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z.......c.Y..6. Y.<..b....20161104145200Z....20161111140700Z0...*.H...............L..mU.d.._..D.....0.......yh...s.sny.......O.k.IJW....0..{M....G..9.#f#.>....w.......g>B^..B...~..lt............A.].=w.::........M6.....BWJ^...\..9..a.q.w.I..y:..n.1n$.o&9.2.u%..uV^Z..0).....e.R`K..MnJ..bP.......c/..P..P/.CY...A.t...J......,...v.}9. ..C.....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= HTTP/1.1
Cache-Control: max-age = 510963
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:45:35 GMT
If-None-Match: "57ff116f-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=505362
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cbc70-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 16:50:56 GMT
Server: ECS (vie/F2AD)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......E.......1-Q...!..m....20161103210000Z0s0q0I0... ............@..D3=?..Mn8...Q..E.......1-Q...!..m........_..fuSC.o.P.....20161103210000Z....20161110210000Z0...*.H.............,...U..~a.@..%n.....d...U..).t..d(.W.".!.....uN...&.-w...X.......... .B...........g....'..j....t ....@..J1./...a..SR. .F.._k,.:u-E.......m...?H..D....,......~.H...*.y.$cR...;.......9N.^.j.e...W'......s...-%...AZ..8..jn.".&V.5..N<..2.......S...Kp........7......
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1
Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=505028
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cbbcf-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 16:48:15 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...20161103210000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ........\..m. B.]......20161103210000Z....20161110210000Z0...*.H...............a......^gY..!.L......"....UE.M..`i~...o.......!....5sI.......C.L...nM..:..."...u..h.|..........]..~f.r.7.J.@.....iF......I^.Loo......ZB...rY..u........V...._=cO).u.%.....,53......J.........e......8...8..Z.g.p..6..A6S5...;....w$G.l.b....4{.O...W....Le........
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1
Cache-Control: max-age = 512045
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 05:41:33 GMT
If-None-Match: "57ff1e8d-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=511624
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cc8b3-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 17:43:15 GMT
Server: ECS (vie/F38D)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U...........z....@7....20161103210000Z....20161110210000Z0...*.H..................}..]...u..*.....Y)o..'.h..b.....J=0R..[....).....<(_.w....7FE..Hi.d.K....Zt...X...un....v.....B .......m...,.D:..(....J73.2.Wi..*.).m%v~h..{T.V..P?..n1YQ...H.,c.......%<......q1.%.. ..v])>./.....s......._.L.iP...g....n........:12.f.]M.ke.F..S.....<XoQ....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o= HTTP/1.1
Cache-Control: max-age = 513888
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 05:42:27 GMT
If-None-Match: "57ff1ec3-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=508884
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cc8f8-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 17:44:24 GMT
Server: ECS (vie/F3B0)
X-Cache: HIT
Content-Length: 471
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss= HTTP/1.1
Cache-Control: max-age = 516225
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 06:53:02 GMT
If-None-Match: "57ff2f4e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=517072
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cdb1e-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 19:01:50 GMT
Server: ECS (vie/F3B1)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....20161104181200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z.........A0#o(....}......20161104181200Z....20161111172700Z0...*.H.............5....)...E.$...5<..........g#...,y0.H.h;...o......b.7L.......V............d.(.\..#...t....N~Y.....%2*..4\.....!.8.3.@go..4X@..l.q< .....8...I...t.d.Wd./.S..3..m.......u...........?.....:...) ...!Q.. .....9j.F..T......(>..I......M@.........<Q.O...v....>.M..nt>....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= HTTP/1.1
Cache-Control: max-age = 517590
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 06:25:50 GMT
If-None-Match: "57ff28ee-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=511615
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cd30d-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 18:27:25 GMT
Server: ECS (vie/F3C2)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...20161103210000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&....cd ....y.D.... .a_.k......20161103210000Z....20161110210000Z0...*.H...............].........A....V.lCI..ga,W....\D.R:cP.....\6..}.......\..w...,E.8..l.....QM..xW.6.....dP...t.u..l....Z...../.J[.P'|..............]..`..@w..*.._x.<....M`..gi.s;]...?.bj....rA...h...[2....7..PE.....?.. ...1.......y..].).j&D@.^...v.a/...n.2...G...&..3....<2....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE= HTTP/1.1
Cache-Control: max-age = 518191
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 06:43:19 GMT
If-None-Match: "57ff2d07-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=512053
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 22:34:50 GMT
Etag: "581cd6bf-1d7"
Expires: Fri, 11 Nov 2016 10:34:50 GMT
Last-Modified: Fri, 04 Nov 2016 18:43:11 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U......n.u..C.rK.......20161103210000Z....20161110210000Z0...*.H..................H2V...1L#..0:.#$....$.om..t...tp>LV(^.b...p9..Pg...H.a...~h.rN.-..cq1D........?B.qD..#!..D...u.7...!KKo....L.u]>f.@.O......C..}. ]..=1.t..i...? ik.Q...#;p..u).....-......%#...?.HQ.........!...Rkr.|...5.$=.... T.X....,f..F.2.5.z..|Y..N/...b'7.0..]...?.HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=512053..Content-Type: application/ocsp-response..Date: Fri, 04 Nov 2016 22:34:50 GMT..Etag: "581cd6bf-1d7"..Expires: Fri, 11 Nov 2016 10:34:50 GMT..Last-Modified: Fri, 04 Nov 2016 18:43:11 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT..Content-Length: 471..0..........0..... .....0......0...0........P5V.L.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U......n.u..C.rK.......20161103210000Z....20161110210000Z0...*.H..................H2V...1L#..0:.#$....$.om..t...tp>LV(^.b...p9..Pg...H.a...~h.rN.-..cq1D........?B.qD..#!..D...u.7...!KKo....L.u]>f.@.O......C..}. ]..=1.t..i...? ik.Q...#;p..u).....-......%#...?.HQ.........!...Rkr.|...5.$=.... T.X....,f..F.2.5.z..|Y..N/...b'7.0..]...?...
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:30 GMT
X-Varnish: 206488259 206487530
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 5
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= HTTP/1.1
Cache-Control: max-age = 432038
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 10:05:24 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: s2.symcb.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1761
content-transfer-encoding: binary
Cache-Control: max-age=377941, public, no-transform, must-revalidate
Last-Modified: Wed, 2 Nov 2016 07:30:43 GMT
Expires: Wed, 9 Nov 2016 07:30:43 GMT
Date: Fri, 04 Nov 2016 22:34:49 GMT
Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161102073043Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..=x..vI`.a}.....*....20161102073043Z....20161109073043Z0...*.H................X.~.......cNyt.......E.^...</........ .C.7.r. .. ..:.I.?6.9.<.2..g|....M.....p.G...gX. ;yb.V....{.......fX.n8..cR.`m.x*..I.[........>.3l...uP....3.H...$.~.4....Q.O...`........Oi~..SsE4"...G.,..l...j..]R..D.?/X.. i....]T...tg..z......).wL...{..6.....pu>.....0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= HTTP/1.1
Cache-Control: max-age = 487662
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 01:30:20 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: s2.symcb.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1761
content-transfer-encoding: binary
Cache-Control: max-age=384805, public, no-transform, must-revalidate
Last-Modified: Wed, 2 Nov 2016 09:26:17 GMT
Expires: Wed, 9 Nov 2016 09:26:17 GMT
Date: Fri, 04 Nov 2016 22:34:49 GMT
Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161102092617Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..~.Joo....?.eM:......20161102092617Z....20161109092617Z0...*.H.............Lw....UP...-T=....<.H...j.5....../.wx./m..|.'..W(...=Ujz...yWn{k.....J.F.5W0. .RVr..3{.........(JO...xk.Wh....vI..C..1r......8..J2.$...&.......,...X.i...0..l.....?..m..' .=n...K.6.6...~b..D..{s5....P.......H"V..9T.G.T .. ....to....^..'.....$...MS\^..7.z.......0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:14 GMT
X-Varnish: 206487045 206485799
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 3
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86400
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT
If-None-Match: "8017f9a85f10d21:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.download.windowsupdate.com
HTTP/1.1 304 Not Modified
Content-Type: application/vnd.ms-cab-compressed
Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT
ETag: "8017f9a85f10d21:0"
Cache-Control: max-age=604800
Date: Fri, 04 Nov 2016 22:34:50 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
HTTP/1.1 304 Not Modified..Content-Type: application/vnd.ms-cab-compressed..Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT..ETag: "8017f9a85f10d21:0"..Cache-Control: max-age=604800..Date: Fri, 04 Nov 2016 22:34:50 GMT..Connection: keep-alive..X-CCC: RU..X-CID: 2..
GET /gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw== HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 06:16:22 GMT
If-None-Match: "4a49c69908e933f536cd8546fd48854f6c2b3f7b"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:48 GMT
Content-Type: application/ocsp-response
Content-Length: 1570
Connection: keep-alive
Set-Cookie: __cfduid=dd54cb12f4cf270e57e9576c0a18640351478298888; expires=Sat, 04-Nov-17 22:34:48 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 04 Nov 2016 19:32:48 GMT
Expires: Tue, 08 Nov 2016 19:32:48 GMT
ETag: "45aeec04cf5f75fd5535651bd4cd9a873159ef92"
Cache-Control: public, max-age=334680
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2fcb891212d1401a-SOF
0..........0..... .....0......0...0.......M........u....%...G..20161104193248Z0o0m0E0... ..........M.=......r......{.....a....)S...};..@..|..........q."W....20161104193248Z....20161108193248Z0...*.H..............".....d.6..2V/.B.{........*"8_l..!..Yt...t}.7.....1............TS!v._.......<c.../...m..5SU.6.B.Y..\.p..&....H...`.O-A..*[-.........VT}.....@C......y...i....O.Q.E...7...<D2..j..M@.9 ..R...1./..~......v|.1....AE..4.} .]#...:..........sz5.W..z...;.....~rb0....K0..G0..C0.. .......*'....?...F$0...*.H........0f1.0...U....BE1.0...U....GlobalSign nv-sa1<0:..U...3GlobalSign Organization Validation CA - SHA256 - G20...161019091216Z..170119091216Z0..1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....2016072511411M0K..U...DGlobalSign Organization Validation CA - SHA256 - G2 - OCSP Responder0.."0...*.H.............0.........C..0j..R........0.".e.&.6'.d..._.....8...Y..../..z..-hi.k.......D.........u..>h....T2..~..*;...v.^.!d.......8.p.e..me...>..V...l...P.6.V..G..;X.......12U.)D.E(ldQ...67..@......l...A.>l......m..e;.....n.~..Wb.?..gE.......a.KM.F...}.qo;S...`/..s....6....G.a........0..0...U.......M........u....%...G0...U.#..0.....a....)S...};..@..|0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...U...........0...U.%..0... .......0...*.H.................v.bV.......)...c..}.....y=...........L.G%...N.<...8Qi..Y...........\.fd-.<V=.;0".4..h:v*j..N<M..*...i.Hz{?..[....ML..I.Y....r.x.n.dS...J......d.JXT..:..P..B..~.KD....b..&..........."..oELo..I
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:14 GMT
X-Varnish: 206487057
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: MISS
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /crls/secureca.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT
If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.geotrust.com
HTTP/1.1 200 OK
Server: Apache
ETag: "bb4969ca5216e65f52a965c1ad15f69b:1478298631"
Last-Modified: Fri, 04 Nov 2016 22:30:31 GMT
Date: Fri, 04 Nov 2016 22:34:51 GMT
Content-Length: 325
Connection: keep-alive
Content-Type: application/pkix-crl
0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161104222300Z..161114222300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............Z.Ry.&R...$.?. rLL*&,.......w2....4......W......:K..=iY..]...n.@P..M>...X.g.......j.....^...I.;b=WH.!.... ......%..0...7.E..,...HTTP/1.1 200 OK..Server: Apache..ETag: "bb4969ca5216e65f52a965c1ad15f69b:1478298631"..Last-Modified: Fri, 04 Nov 2016 22:30:31 GMT..Date: Fri, 04 Nov 2016 22:34:51 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: application/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..161104222300Z..161114222300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H............Z.Ry.&R...$.?. rLL*&,.......w2....4......W......:K..=iY..]...n.@P..M>...X.g.......j.....^...I.;b=WH.!.... ......%..0...7.E..,.....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI= HTTP/1.1
Cache-Control: max-age = 356574
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 10 Oct 2016 12:54:45 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.thawte.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1612
content-transfer-encoding: binary
Cache-Control: max-age=479257, public, no-transform, must-revalidate
Last-Modified: Thu, 3 Nov 2016 11:42:05 GMT
Expires: Thu, 10 Nov 2016 11:42:05 GMT
Date: Fri, 04 Nov 2016 22:34:48 GMT
Connection: keep-alive
0..H......A0..=.. .....0......0..*0......jwG.8s...r:ts.0.:.I...20161103114205Z0s0q0I0... .........H/..O.4..{.......:Q...l..`.....>.t c...Y...64....&i.V.l..q2....20161103114205Z....20161110114205Z0...*.H..............n..s.G...G.f..[H&Y ......h.......k..WF.......WB..*.k....P...O.iO...V1p-.oQ...S\..l;8..o,.pg.g}..Eh.:. *.kN$..C...G.1g.._.........i..Oy~...d.2..V(...`......I@.......=..P'.}.w.6....5...cJ..."......!.]...k..u.q......Ry..E.....J..}z......n%`.??B/.\.'V...^(x.$...q0..m0..i0..Q.......h`(V......*....R0...*.H........0..1.0...U....US1.0...U....thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2008 thawte, Inc. - For authorized use only1$0"..U....thawte Primary Root CA - G30...151124000000Z..161214235959Z0..1.0...U....US1.0...U....thawte, Inc.1(0&..U....Certification Services Division1503..U...,thawte Primary Root CA - G3 OCSP Responder 40.."0...*.H.............0....................Zs.8..W.D..c...H.....p.4I.........n..E...T.3...):w].s\`..t2........G.Gj|w).~i18J`....D....'t..e&q.Ga]>tw...0s.|I.R..!o.-.....G.. F-.s.......O..7_p9.:.............^..i..}.K..S3.1.9Z..N|w...u...Ay.*|%....y.nU..U.q.y.y. ....\.w.j........Cu{.!k............0..0...U.%..0... .......0... .....0......0...U.......0.0...U...........0 ..U....0...0.1.0...U....TGV-C-650...U......jwG.8s...r:ts.0.:.I.0...U.#..0....l..`.....>.t c...Y.0...*.H...............A...../W.....x.V.Km.H7Q.[..(..i..Y.........Ì....eI..j...|..O...k....X>r/{..\h.<..N.G...........Y.8..@i`..>..W...?..{...^G.)0S.>;..;4a#..)(.O{..t.h.8...z.'.
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU= HTTP/1.1
Cache-Control: max-age = 360742
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 10 Oct 2016 14:02:11 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: tg.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1451
content-transfer-encoding: binary
Cache-Control: max-age=516299, public, no-transform, must-revalidate
Last-Modified: Thu, 3 Nov 2016 21:57:32 GMT
Expires: Thu, 10 Nov 2016 21:57:32 GMT
Date: Fri, 04 Nov 2016 22:34:48 GMT
Connection: keep-alive
0..........0..... .....0......0...0......|.....Q.......Uh..z...20161103215732Z0s0q0I0... ........U..2....i.*Y......[K.. .5...80.pz...v.........8U.h.....v^yPu....20161103215732Z....20161110215732Z0...*.H.................Hr..9DL.&o....$c'i k4......T-.q.J...:"@.\.;{Fs...l...>.....X(.J..M.7...*...).\.S...#vzE...].....:......2...VD..;.T......y..(.Ax......"\.a\..@"...."....o 'R..6.......h..Y.WbfB.U1'...c.....}.P-...eLL.....o.:.D..%.d....wi`m&.h.... .....hqr.... 3:3$.sz.'......0...0...0..........e......L.B......0...*.H........0C1.0...U....US1.0...U....thawte, Inc.1.0...U....thawte SHA256 SSL CA0...160829000000Z..161127235959Z0O1.0...U....US1.0...U....thawte, Inc.1)0'..U... thawte SHA256 SSL OCSP Responder0.."0...*.H.............0................#.....]......F#...Q...b:k.._n.X..!a.;<..a.......c....|.OsP..f..p.2r"2c&...8.:>vq.........2P..U....r..2.."N.!.gN....8.Y......D2.zF......Ln...Z..J..)..B{.1.p#|...e...$.A{...n.B.....o......L1...g...].......$cpYK.vC.D=.N..F2..j...=.....Yi.......u..r...........0..0... .....0......0"..U....0...0.1.0...U....TGV-D-17700...U.#..0... .5...80.pz...v.....0...U......|.....Q.......Uh..z.0...U.......0.0...U.%..0... .......0...U...........0...*.H.............C..7...X}.(.w9 9..*9.0x^Q.h....o. ..J...B.dc.6.%a_^?Z...8V.....O.aMh..I...1u.......v.VE7..h....t.o.m.=......U.@.V..'......v....4.......!.xV.es.....\......eM...C.|....$..I...-.. ...n.c*......Tz..6T..gU..XQ.^....P.LB..H....y.o}.i...I.......5...j!.g.D's........
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:08 GMT
X-Varnish: 206486611 206485799
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: subca.ocsp-certum.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1651
Connection: keep-alive
Content-transfer-encoding: binary
X-Cached: MISS
Server: NetDNA-cache/2.2
X-Cache: HIT
0..o......h0..d.. .....0.....U0..Q0..-........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service..20161104222830Z0r0p0H0... ......y...bOm..(y.Y6B...}n...C..m.....i..J.`.:........@.eq_..(....(....20161104222830Z....20161111222830Z..0.0... .....0....0... .....0..0...*.H...........=.$...../.\J.!..b3` q..Dd.}M.u.p.s..b.......[g...=V....@...Y_0...?D.<..pB....Dz..bQ.j...........`O.Q...g.$...........*..9...$...R.e#/v....'...(..e......1 .)P{.;Fe...G...>.n.(..7... .{.n.".*hOF.-....I....h}...b.7NF..c.h..<P.\...N.h.&. ......62.....B.....n......0...0...0............Y\T..f..Y....HV0...*.H........0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA0...160107125922Z..170206125922Z0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service0.."0...*.H.............0..........3..>......]{7..\...$vl.....V......T...-.:.....y..'...X..}.fA\...._.Uxl6.ti %.SS..#. Z.5.G"..S.....)Q...!..P....~0..32...Bmd...%.2...D.....J.........6....O.u..vm.l..V.'.L.4.._....\.eK...MI.F.;H.;..%...KZ...H;e ..9.2..A.b......F.T..._........DY2...2Z#L.D0)........0..0...U.......0.0...U.......L.oh.....2......|.=0R..U.#.K0I.B.@0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA.... 0...U...........0...U.%..0... .......0... .....0......0...*.H.............0.r._(...,.QowB....:......p.....ju.:..-."...e.......Y.b....<.[..m...qO.A.}....n^..w...=.f...]..mR....j..5...C.(....:a.f.
<<< skipped >>>
GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: subca.ocsp-certum.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1663
Connection: keep-alive
Content-transfer-encoding: binary
X-Cached: HIT
Server: NetDNA-cache/2.2
X-Cache: HIT
0..{......t0..p.. .....0.....a0..]0..-........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service..20161104223038Z0r0p0H0... .......:L..!..O'...Q.)..&....v....$.........7Fu......G...dR.oz5I..H....20161104223038Z....20161111223038Z..0.0... .....0....0... .....0..0...*.H.............b...$:..........5. ...F.bm08..Y x.).h..|W.....g.y(.....}....w......ha.Oi..I...[c?:>c.....q....m5:.[.UIHZ.#....oO$..W.....x,.OtF\..n<..../.U.(....3.S..Kc;%L.&....)..6..os.....b...^. ....#3\..=e..[.(123...f.~......T....i.0(5...6.L?K&....l.....|jEW.?.W.........0...0...0..........x....4P^..o.@oz.0...*.H........0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Trusted Network CA0...160107130439Z..170206130439Z0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U....Certum Validation Service0.."0...*.H.............0..........AB...I....z..#U......oD.L.....UX....j.....S.K......".>w.;.r8....C...Zc...U.}%.....@Ff..`.&.j.`.......ci.Io........pW...........#.s............tR@...N.......L....U..t.>su...OyH.E...v...r.]."m..7.... ....@.....>.X......M.P@......./.......k...O....@v7.d............0..0...U.......0.0...U..........Lw..l..n..n...~.0...U.#..0....v....$.........7Fu.0...U...........0...U.%..0... .......0... .....0......0...*.H.................Rg.....O~y.G G...XJ..S.e.Z0y.h..Np8.=&.P.?....R...t..>.2........P.......l}..;=c....@C..9..[..^.?:.yFSu.r.D.
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0= HTTP/1.1
Cache-Control: max-age = 588368
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 05:31:11 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: sv.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1611
content-transfer-encoding: binary
Cache-Control: max-age=541165, public, no-transform, must-revalidate
Last-Modified: Fri, 4 Nov 2016 04:50:17 GMT
Expires: Fri, 11 Nov 2016 04:50:17 GMT
Date: Fri, 04 Nov 2016 22:34:50 GMT
Connection: keep-alive
0..G......@0..<.. .....0.....-0..)0......H.S.......J.?x.7T..a..20161104045017Z0s0q0I0... ...........C%.......`M.....B...;S.y3..}... .....rf..*.!...:<X..2 .......20161104045017Z....20161111045017Z0...*.H..............P..71O.].~..?l.(s'yVNS]....A-..q..fq.N..7..."..g..9e.Sn7...J{..U.s.......P.U S....I.x.o.m.&.P.a.;..&.Z...~@?.9N.l.{4.{k.4.a..Y..p.. yw...v......!.G#...'.Fq!.(......!....P...2..U.......\....5...T.N.b'<Y.#M..'V.?...`.....V.1.2...y......>L...i|.....9`y.to1d....p0..l0..h0..P.......jVl_wg...'.i....0...*.H........0.1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U...'Symantec Class 3 SHA256 Code Signing CA0...161002000000Z..161231235959Z0A1?0=..U...6Symantec Class 3 SHA256 Code Signing CA OCSP Responder0.."0...*.H.............0............y.....l..f.......m./].j..mysU[d......:..!...9......-._k..V.%.B'...'..e.S.....>....3..3..?../.hO#.c.L.......T...<,..-....Bt...U..G.A%|..E..y=jf....%.Y*..x.b..F...'~.,.g6......?..@e.v.|!...R..8....:.N..,;zG.WN..{\c.Q.V!..l.....!h..d...T..Ik....Nu.S.WK"...........0...0... .....0......0"..U....0...0.1.0...U....TGV-D-22120...U.#..0....;S.y3..}... .....rf0...U......H.S.......J.?x.7T..a0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://VVV.symauth.com/cps0*.. .......0... hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0...*.H................a..).B.>@.`...-.1..0..LJ.(S...s...U.'.;...N..Kp[..... B...&...K.|K..xd.....db....."\2..J......l.....U.I..t C.8B...B.... .....v.!#.1.v7$..j......6>.....j.7
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys= HTTP/1.1
Cache-Control: max-age = 444549
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 13:33:22 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: sf.symcd.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1725
content-transfer-encoding: binary
Cache-Control: max-age=386656, public, no-transform, must-revalidate
Last-Modified: Wed, 2 Nov 2016 09:55:44 GMT
Expires: Wed, 9 Nov 2016 09:55:44 GMT
Date: Fri, 04 Nov 2016 22:34:49 GMT
Connection: keep-alive
0..........0..... .....0......0...0.......].[ .A.|1.rC_H.5F....20161102095544Z0s0q0I0... ...................F....0.yV......{&.K......&.......L@......zW.Et.......20161102095544Z....20161109095544Z0...*.H................L;.;..*-...6......T...P.4..%?.aS@"kD...=7..<.|t.|.H..d.'..8p......,.....y.j.._.0..G$......d.....\.iP.(.3^.......a.K..k/.....vE.m.>..AW......r.....b...0...P.....)..M.Cp....G.....XG.Q....}o......km7...B..9.....{....L.v.{p.9....V.}.]w.1C.n-...:..".I{....^ ....0...0...0...........3..-......F....0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code Signing 2010 CA0...160928000000Z..161227235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0..........0CTS.....D7.=.s/..|..P...mS.....,.,).?C..r8.H...]....R.&....#..}.[G8C.|P.Z...[........Y.m..5...#.{yp^d;..^.=c~}P5.....=0...U..."!j.1.(.Q...n....O3.-:.R.;..A...............}.......JN..1E....I..!.y.:u.Jw..S......8.s..P..d........ ..t.u......X.cM...N:."a ...........0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-D-21700...*.H.............h.S...i..v...l.p,'JO....*.mGF`...(..MU|.vn.....*.^.2..._.$..j
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:08 GMT
X-Varnish: 206486617 206485799
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 2
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /CRL/Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT
If-None-Match: "200da-5b6-4eb453c33260e"
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Date: Fri, 04 Nov 2016 22:34:45 GMT
Etag: "200c0-b1c-53fb55344ca83"
Last-Modified: Tue, 25 Oct 2016 19:15:02 GMT
Server: ECS (arn/45CB)
X-Cache: HIT
Content-Length: 2844
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0 ..U....Baltimore CyberTrust Root..161025180751Z..170120180751Z0.._0....'k...120111220757Z0....'k...120111220847Z0....'.C..130130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..100414175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...130123162633Z0....'....130904190524Z0....'....131024214319Z0....'....140129172435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...150603184605Z0....'k...150603185020Z0....'k...150603185058Z0....'k...150603185131Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:19 GMT
X-Varnish: 206487530
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: MISS
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1
Cache-Control: max-age = 547348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 21:12:41 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=512823, public, no-transform, must-revalidate
Last-Modified: Thu, 3 Nov 2016 20:57:28 GMT
Expires: Thu, 10 Nov 2016 20:57:28 GMT
Date: Fri, 04 Nov 2016 22:34:45 GMT
Connection: keep-alive
0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...20161103205728Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5..........^.3@..cL.1.......20161103205728Z....20161110205728Z0...*.H..............?....eGB.!...w.}d..5y..!3P..j...1oL..v.......8&...8.i.].4..Z.?..<............Kh.....4.LT%.%Jh ..../.....u.s4QP54.}.5.].b.5.}w..%...<...9y..Lp*].........n1..Nz<..Hc..P....................P.L.$.}......,.....a$..._C..7k.s.p...VS^P.?@...^......l......Q.9RZ..z...#0...0...0..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0..........&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m......@U...T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. ....J].M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd..*o..&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.............0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........https://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TG
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= HTTP/1.1
Cache-Control: max-age = 363986
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sun, 17 Nov 2013 16:06:48 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1452
content-transfer-encoding: binary
Cache-Control: max-age=404268, public, no-transform, must-revalidate
Last-Modified: Wed, 2 Nov 2016 14:50:27 GMT
Expires: Wed, 9 Nov 2016 14:50:27 GMT
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0..........0..... .....0......0...0.........Yt...........z.(...20161102145027Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..%...0a.. ...M|......20161102145027Z....20161109145027Z0...*.H.............$...4.x..a .*$=v<.g..t.......]..9.U:"......!o.a....vK.D....%.....%...9..._'.....Y........_<m..H..;......2 .b..1....#;.&aX...V..x....l-....*..ed.z...*P3.E..t......[. ..y..x...U.....'l&.;..$....4..I.M....ULHX...J..=...0.x.$W38e...I..;7/ .^..-....:......u.B......0...0...0..2.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 40.."0...*.H.............0..........K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.by.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?......g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H............o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd........#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`8......
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY= HTTP/1.1
Cache-Control: max-age = 512217
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 09:17:20 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 5
content-transfer-encoding: binary
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0....HTTP/1.1 200 OK..Server: nginx/1.4.7..Content-Type: application/ocsp-response..Content-Length: 5..content-transfer-encoding: binary..Date: Fri, 04 Nov 2016 22:34:46 GMT..Connection: keep-alive..0....>....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1
Cache-Control: max-age = 440358
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1452
content-transfer-encoding: binary
Cache-Control: max-age=557368, public, no-transform, must-revalidate
Last-Modified: Fri, 4 Nov 2016 09:20:23 GMT
Expires: Fri, 11 Nov 2016 09:20:23 GMT
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0..........0..... .....0......0...0.........Yt...........z.(...20161104092023Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a..eR&.....Y.)..".\....20161104092023Z....20161111092023Z0...*.H................>@..W..=vlg..........Vy...m......wZ !Zl..../.z&..z.:.1......k.....c).....%..0...8....!li.~..w\.y..W...)F.....J......|...@..w1..C.IX........h...m[....v....o.i~.GE.'A:.......... ..... l.....cv.... .........O.l.E..S.dx9....bxV.,.M.#m......AF.......o.6..~......0...0...0..2.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authority0...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G1 OCSP Responder Certificate 40.."0...*.H.............0..........K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.by.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?......g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U....0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H............o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd........#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`8......
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE= HTTP/1.1
Cache-Control: max-age = 589790
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 20 Nov 2013 09:32:32 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 5
content-transfer-encoding: binary
Date: Fri, 04 Nov 2016 22:34:47 GMT
Connection: keep-alive
0....HTTP/1.1 200 OK..Server: nginx/1.4.7..Content-Type: application/ocsp-response..Content-Length: 5..content-transfer-encoding: binary..Date: Fri, 04 Nov 2016 22:34:47 GMT..Connection: keep-alive..0....>....
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1
Cache-Control: max-age = 435806
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 11:05:46 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=401349, public, no-transform, must-revalidate
Last-Modified: Wed, 2 Nov 2016 14:00:49 GMT
Expires: Wed, 9 Nov 2016 14:00:49 GMT
Date: Fri, 04 Nov 2016 22:34:49 GMT
Connection: keep-alive
0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...20161102140049Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5........M.s.Q~...@?j.......20161102140049Z....20161109140049Z0...*.H...............D..#i.F.Z....faQ.#...SP...n.~.....b.. ...J2e4...U.yC......E...g`6...7........W.....i.G.v...H.8.(.......T .).A\..Kd.q....].OK...zrrz.Y...4......dmV....,..G....cW....r......._...X3..!..`......*...S,.cC...1..;..._yN?Y....F2n=0...G..z..J)"{"~..%^!...5IJ.L......#0...0...0..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Signing 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0..........&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m......@U...T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. ....J].M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd..*o..&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.............0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://www.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U....TGV-D-21870
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1
Cache-Control: max-age = 584393
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:26:54 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1761
content-transfer-encoding: binary
Cache-Control: max-age=486074, public, no-transform, must-revalidate
Last-Modified: Thu, 3 Nov 2016 13:32:39 GMT
Expires: Thu, 10 Nov 2016 13:32:39 GMT
Date: Fri, 04 Nov 2016 22:34:51 GMT
Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161103133239Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313..R...%V.......K3.....20161103133239Z....20161110133239Z0...*.H................o.2.s.j).H.'8..`.?..b...,\...Qj..... . .f...@...:@f....LPq...=D.....W....././U.3b..!.... ......v..9/.2>......8y.Z0fB..(...)*oz......v.b. ...K...)_..........}#......f..d.P... ...U.e./...N%q.1.=....A_.../.~..~..36S\}.......n...,.VMp.4.xaC.c....W.O=~.W........0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>
GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ HTTP/1.1
Cache-Control: max-age = 339923
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 09:41:21 GMT
If-None-Match: "c06e9a4e33eec9dd813b8faff15397229f914d2a"
User-Agent: Microsoft-CryptoAPI/6.1
Host: vassg142.ocsp.omniroot.com
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 1746
Last-Modified: Fri, 04 Nov 2016 22:16:08 GMT
ETag: "5fc52ba3045cb8822c18fe74c1700365587a44c6"
Cache-Control: public, no-transform, must-revalidate, max-age=339695
Expires: Tue, 08 Nov 2016 20:56:23 GMT
Date: Fri, 04 Nov 2016 22:34:48 GMT
Connection: keep-alive
0..........0..... .....0......0...0......\r...Ev.C..*....omJ...20161104221608Z0w0u0M0... .........-R...P:.B...9...0Q.......sw....KM...3..r...C...X.<1ya..w.2..^.?....20161104221608Z....20161108221608Z0...*.H.............}bkI.yrT......u....s..[.......V.gc6..Q2.CZ.....2......5...{.r..p....~}...s..-.V=..dK...rg.o"SS...8]...4.....i....{?U[.X.=)ry..U..&o..4..7...$.u.{....4.#.........X..v..G.j..f.=..._........@.....~.. ...`h3;/.V.Z*.'........?.....b....L.TA....../....Oe0...dX.A....0...0...0...........1....n.SsnC.K.]I.w90...*.H........0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA20...160407064154Z..170407064154Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertrust1%0#..U....vassg142-OCSP Responder 20160.."0...*.H.............0.........w.;..Eu..'f.c^....Qe.O...U.....d.\?.....S.r'g.d..ES.NA.t....<.....#?.."...*Pm.<..s........v...<....8......A@.....7h...r$.T..8=......\....>......z=t3?(.....i.>t.^.....]7.9..j.E. ....{.$w..Y,...hf..6......L._9,.....i...S...)/.."^.K.O...bb^....V....'p...'V..........H0..D0... .....0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure.omniroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.der0...U...........0...U.%..0... .......0...U.#..0.......sw....KM...3..r.0...U......\r...Ev.C..*....omJ.0...*.H.............l/0j.Z.z.......n-..2.?.e.
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg= HTTP/1.1
Cache-Control: max-age = 471678
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 28 Nov 2013 01:44:29 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: evsecure-ocsp.verisign.com
HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1761
content-transfer-encoding: binary
Cache-Control: max-age=493882, public, no-transform, must-revalidate
Last-Modified: Thu, 3 Nov 2016 15:42:58 GMT
Expires: Thu, 10 Nov 2016 15:42:58 GMT
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...20161103154258Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...313...*.m7..o..|.........20161103154258Z....20161110154258Z0...*.H................b.B..... .7..n...].......q...X.[...Nb............".9..z.M.Cv#I....cbZ.,BW...$G....&{...9q...h[[....#...`.. ...VC.E.>.j=......s..]....aJ..l......).2.....s......Z.x.W..2.F...OY..,.\.T...8......1.........f.k.N.R.=......t..j...H..V.}.....or.]..*.....cm.........0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Public Primary Certification Authority - G50...151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: yandex.ocsp-responder.com
HTTP/1.1 200 OK
Server: nginx/1.8.1
Date: Fri, 04 Nov 2016 22:34:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1548
Connection: keep-alive
Keep-Alive: timeout=5
Content-transfer-encoding: binary
X-Cached: MISS
X-Cache: HIT
0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..20161104213325Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M..."[.w..2............20161104213325Z....20161111213325Z..0.0... .....0....0... .....0..0...*.H.................... 7..m...w{......'`.%.%.....$...H.y.qTsGy..6....q%].=Q ....8;..~..ir..m)..yO..y...D#..yS......y...*..m.....}L5......T.5O5.........lR..d)..1.GV?....I. R.{,.p..t....)P....H.,.!*..\N.eB/.....;.S]Kx.....y....4.p.0....m/...._4$4.k0E.=..G...J;x.w(<.X........0...0...0..........F.......4..or"<i0...*.H........0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Authority1.0...U....Yandex CA0...161027084144Z..170125084144Z0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service0.."0...*.H.............0..........&@.L)=DbS.4...v.....v..U...1Vf.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H...B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..ji...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\.......N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0... .......0... .....0......0...*.H................ ....k....@.........xZ.v..a.0.h.$........K.....V.1'v.........H..A.V)*Pe..Q...:\FeJ.s%...........~:t......;..!...r.~...kxd...;.f>.I..5.....?.....L.uWQg........Ja.wt.U.'*$.J.!1....;`..XN....A...]...>.jO...?.eg...........
<<< skipped >>>
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: yandex.ocsp-responder.com
HTTP/1.1 200 OK
Server: nginx/1.8.1
Date: Fri, 04 Nov 2016 22:34:51 GMT
Content-Type: application/ocsp-response
Content-Length: 1548
Connection: keep-alive
Keep-Alive: timeout=5
Content-transfer-encoding: binary
X-Cached: MISS
X-Cache: HIT
0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..20161104215138Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M...P..m....,.(t.?.....20161104215138Z....20161111215138Z..0.0... .....0....0... .....0..0...*.H...........4YBR...%.......F7......aGU...]....g.2x`D.G[1=.x.rU.!.4W....,.zZ......].0.?....45. c.q...1..H.....a.CEC..I{......D]y.C..Po.w.V6.$*.".WW....re..KG. Q.......(F>..~$F.@..c.y.....]p.}..........A(2.r..._..]d...X....C4.........}.g.,.yn. .Sn.6.zg..H......_.).T-.......0...0...0..........F.......4..or"<i0...*.H........0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Authority1.0...U....Yandex CA0...161027084144Z..170125084144Z0U1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service0.."0...*.H.............0..........&@.L)=DbS.4...v.....v..U...1Vf.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H...B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..ji...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\.......N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0... .......0... .....0......0...*.H................ ....k....@.........xZ.v..a.0.h.$........K.....V.1'v.........H..A.V)*Pe..Q...:\FeJ.s%...........~:t......;..!...r.~...kxd...;.f>.I..5.....?.....L.uWQg........Ja.wt.U.'*$.J.!1....;`..XN....A...]...>.jO...?.eg...........
<<< skipped >>>
GET /AddTrustExternalCARoot.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.comodoca.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:45 GMT
Content-Type: application/x-pkcs7-crl
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d75bbd26e58b4db91ab3b562b2f8660c91478298885; expires=Sat, 04-Nov-17 22:34:45 GMT; path=/; domain=.comodoca.com; HttpOnly
Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT
ETag: W/"581bdf7e-227"
X-CCACDN-Mirror-ID: rmdccacrl7
Cache-Control: public, max-age=14400
CF-Cache-Status: HIT
Expires: Sat, 05 Nov 2016 02:34:45 GMT
Server: cloudflare-nginx
CF-RAY: 2fcb8905462e401a-SOF
25a..0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..161104010814Z..161108010814Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H..............E3.l.3G...@O..G...G...}..X.X*Q.Xy./,Y...iR.q....3*U.kel.."..]..0|.( ..nd...0u.f.iu.n....i.......nJ....n.......2..]A....j.av .......(`.u.....)>.4S......;......I..._.\........&Vw..........d..^...(?gT~...Ti0...a..1-".pf.X....Bgi.?....M...WT.P.....v.8e\\.@h.O..0..HTTP/1.1 200 OK..Date: Fri, 04 Nov 2016 22:34:45 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=d75bbd26e58b4db91ab3b562b2f8660c91478298885; expires=Sat, 04-Nov-17 22:34:45 GMT; path=/; domain=.comodoca.com; HttpOnly..Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT..ETag: W/"581bdf7e-227"..X-CCACDN-Mirror-ID: rmdccacrl7..Cache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: Sat, 05 Nov 2016 02:34:45 GMT..Server: cloudflare-nginx..CF-RAY: 2fcb8905462e401a-SOF..25a..0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..161104010814Z..161108010814Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H..............E3.l.3G...@O..G..
<<< skipped >>>
GET /UTN-DATACorpSGC.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.comodoca.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:46 GMT
Content-Type: application/x-pkcs7-crl
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dab2b16133ff7d811973ec1520f4f1a221478298886; expires=Sat, 04-Nov-17 22:34:46 GMT; path=/; domain=.comodoca.com; HttpOnly
Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT
ETag: W/"581bdf7e-22d"
X-CCACDN-Mirror-ID: rmdccacrl8
Cache-Control: public, max-age=14400
CF-Cache-Status: HIT
Expires: Sat, 05 Nov 2016 02:34:46 GMT
Server: cloudflare-nginx
CF-RAY: 2fcb890a32fe401a-SOF
239..0..50......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertrust.com1.0...U....UTN - DATACorp SGC..161104010814Z..161108010814Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S2........].N...E..O0...U........0...*.H..............'H....6..;.;phx.....i....&........F[..c...W.....q..@U...g./.k....Q.YHa.Yr......u...c..Q..T..&.7.~;..u..v.....K..Y<-.....k.../.J.uNzS$.U..@OO..W....r)~...'..I..GU..~zA...,.z2....ry{.Z.......al..(...t....a..X.'........<c._.H<}6.w.....#... ?Y...=..G..i.L95.d..0..HTTP/1.1 200 OK..Date: Fri, 04 Nov 2016 22:34:46 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..Set-Cookie: __cfduid=dab2b16133ff7d811973ec1520f4f1a221478298886; expires=Sat, 04-Nov-17 22:34:46 GMT; path=/; domain=.comodoca.com; HttpOnly..Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT..ETag: W/"581bdf7e-22d"..X-CCACDN-Mirror-ID: rmdccacrl8..Cache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: Sat, 05 Nov 2016 02:34:46 GMT..Server: cloudflare-nginx..CF-RAY: 2fcb890a32fe401a-SOF..239..0..50......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertrust.com1.0...U....UTN - DATACorp SGC..161104010814Z..161108010814Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S2........].N...E..O0...U........0...*.H..............'H....6..;.;phx.....i....&........F[..c...W.....q..@U...g./.k....Q.YHa.Yr......u...
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 404 Not Found
Date: Fri, 04 Nov 2016 22:34:47 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Fri, 04 Nov 2016 19:03:25 GMT
Expires: Tue, 08 Nov 2016 19:03:25 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 12683
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161104070222Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...0A..%[.....20161104070222Z....20161111070222Z0...*.H.............@K.n..f.......w3D..%..Z.r*.........c...(..ds.=..)......oii...H.8.<E.........h.....2=(.oN...l..).......6/......D.......M.\.Y....nu..{........`......_J.Y...#..Bi.}.|k2....Y.H.t0N.;M..1H.7Y.W....RR. .*j.#K.#62....h..f..;...&pa.8.h,.aX.A.N`...K.m9..,..@...........
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 03 Nov 2016 03:43:33 GMT
Expires: Mon, 07 Nov 2016 03:43:33 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 154275
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190348Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..u...5:......20161102190348Z....20161109190348Z0...*.H...............3I..-b`O..\..........`.............q......O.g..%6.xo........`.7.d.../..v.~......I.!X...'._.....\.....L...@HGs..u\...n.TE.g..1..b.^9.A.);.Y`S)&..y..}..F..N\>.&..~....t.9.{....Y.............*M.?.:.....Ug*^}.a.TA..tHN_.G.oDL<#../..UUQ..6B...B.R.K........ ......
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 01 Nov 2016 13:58:35 GMT
Expires: Sat, 05 Nov 2016 13:58:35 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 290173
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070311Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...../.5......20161101070311Z....20161108070311Z0...*.H.............RL....U..WQ..<..@.6*...`-..........6.`..kXh.]w..zk. ....#!...[.L.......Da|MZ......".Y...%..v...[.......oQ../QL...vH..........J.T?..c.3.dC...tn.hL.Ps.6..4Q)d[..k.........t...~.hq.n..dc_..Z"K....t,.....9Q......R.$..s.W.l]kf.}.z......].%>...8.....(.-.b.O...9.....
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 03 Nov 2016 02:51:47 GMT
Expires: Mon, 07 Nov 2016 02:51:47 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 157381
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190122Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..fb....$.....20161102190122Z....20161109190122Z0...*.H.............|_..X].*......p&.........K}......G...K.W.\f..g,".Q0.&..(.......8........cc.`....`EV....].w..1....|......W..Z8..?R9.'.x.R..:.....h.....a...|."......$Lv..........=.(.=..BKuy#.$.,...3%..A....%....!/.#.z...I.#i@.Ni.g.........W.....gw.$}...V.= ...V....kn......B....
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 02 Nov 2016 12:38:49 GMT
Expires: Sun, 06 Nov 2016 12:38:49 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Cache-Control: public, max-age=345600
Age: 208559
0..........0..... .....0......0...0......J......h.v....b..Z./..20161102010418Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...[..D7fZ....20161102010418Z....20161109010418Z0...*.H..............y.ze.*H...........t`D...2....j. ..0...C..!..j5..r...r..V.3{.......m.j.&Z... .7.{.!MZd...~:'.)....D.7...muOZ..a.b..L..F...;.m....--..rC$..~.%..o..a.}.....c...%.......?N..v0|.D..}....#a..|;C..k.5..q.F..L..%u..'..`.y..J.._uFgzj..... .<hyEv*....6.g.@...8.Z...HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Wed, 02 Nov 2016 12:38:49 GMT..Expires: Sun, 06 Nov 2016 12:38:49 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Cache-Control: public, max-age=345600..Age: 208559..0..........0..... .....0......0...0......J......h.v....b..Z./..20161102010418Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...[..D7fZ....20161102010418Z....20161109010418Z0...*.H..............y.ze.*H...........t`D...2....j. ..0...C..!..j5..r...r..V.3{.......m.j.&Z... .7.{.!MZd...~:'.)....D.7...muOZ..a.b..L..F...;.m....--..rC$..~.%..o..a.}.....c...%.......?N..v0|.D..}....#a..|;C..k.5..q.F..L..%u..'..`.y..J.._uFgzj..... .<hyEv*....6.g.@...8.Z.......
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 03 Nov 2016 04:58:50 GMT
Expires: Mon, 07 Nov 2016 04:58:50 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 149758
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190248Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..#. o..>b....20161102190248Z....20161109190248Z0...*.H..............E;`.'{.._$}...ig\.^....].......ux2n..@.j..3..5Ix..Zy"..bc~....2.........'.........=.=\..C......./eF......K=....B...0../z.....N....^;.e...NO7!EsBzO....... *U.8.2.<?..F.L/m....6.....^...%/.....v$.*o1..KO...N.1......'.')_9a(ws;...b9_..i./...L&`k%'.p.[ ..%...HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Thu, 03 Nov 2016 04:58:50 GMT..Expires: Mon, 07 Nov 2016 04:58:50 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 149758..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190248Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..#. o..>b....20161102190248Z....20161109190248Z0...*.H..............E;`.'{.._$}...ig\.^....].......ux2n..@.j..3..5Ix..Zy"..bc~....2.........'.........=.=\..C......./eF......K=....B...0../z.....N....^;.e...NO7!EsBzO....... *U.8.2.<?..F.L/m....6.....^...%/.....v$.*o1..KO...N.1......'.')_9a(ws;...b9_..i./...L&`k%'.p.[ ..%.......
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 01 Nov 2016 14:10:59 GMT
Expires: Sat, 05 Nov 2016 14:10:59 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 289429
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070302Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..CM.{...N....20161101070302Z....20161108070302Z0...*.H.............J^..8. .GU...*....=..7O....X.\*..<...IcC...z....Ie;E.>...).....F.kp....|..2...C.?.....).....dp.....w...........}...Q...).......ll.\...`R#.E# zJ.[}..d..0.........|tu....LY...?.~!...$.d4Z.I...........,...1..J.nO#.^...R9.....6\.........Y.T.3f.........S.8....$....
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 01 Nov 2016 14:21:58 GMT
Expires: Sat, 05 Nov 2016 14:21:58 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 288771
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070030Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..).(.I.0^....20161101070030Z....20161108070030Z0...*.H................N.].[...=...AL|./....%2. .s.:...y1.....|.A.O<..X..T_....fh..o.....2hAM....P.&.. ML>.....m......m.......z....JV#.....r..Z.u..P..c._... Q...%...$/_...1......r....2.[.j.......IYpa.s .il..-z..&2~..wX...........bq....&).....cf!.={....x3.GG.W.67...=......S.. HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 01 Nov 2016 14:21:58 GMT..Expires: Sat, 05 Nov 2016 14:21:58 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 288771..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161101070030Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..).(.I.0^....20161101070030Z....20161108070030Z0...*.H................N.].[...=...AL|./....%2. .s.:...y1.....|.A.O<..X..T_....fh..o.....2hAM....P.&.. ML>.....m......m.......z....JV#.....r..Z.u..P..c._... Q...%...$/_...1......r....2.[.j.......IYpa.s .il..-z..&2~..wX...........bq....&).....cf!.={....x3.GG.W.67...=......S.. ....
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11 HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 03 Nov 2016 02:26:35 GMT
Expires: Mon, 07 Nov 2016 02:26:35 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 158894
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190208Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..<...k..u....20161102190208Z....20161109190208Z0...*.H.....................m..c..!..C..N....w.1.........:d&.hq...#.....G'.m.>...Jz.u..........-...i.|r..7,RY.3.:.....WKH J....By.v.6d...}J...n.[[C...f..0S..j..56;...n.}...P....97...F(.WBRH..........CY..#9Iv..c...XW....wVm._E....I..P{.......'6.u.\4mQNT..X...fp..-.C.q..jv[.huWHTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Thu, 03 Nov 2016 02:26:35 GMT..Expires: Mon, 07 Nov 2016 02:26:35 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 158894..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161102190208Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..<...k..u....20161102190208Z....20161109190208Z0...*.H.....................m..c..!..C..N....w.1.........:d&.hq...#.....G'.m.>...Jz.u..........-...i.|r..7,RY.3.:.....WKH J....By.v.6d...}J...n.[[C...f..0S..j..56;...n.}...P....97...F(.WBRH..........CY..#9Iv..c...XW....wVm._E....I..P{.......'6.u.\4mQNT..X...fp..-.C.q..jv[.huW....
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 03 Nov 2016 10:27:55 GMT
Expires: Mon, 07 Nov 2016 10:27:55 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 130014
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161103010227Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..x.L.-.).....20161103010227Z....20161110010227Z0...*.H.............<.X.g....S.....$.......#.."b.1Bh..R.....[..G...{y?<.a..........si......K7%......'W.f.... !_...]<@..d...<>/<.p....Y_..b...H>...E........<...,<.t..;.....-2.u%./......7..0...6...lG|...'...$6.?l..u.d9vA..~Kq`.....x c..(.>].....H..TC...)ea.......C....... .3I.......
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 01 Nov 2016 21:41:58 GMT
Expires: Sat, 05 Nov 2016 21:41:58 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 262371
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..20161101130128Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..D.....V.....20161101130128Z....20161108130128Z0...*.H.............B....\..=s...$.EO&=.6.. K.?...J.wQ..P....P$..(..b....B\...7.u..m........ .l.A......&...n\. ...=......|@...Z...g....T@N..N....@..{..s.s.-<......{'.K...X.k...V8.g.]......Q.......U.(\...N.bp.L....P.....DN...S.PQ...0.......Q('..'..)1........c.2..b..h.. ....4.HTTP/1.1 200 OK..Content-Type: application/ocsp-response..Date: Tue, 01 Nov 2016 21:41:58 GMT..Expires: Sat, 05 Nov 2016 21:41:58 GMT..Server: ocsp_responder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Age: 262371..Cache-Control: public, max-age=345600..0..........0..... .....0......0...0......J......h.v....b..Z./..20161101130128Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..D.....V.....20161101130128Z....20161108130128Z0...*.H.............B....\..=s...$.EO&=.6.. K.?...J.wQ..P....P$..(..b....B\...7.u..m........ .l.A......&...n\. ...=......|@...Z...g....T@N..N....@..{..s.s.-<......{'.K...X.k...V8.g.]......Q.......U.(\...N.bp.L....P.....DN...S.PQ...0.......Q('..'..)1........c.2..b..h.. ....4...
GET /PublicSureServerSV.crl HTTP/1.1
Cache-Control: max-age = 150326
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 20 Nov 2013 09:46:05 GMT
If-None-Match: "2b0037-c0d1-a6553140"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.omniroot.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=864000
Content-Type: application/x-pkcs7-crl
Date: Fri, 04 Nov 2016 22:34:47 GMT
Etag: "4029b-51347-5407ce3d0400e"
Expires: Mon, 14 Nov 2016 22:34:47 GMT
Last-Modified: Fri, 04 Nov 2016 17:20:25 GMT
Server: ECS (arn/46BA)
X-Cache: HIT
X-Cntnt-Length: 332615
Content-Length: 332615
0...B0...)...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybertrust Public SureServer SV CA..161104165625Z..161114165625Z0...z0......... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I..101116165848Z0.........,U./...101116173007Z0.........,U.h...101116172944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0.........,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..101116195619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0.........-..4...110315204303Z0........../P....120206141831Z0..........I..@..120124180322Z0..........JP....110222182509Z0..........Jf/Y..120213142815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0..........YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu...120220131416Z0..........^..^..111007192320Z0..........`.w...120213144727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0..........hlG...120213145015Z0..........h.....120130140408Z0............j...120110213653Z0...........}....110406160143Z0............$...110401005006Z0................110401005536Z0............W...120308151704Z0.............h..120228141105Z0................110314145902Z0............`...110322142311Z0................110322142551Z0............lb..120110213802Z0.............0..130201130700Z0............OB..110321165802Z0.............o..110321172720Z0...........g.:..120221183148Z0...........Ud...110516131110Z0............h5..120229174140Z0................1202
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:29 GMT
X-Varnish: 206488254 206487530
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 4
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:24 GMT
X-Varnish: 206487949 206487530
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 3
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1
Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 08:39:04 GMT
If-None-Match: "06a163dbd612a346836873636bdef55a96277740"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:47 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 04 Nov 2016 21:35:50 GMT
Expires: Tue, 08 Nov 2016 21:35:50 GMT
ETag: "a44b6f2498f2c689d96d5918d635d092ebfa0fcb"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2fcb891095574050-SOF
0..........0..... .....0......0...0.......ue......$I1......dO..20161104213550Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K......../N.E.....20161104213550Z....20161108213550Z0...*.H..............y..#H....T...A=..R..;*K.V/4.}....O.2........s..x.........].....n....!...7U.u....LZ.........o..F..b....)....[s.r|L....:6..k...aBh...p.......$e...vu.'.a.a........xy`3....K..%nB..OS.%..... ...n.=..n..S.E#._.W...`L@ ..._|f.d...c.K.~0.S!O...'.W69.7......NV.o.)....0...0...0..........H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z..161115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.........ga..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU....@...h.3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#.M.vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p.6.E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U...........0...U.%..0... .......0...U.......0.0...U.......ue......$I1......dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H..............$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..k,....f...K....A...a..@...b.qZ....Z......4.L.i...=.C.....0(*....................1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..P...H. .s7..s.~..P..@...S...l..9.....$.....3....P6.'.$...........
<<< skipped >>>
GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH HTTP/1.1
Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 07:50:34 GMT
If-None-Match: "6b9ba9eca642c891cc02365fc6161341647bd9fc"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:47 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 04 Nov 2016 20:07:29 GMT
Expires: Tue, 08 Nov 2016 20:07:29 GMT
ETag: "116835402ed3e6687ea7e1347babccca0ce09762"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2fcb8910e5ad4050-SOF
0..........0..... .....0......0...0.......ue......$I1......dO..20161104200729Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K........DN.BG....20161104200729Z....20161108200729Z0...*.H..............w.sqWkRJC#QVx....8N/. R.).vx...'.F.t.g..9{.y.......6%GN...*LU.._n....8x.....OQ..v..Sx..A....y.*r............?...HE.......#Xj5.E9y....K....ql..n........3...8......."...GX.B......6..A.d......G>.[..X....<......z.n..J....g/>MG2.13.p...pH.G.!...<3X...d....4.&P....0...0...0..........H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z..161115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.........ga..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU....@...h.3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#.M.vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p.6.E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U...........0...U.%..0... .......0...U.......0.0...U.......ue......$I1......dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H..............$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..k,....f...K....A...a..@...b.qZ....Z......4.L.i...=.C.....0(*....................1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..P...H. .s7..s.~..P..@...S...l..9.....$.....3....P6.'.$......
<<< skipped >>>
GET /rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV HTTP/1.1
Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 08:41:57 GMT
If-None-Match: "682f048b8d31cb3f1cc888edf96fec2777d7e64b"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com
HTTP/1.1 200 OK
Date: Fri, 04 Nov 2016 22:34:47 GMT
Content-Type: application/ocsp-response
Content-Length: 1507
Connection: keep-alive
Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Fri, 04 Nov 2016 19:40:47 GMT
Expires: Tue, 08 Nov 2016 19:40:47 GMT
ETag: "9a5e0e2eda739d824031f795d956a4198eca2c4e"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2fcb891136044050-SOF
0..........0..... .....0......0...0...........1.IVp*.@N~.......20161104194047Z0n0l0D0... .........\.1n........U.:.yB......Wg...j..Y..-.............DN.JU....20161104194047Z....20161108194047Z0...*.H..............X{[}...Y.6ab..e....p..b.F..7.F(..\rp....#>......./>........4..0d.DZ..........).....r6_..>..<.. ...........8...*.h...Gem....&.:.S.t.....L\.c#=-....*<jn..#V...C.5..%V....\*w.>v..)ih.F.....m`..1...Lc.9.........!.:..w.T./b_....oXv.QXQ....u....._...7.....A...R....0...0...0..........H.j...N... .<i0...*.H........0L1 0...U....GlobalSign Root CA - R21.0...U....GlobalSign1.0...U....GlobalSign0...161007000000Z..170115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OCSP for Root R2 - Signer 1.10.."0...*.H.............0.........N.......B>.|..S...@.......C.a.C.........V...Cf|G.....,......|.b..K.T.x<L.K...6Q..zeh.....Zd.n...0km86...\...n..v..O.......9...)...|...#.....j.......%W..vH`..Z.=..1[.d.y...)..n.&3,Z...#..Q....A.&...i..r"0.!6.g._..7...&.]..4 .$........IG..sw.....c.J.../.7b.........0..0...U...........0...U.%..0... .......0...U.......0.0...U...........1.IVp*.@N~.....0...U.#..0......Wg...j..Y..-.....0... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.............s2..o"..2]=~.=..K.D...{n......,hd.....~TKr.R...K..u.&....lx...^.G...n9.x..~..o.R..:...\I..c<.]I..Ps..uh...<.(..HnJT....m..o.f%..'4^.)...z.-...$s.iI......M....B..3y./..3. .]2.......v.-.l...,..r.k.{^.OW!.......b.k......_Px'....IF............m.(.~.:...r#t
<<< skipped >>>
GET /pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl HTTP/1.1
Cache-Control: max-age = 6793
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 23:37:31 GMT
If-None-Match: "b61f5b26b7e4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: mscrl.microsoft.com
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=7200
Content-Type: application/pkix-crl
Date: Fri, 04 Nov 2016 22:34:45 GMT
Etag: "ad925b8a3c1d11:0"
Last-Modified: Wed, 08 Jun 2016 16:35:08 GMT
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server: ECAcc (arn/46C8)
VTag: 791539655600000000
X-Cache: HIT
X-Powered-By: ASP.NET
Content-Length: 163018
0..|.0..{....0...*.H........0..1.0.....&...,d....com1.0.....&...,d....microsoft1.0.....&...,d....corp1.0.....&...,d....redmond1.0...U....MSIT Machine Auth CA 2..160608162453Z..160616164453Z0..z.0)....=.........130522112904Z0.0...U.......0).....3........130522112904Z0.0...U.......0)..M.\.........130522100146Z0.0...U.......0)....K.........130522100145Z0.0...U.......0)...........Z..130522100145Z0.0...U.......0).....j.....I..130522100145Z0.0...U.......0)....q.....q...130522094611Z0.0...U.......0).....C....q=..130522055646Z0.0...U.......0)..P.......j...130522055646Z0.0...U.......0)..c.......:...130522053344Z0.0...U.......0)..[..x....F0..130521142635Z0.0...U.......0)..[.......F...130521142635Z0.0...U.......0)..`.ii....9...130521142635Z0.0...U.......0)..`.X.....9...130521142635Z0.0...U.......0)..[.......F/..130521142143Z0.0...U.......0).....9....p...130520132837Z0.0...U.......0)..Q.4u....]...130520115050Z0.0...U.......0).....p....p...130520110806Z0.0...U.......0)...z......fQ..130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U.......0)... K.....p...130520094519Z0.0...U.......0)... H.....p...130520094519Z0.0...U.......0)...zF,....o...130520070955Z0.0...U.......0)..f..E....P...130518074816Z0.0...U.......0...\,jN....FD..130402211200Z0...../w....U...130328232900Z0...p.R.....G1..130226223400Z0....e......?...130220163500Z0....[......*...121221223500Z0...A......."...121206221900Z0...A......."...121206221900Z0...A......."...121206221800Z0...A..\...."...121206221700Z0...A.
<<< skipped >>>
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:19 GMT
X-Varnish: 206487540 206487530
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /protected/data/serve/config.bin HTTP/1.1
Accept: */*
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: acgplug.org
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=iso-8859-1
Server: - Web acceleration by hXXp://VVV.unixy.net/varnish
X-Cacheable: YES
Content-Length: 348
Accept-Ranges: bytes
Date: Fri, 04 Nov 2016 22:34:24 GMT
X-Varnish: 206487941 206487530
Via: 1.1 varnish
Connection: close
age: 0
X-Cache: HIT
X-Cache-Hits: 2
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL /protected/data/serve/config.bin was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>...
GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 20 Sep 2013 05:02:11 GMT
If-None-Match: "96d8890beb5ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 02 Nov 2016 05:01:26 GMT
Accept-Ranges: bytes
ETag: "82c52e2ac634d21:0"
Server: Microsoft-IIS/8.5
VTag: 438100426000000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 550
Cache-Control: max-age=900
Date: Fri, 04 Nov 2016 22:34:45 GMT
Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..161101211705Z..170131093705Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......:0... .....7......170130212705Z0...*.H...............j!f......L..W.O...i..4...(cZ...x?y...........-a.N.q..............O.$l.....>........]........Y>.....^..99&I..{;a....{.X.c..........>K.9..lp.....u|..N] .l...;..a...y.q.c .......9....f.....B..:....).#..x.IN.."s..s.P<b*3!nw.i.....CnWe...gZ .............#6.._HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Wed, 02 Nov 2016 05:01:26 GMT..Accept-Ranges: bytes..ETag: "82c52e2ac634d21:0"..Server: Microsoft-IIS/8.5..VTag: 438100426000000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 550..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:45 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-Stamp PCA..161101211705Z..170131093705Z._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......:0... .....7......170130212705Z0...*.H...............j!f......L..W.O...i..4...(cZ...x?y...........-a.N.q..............O.$l.....>........]........Y>.....^..99&I..{;a....{.X.c..........>K.9..lp.....u|..N] .l...;..a...y.q.c .......9....f.....B..:....).#..x.IN.."s..s.P<b*
<<< skipped >>>
GET /pki/crl/products/WinPCA.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT
If-None-Match: "8071417b63bece1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Wed, 02 Dec 2015 18:30:06 GMT
Accept-Ranges: bytes
ETag: "0cb60772f2dd11:0"
Server: Microsoft-IIS/8.5
VTag: 791804826200000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 530
Cache-Control: max-age=900
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p............<.J0... .....7.......0...U......90...*.H..............I...MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D.........g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt.}......X......H.....|d...s..`.8F.l.......R.C........
GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1
Cache-Control: max-age = 900
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 29 Oct 2013 05:02:50 GMT
If-None-Match: "b8b5df1d64d4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Tue, 27 Sep 2016 05:00:38 GMT
Accept-Ranges: bytes
ETag: "773de167c18d21:0"
Server: Microsoft-IIS/8.5
VTag: 279261256600000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 554
Cache-Control: max-age=900
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Signing PCA..160926163316Z..161226045316Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......a0... .....7......161225164316Z0...*.H.............&............G.$.-..dc.....7.m..N.`.U......^F.V....%ej..p4...>.[)0.......Z..v.../..b-.....v.A$......z.k.U....@S.._...I.........h*@6.)WM..u....I....ew.7...._.....Y...iFWaQ.}....X.........Y.!..J.j*............<L......L,...Y...c...:.WE..C..Q..|G....j<..z~6q......
GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1
Cache-Control: max-age = 808
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT
If-None-Match: "9c3f3dbaacc4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Tue, 06 Sep 2016 05:01:54 GMT
Accept-Ranges: bytes
ETag: "6b18dc9fb7d21:0"
Server: Microsoft-IIS/8.5
VTag: 279107828100000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 813
Cache-Control: max-age=900
Date: Fri, 04 Nov 2016 22:34:46 GMT
Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..160905204847Z..161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......00... .....7......161204205847Z0...*.H.............".....s..B#.bK..Hv...m,x..e.ec..j...y....6.e......Cp.....7G.0..AH..A.e......I...j....W.obU0.?.....Q.#.\.t..v.4E.......jF.Zm....u...P....88.....nC./.._2&.. .h....Q..z{wl.....?...M..'..s[..\M.t....J.Vb..,G..t....nk._...t.T.c[...kKW&D...#.."9.....X./.w.....%..0....K%.H...x.%..'..}.....P.3;.Y...pe z.!...:X..f..r..i1...F...0.......2.~x.n.R.E...' ..>.)...}GT...>...P.^..]....{..> 2..N.m....!..1gL..jl@...B..5.o....s..6...d..N.u...|%.q..-../.....(.Xm.X...r9...........[.DQ.......Y..;.. U.......xu-%*.-....~..$U.../...HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Tue, 06 Sep 2016 05:01:54 GMT..Accept-Ranges: bytes..ETag: "6b18dc9fb7d21:0"..Server: Microsoft-IIS/8.5..VTag: 279107828100000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 813..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:46 GMT..Connection: keep-alive..0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..160905204847Z..161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..%..*..S.Y..0... .....7.......0...U......00... .....7...
<<< skipped >>>
GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com
HTTP/1.1 404 Not Found
Date: Fri, 04 Nov 2016 22:34:46 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>. <meta charset=utf-8>. <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">. <title>Error 404 (Not Found)!!1</title>. <style>. *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//VVV.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//VVV.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}. </style>. <a href=//VVV.google.com/><span id=logo aria-label=Google></span></a>. <p><b>404.</b> <ins>Tha
<<< skipped >>>
GET /pki/crl/products/CodeSignPCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
HTTP/1.1 200 OK
Content-Type: application/pkix-crl
Last-Modified: Mon, 16 Apr 2012 23:49:48 GMT
Accept-Ranges: bytes
ETag: "0f6669b2b1ccd1:0"
Server: Microsoft-IIS/8.5
VTag: 438195957300000000
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Content-Length: 558
Cache-Control: max-age=900
Date: Fri, 04 Nov 2016 22:34:14 GMT
Connection: keep-alive
0..*0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 2000 Microsoft Corp.1#0!..U....Microsoft Code Signing PCA..111110211944Z..420416234935Z.7050...U.#..0...%. K].rT....*.....S.0... .....7.........0...*.H...............&..%PIu@.....\0KF....0..^.h9=.1jT,5.L....Ed ..6.......i.6.xva....oX.^f'....s...!......O...h.1a..Ud);.?....J_...Fu....<v.zx..t..h.0JU%.nk;..B[4.?&Zm^..M.!.'...w.u.\T..Tr..Ch.[.z:....#...T.4Ct.......,...c..}F..U....:..7J...%.#..D6 . ....G..#....T..G;......HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: Mon, 16 Apr 2012 23:49:48 GMT..Accept-Ranges: bytes..ETag: "0f6669b2b1ccd1:0"..Server: Microsoft-IIS/8.5..VTag: 438195957300000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 558..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:14 GMT..Connection: keep-alive..0..*0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 2000 Microsoft Corp.1#0!..U....Microsoft Code Signing PCA..111110211944Z..420416234935Z.7050...U.#..0...%. K].rT....*.....S.0... .....7.........0...*.H...............&..%PIu@.....\0KF....0..^.h9=.1jT,5.L....Ed ..6.......i.6.xva....oX.^f'....s...!......O...h.1a..Ud);.?....J_...Fu....<v.zx..t..h.0JU%.nk;..B[4.?&Zm^..M.!.'...w.u.\T..Tr..Ch.[.z:....#...T.4Ct.......,...c..}F..U....:..7J
<<< skipped >>>
Map
The Trojan connects to the servers at the folowing location(s):
Strings from Dumps
taskhost.exe_252_rwx_003B0000_00027000:
.text
.text
`.data
`.data
.reloc
.reloc
hXXp://VVV.google.com/webhp
hXXp://VVV.google.com/webhp
PR_OpenTCPSocket
PR_OpenTCPSocket
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
gdi32.dll
gdi32.dll
: ;2*8.>
: ;2*8.>
3.#70!2)
3.#70!2)
x#m`a`cmddt-
x#m`a`cmddt-
6 !26!1'1
6 !26!1'1
7"52),,>
7"52),,>
;
;
71.(5;4=
71.(5;4=
(203,2$0
(203,2$0
/?./,5
/?./,5
:>(
:>(
8%/
8%/
%/>!
%/>!
HTTP/1.1
HTTP/1.1
userenv.dll
userenv.dll
del "%s"
del "%s"
if exist "%s" goto d
if exist "%s" goto d
del /F "%s"
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
urlmon.dll
cabinet.dll
cabinet.dll
hXXp://
hXXp://
hXXps://
hXXps://
HTTP/1.
HTTP/1.
SSSh,4;
SSSh,4;
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SetKeyboardState
SetKeyboardState
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardState
GetKeyboardState
OpenWindowStationW
OpenWindowStationW
GetProcessWindowStation
GetProcessWindowStation
CreateWindowStationW
CreateWindowStationW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
PathIsURLW
PathIsURLW
UrlUnescapeA
UrlUnescapeA
SHDeleteKeyW
SHDeleteKeyW
SHLWAPI.dll
SHLWAPI.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
Secur32.dll
Secur32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
WS2_32.dll
WS2_32.dll
PFXImportCertStore
PFXImportCertStore
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpSendRequestA
HttpSendRequestA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
WININET.dll
WININET.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
6 6&6/656{6
6 6&6/656{6
cGlobal\XXX
cGlobal\XXX
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
SysShadow
SysShadow
kernel32.dll
kernel32.dll
"%s" %s
"%s" %s
/c "%s"
/c "%s"
%sx.%s
%sx.%s
%sx
%sx
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso\vixih.zel
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso\vixih.zel
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso
C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso
vixih.zel
vixih.zel
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
C:\Users\"%CurrentUserName%"\AppData\Roaming
C:\Users\"%CurrentUserName%"\AppData\Roaming
{2EF86105-93EC-9282-1D42-79894B2F994B}
{2EF86105-93EC-9282-1D42-79894B2F994B}
Explorer.EXE_284_rwx_039E0000_00027000:
.text
.text
`.data
`.data
.reloc
.reloc
hXXp://VVV.google.com/webhp
hXXp://VVV.google.com/webhp
PR_OpenTCPSocket
PR_OpenTCPSocket
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
gdi32.dll
gdi32.dll
: ;2*8.>
: ;2*8.>
3.#70!2)
3.#70!2)
x#m`a`cmddt-
x#m`a`cmddt-
6 !26!1'1
6 !26!1'1
7"52),,>
7"52),,>
;
;
71.(5;4=
71.(5;4=
(203,2$0
(203,2$0
/?./,5
/?./,5
:>(
:>(
8%/
8%/
%/>!
%/>!
HTTP/1.1
HTTP/1.1
userenv.dll
userenv.dll
del "%s"
del "%s"
if exist "%s" goto d
if exist "%s" goto d
del /F "%s"
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
urlmon.dll
cabinet.dll
cabinet.dll
hXXp://
hXXp://
hXXps://
hXXps://
HTTP/1.
HTTP/1.
SSSh,4
SSSh,4
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SetKeyboardState
SetKeyboardState
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardState
GetKeyboardState
OpenWindowStationW
OpenWindowStationW
GetProcessWindowStation
GetProcessWindowStation
CreateWindowStationW
CreateWindowStationW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
PathIsURLW
PathIsURLW
UrlUnescapeA
UrlUnescapeA
SHDeleteKeyW
SHDeleteKeyW
SHLWAPI.dll
SHLWAPI.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
Secur32.dll
Secur32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
WS2_32.dll
WS2_32.dll
PFXImportCertStore
PFXImportCertStore
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpSendRequestA
HttpSendRequestA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
WININET.dll
WININET.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
6 6&6/656{6
6 6&6/656{6
cGlobal\XXX
cGlobal\XXX
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
SysShadow
SysShadow
kernel32.dll
kernel32.dll
"%s" %s
"%s" %s
/c "%s"
/c "%s"
%sx.%s
%sx.%s
%sx
%sx
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
C:\Users\"%CurrentUserName%"\AppData\Roaming
C:\Users\"%CurrentUserName%"\AppData\Roaming
{2EF86105-93EC-9282-1D42-79894B2F994B}
{2EF86105-93EC-9282-1D42-79894B2F994B}
Dwm.exe_528_rwx_010A0000_00027000:
.text
.text
`.data
`.data
.reloc
.reloc
hXXp://VVV.google.com/webhp
hXXp://VVV.google.com/webhp
PR_OpenTCPSocket
PR_OpenTCPSocket
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
gdi32.dll
gdi32.dll
: ;2*8.>
: ;2*8.>
3.#70!2)
3.#70!2)
x#m`a`cmddt-
x#m`a`cmddt-
6 !26!1'1
6 !26!1'1
7"52),,>
7"52),,>
;
;
71.(5;4=
71.(5;4=
(203,2$0
(203,2$0
/?./,5
/?./,5
:>(
:>(
8%/
8%/
%/>!
%/>!
HTTP/1.1
HTTP/1.1
userenv.dll
userenv.dll
del "%s"
del "%s"
if exist "%s" goto d
if exist "%s" goto d
del /F "%s"
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
urlmon.dll
cabinet.dll
cabinet.dll
hXXp://
hXXp://
hXXps://
hXXps://
HTTP/1.
HTTP/1.
SSSh,4
SSSh,4
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SetKeyboardState
SetKeyboardState
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardState
GetKeyboardState
OpenWindowStationW
OpenWindowStationW
GetProcessWindowStation
GetProcessWindowStation
CreateWindowStationW
CreateWindowStationW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
PathIsURLW
PathIsURLW
UrlUnescapeA
UrlUnescapeA
SHDeleteKeyW
SHDeleteKeyW
SHLWAPI.dll
SHLWAPI.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
Secur32.dll
Secur32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
WS2_32.dll
WS2_32.dll
PFXImportCertStore
PFXImportCertStore
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpSendRequestA
HttpSendRequestA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
WININET.dll
WININET.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
6 6&6/656{6
6 6&6/656{6
cGlobal\XXX
cGlobal\XXX
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
SysShadow
SysShadow
kernel32.dll
kernel32.dll
"%s" %s
"%s" %s
/c "%s"
/c "%s"
%sx.%s
%sx.%s
%sx
%sx
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
C:\Users\"%CurrentUserName%"\AppData\Roaming
C:\Users\"%CurrentUserName%"\AppData\Roaming
{2EF86105-93EC-9282-1D42-79894B2F994B}
{2EF86105-93EC-9282-1D42-79894B2F994B}
TPAutoConnect.exe_2068_rwx_00550000_00027000:
.text
.text
`.data
`.data
.reloc
.reloc
hXXp://VVV.google.com/webhp
hXXp://VVV.google.com/webhp
PR_OpenTCPSocket
PR_OpenTCPSocket
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
gdi32.dll
gdi32.dll
: ;2*8.>
: ;2*8.>
3.#70!2)
3.#70!2)
x#m`a`cmddt-
x#m`a`cmddt-
6 !26!1'1
6 !26!1'1
7"52),,>
7"52),,>
;
;
71.(5;4=
71.(5;4=
(203,2$0
(203,2$0
/?./,5
/?./,5
:>(
:>(
8%/
8%/
%/>!
%/>!
HTTP/1.1
HTTP/1.1
userenv.dll
userenv.dll
del "%s"
del "%s"
if exist "%s" goto d
if exist "%s" goto d
del /F "%s"
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
urlmon.dll
cabinet.dll
cabinet.dll
hXXp://
hXXp://
hXXps://
hXXps://
HTTP/1.
HTTP/1.
SSSh,4U
SSSh,4U
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SetKeyboardState
SetKeyboardState
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardState
GetKeyboardState
OpenWindowStationW
OpenWindowStationW
GetProcessWindowStation
GetProcessWindowStation
CreateWindowStationW
CreateWindowStationW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
PathIsURLW
PathIsURLW
UrlUnescapeA
UrlUnescapeA
SHDeleteKeyW
SHDeleteKeyW
SHLWAPI.dll
SHLWAPI.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
Secur32.dll
Secur32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
WS2_32.dll
WS2_32.dll
PFXImportCertStore
PFXImportCertStore
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpSendRequestA
HttpSendRequestA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
WININET.dll
WININET.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
6 6&6/656{6
6 6&6/656{6
cGlobal\XXX
cGlobal\XXX
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
SysShadow
SysShadow
kernel32.dll
kernel32.dll
"%s" %s
"%s" %s
/c "%s"
/c "%s"
%sx.%s
%sx.%s
%sx
%sx
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
C:\Users\"%CurrentUserName%"\AppData\Roaming
C:\Users\"%CurrentUserName%"\AppData\Roaming
{2EF86105-93EC-9282-1D42-79894B2F994B}
{2EF86105-93EC-9282-1D42-79894B2F994B}
conhost.exe_2076_rwx_000D0000_00027000:
.text
.text
`.data
`.data
.reloc
.reloc
hXXp://VVV.google.com/webhp
hXXp://VVV.google.com/webhp
PR_OpenTCPSocket
PR_OpenTCPSocket
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
gdi32.dll
gdi32.dll
: ;2*8.>
: ;2*8.>
3.#70!2)
3.#70!2)
x#m`a`cmddt-
x#m`a`cmddt-
6 !26!1'1
6 !26!1'1
7"52),,>
7"52),,>
;
;
71.(5;4=
71.(5;4=
(203,2$0
(203,2$0
/?./,5
/?./,5
:>(
:>(
8%/
8%/
%/>!
%/>!
HTTP/1.1
HTTP/1.1
userenv.dll
userenv.dll
del "%s"
del "%s"
if exist "%s" goto d
if exist "%s" goto d
del /F "%s"
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
urlmon.dll
cabinet.dll
cabinet.dll
hXXp://
hXXp://
hXXps://
hXXps://
HTTP/1.
HTTP/1.
SSSh,4
SSSh,4
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SetKeyboardState
SetKeyboardState
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardState
GetKeyboardState
OpenWindowStationW
OpenWindowStationW
GetProcessWindowStation
GetProcessWindowStation
CreateWindowStationW
CreateWindowStationW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
PathIsURLW
PathIsURLW
UrlUnescapeA
UrlUnescapeA
SHDeleteKeyW
SHDeleteKeyW
SHLWAPI.dll
SHLWAPI.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
Secur32.dll
Secur32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
WS2_32.dll
WS2_32.dll
PFXImportCertStore
PFXImportCertStore
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpSendRequestA
HttpSendRequestA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
WININET.dll
WININET.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
6 6&6/656{6
6 6&6/656{6
cGlobal\XXX
cGlobal\XXX
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
SysShadow
SysShadow
kernel32.dll
kernel32.dll
"%s" %s
"%s" %s
/c "%s"
/c "%s"
%sx.%s
%sx.%s
%sx
%sx
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
C:\Users\"%CurrentUserName%"\AppData\Roaming
C:\Users\"%CurrentUserName%"\AppData\Roaming
{2EF86105-93EC-9282-1D42-79894B2F994B}
{2EF86105-93EC-9282-1D42-79894B2F994B}
conhost.exe_3452_rwx_00070000_00027000:
.text
.text
`.data
`.data
.reloc
.reloc
hXXp://VVV.google.com/webhp
hXXp://VVV.google.com/webhp
PR_OpenTCPSocket
PR_OpenTCPSocket
gdiplus.dll
gdiplus.dll
GdiplusShutdown
GdiplusShutdown
ole32.dll
ole32.dll
gdi32.dll
gdi32.dll
: ;2*8.>
: ;2*8.>
3.#70!2)
3.#70!2)
x#m`a`cmddt-
x#m`a`cmddt-
6 !26!1'1
6 !26!1'1
7"52),,>
7"52),,>
;
;
71.(5;4=
71.(5;4=
(203,2$0
(203,2$0
/?./,5
/?./,5
:>(
:>(
8%/
8%/
%/>!
%/>!
HTTP/1.1
HTTP/1.1
userenv.dll
userenv.dll
del "%s"
del "%s"
if exist "%s" goto d
if exist "%s" goto d
del /F "%s"
del /F "%s"
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)
urlmon.dll
urlmon.dll
cabinet.dll
cabinet.dll
hXXp://
hXXp://
hXXps://
hXXps://
HTTP/1.
HTTP/1.
SSSh,4
SSSh,4
GetProcessHeap
GetProcessHeap
KERNEL32.dll
KERNEL32.dll
SetKeyboardState
SetKeyboardState
ExitWindowsEx
ExitWindowsEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
MapVirtualKeyW
MapVirtualKeyW
GetKeyboardState
GetKeyboardState
OpenWindowStationW
OpenWindowStationW
GetProcessWindowStation
GetProcessWindowStation
CreateWindowStationW
CreateWindowStationW
CloseWindowStation
CloseWindowStation
SetProcessWindowStation
SetProcessWindowStation
USER32.dll
USER32.dll
RegOpenKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegEnumKeyExW
RegCloseKey
RegCloseKey
RegCreateKeyExW
RegCreateKeyExW
ADVAPI32.dll
ADVAPI32.dll
PathIsURLW
PathIsURLW
UrlUnescapeA
UrlUnescapeA
SHDeleteKeyW
SHDeleteKeyW
SHLWAPI.dll
SHLWAPI.dll
ShellExecuteW
ShellExecuteW
SHELL32.dll
SHELL32.dll
Secur32.dll
Secur32.dll
SetViewportOrgEx
SetViewportOrgEx
GDI32.dll
GDI32.dll
WS2_32.dll
WS2_32.dll
PFXImportCertStore
PFXImportCertStore
CertDeleteCertificateFromStore
CertDeleteCertificateFromStore
CertOpenSystemStoreW
CertOpenSystemStoreW
CertCloseStore
CertCloseStore
CertEnumCertificatesInStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertDuplicateCertificateContext
PFXExportCertStoreEx
PFXExportCertStoreEx
CRYPT32.dll
CRYPT32.dll
HttpSendRequestExA
HttpSendRequestExA
HttpQueryInfoA
HttpQueryInfoA
HttpSendRequestExW
HttpSendRequestExW
HttpSendRequestW
HttpSendRequestW
HttpSendRequestA
HttpSendRequestA
InternetCrackUrlA
InternetCrackUrlA
HttpOpenRequestA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpAddRequestHeadersA
GetUrlCacheEntryInfoW
GetUrlCacheEntryInfoW
HttpAddRequestHeadersW
HttpAddRequestHeadersW
WININET.dll
WININET.dll
OLEAUT32.dll
OLEAUT32.dll
NETAPI32.dll
NETAPI32.dll
6 6&6/656{6
6 6&6/656{6
cGlobal\XXX
cGlobal\XXX
nspr4.dll
nspr4.dll
nss3.dll
nss3.dll
SysShadow
SysShadow
kernel32.dll
kernel32.dll
"%s" %s
"%s" %s
/c "%s"
/c "%s"
%sx.%s
%sx.%s
%sx
%sx
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
Global\{B883D320-21C9-04F9-1D42-79894B2F994B}
C:\Users\"%CurrentUserName%"\AppData\Roaming
C:\Users\"%CurrentUserName%"\AppData\Roaming
{2EF86105-93EC-9282-1D42-79894B2F994B}
{2EF86105-93EC-9282-1D42-79894B2F994B}