MD5: aa1d565a0070bef7366abe3824bf049a
SHA1: cb438dac3143311468ce781ba7e842a1389f32f1
SHA256: 7c0edcf1bb536ad72a98b4437e86dff897e383c87830222889af6d5c514b1887
SSDeep: 12288:K6Wq4aaE6KwyF5L0Y2D1PqLUjL QT9zXpTl2WCAOVFripV2G:othEVaPqL27FDWAsI6G
Size: 525567 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: PackerUPXCompresorGratuitowwwupxsourceforgenet, UPolyXv05_v6
Company: no certificate found
Created at: 2012-01-29 23:32:28
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

WinMail.exe:2824
%original file name%.exe:1024

The Trojan injects its code into the following process(es):

taskhost.exe:252
Explorer.EXE:284
Dwm.exe:528
TPAutoConnect.exe:2068
conhost.exe:2076
conhost.exe:3452

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process WinMail.exe:2824 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (42552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.log (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol (592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml (1924 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol (608 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol (560 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol (544 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\tmp.edb (1728 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.log (18592 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.chk (300 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (558 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore (99 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (968 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml:OECustomProperty (260 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (3466 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (2712 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.pat (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb00001.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\WindowsMail.MSMessageStore (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old\edb00001.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\old (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2.ui (0 bytes)

The process %original file name%.exe:1024 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmpbe57d30b.bat (179 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe (1053 bytes)

Registry activity

The process WinMail.exe:2824 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\IdentityCRL\Dynamic Salt]
"Size" = "330"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows Mail]
"Compact Check Count" = "2"
"Settings Upgraded" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows Mail\Junk Mail\Block Senders List]
"Version" = "327680"

[HKCU\Identities\{C692FCB0-9162-422E-94A4-4CD072B19CA9}]
"Identity Ordinal" = "1"

[HKCU\Software\Microsoft\Windows Mail]
"LastBackup" = "E0 07 0B 00 05 00 04 00 16 00 22 00 0A 00 7F 00"
"Running" = "1"
"V7StoreMigDone" = "01 00 00 00"
"StoreMigratedV5" = "1"

[HKCU\Software\Microsoft\Windows Mail\Junk Mail\Safe Senders List]
"Version" = "327680"

[HKCU\Software\Microsoft\Windows Mail\Mail]
"Welcome Message" = "0"

[HKCU\Software\Microsoft\Windows Mail]
"SpoolerDlgPos" = "2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\IdentityCRL\Dynamic Salt]
"Value" = "01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0"

[HKCU\Identities]
"Identity Ordinal" = "2"

[HKCU\Software\Microsoft\Windows Mail\Mail]
"Secure Safe Attachments" = "1"
"Default_CodePage" = "28591"

[HKCU\Software\Microsoft\WAB]
"NamedPropCount" = "1"

[HKCU\Software\Microsoft\IAM\Accounts]
"ConnectionSettingsMigrated" = "1"

[HKCU\Software\Microsoft\Windows Mail]
"SpoolerTack" = "0"

[HKCU\Software\Microsoft\IAM]
"Default News Account" = "account{CE54EE8F-8454-4E11-A69C-0E6F9BED6C0A}.oeaccount"
"Default LDAP Account" = "account{5F33D8D7-3326-4E0C-969F-F201824EF068}.oeaccount"

[HKCU\Software\Microsoft\Windows Mail]
"lastrun" = "77 71 87 92 EB 36 D2 01"

[HKCU\Software\Microsoft\Windows Mail\Mail]
"Safe Attachments" = "1"

[HKCU\Software\Microsoft\IAM]
"Server ID" = "2"

[HKCU\Software\Microsoft\WAB]
"NamedProps" = "04 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\WAB]
"NamedPropCount"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Identities]
"Changing"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Identities]
"IncomingID"
"OutgoingID"

[HKCU\Software\Microsoft\WAB]
"NamedProps"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

The Trojan installs the following user-mode hooks in WININET.dll:

HttpSendRequestExA
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExW
InternetReadFileExA
InternetQueryDataAvailable
InternetReadFile
HttpQueryInfoA
InternetCloseHandle

The Trojan installs the following user-mode hooks in CRYPT32.dll:

PFXImportCertStore

The Trojan installs the following user-mode hooks in USER32.dll:

SetCursorPos
ReleaseCapture
SetCapture
GetMessagePos
DefDlgProcW
CallWindowProcA
DefMDIChildProcA
DefFrameProcA
GetUpdateRgn
DefFrameProcW
DefMDIChildProcW
DefDlgProcA
GetClipboardData
GetMessageW
TranslateMessage
PeekMessageW
EndPaint
BeginPaint
GetDC
ReleaseDC
DefWindowProcW
GetWindowDC
GetDCEx
CallWindowProcW
PeekMessageA
GetMessageA
RegisterClassExW
RegisterClassW
RegisterClassA
DefWindowProcA
GetUpdateRect
GetCursorPos
GetCapture
RegisterClassExA
OpenInputDesktop
SwitchDesktop

The Trojan installs the following user-mode hooks in WS2_32.dll:

send
WSASend
closesocket

The Trojan installs the following user-mode hooks in kernel32.dll:

GetFileAttributesExW

The Trojan installs the following user-mode hooks in ntdll.dll:

LdrLoadDll
ZwCreateUserProcess

Propagation

VersionInfo

Company Name:
Product Name:
Product Version:
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 3, 3, 8, 1
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://acgplug.org/protected/data/serve/config.bin
hxxp://a1363.dscg.akamai.net/pki/crl/products/CodeSignPCA.crl
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://cs3.wpc.v0cdn.net/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://crl.comodoca.com.cdn.cloudflare.net/AddTrustExternalCARoot.crl	104.16.92.188
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg=
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://crl.comodoca.com.cdn.cloudflare.net/UTN-DATACorpSGC.crl	104.16.92.188
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://gpla1.wac.v2cdn.net/PublicSureServerSV.crl
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH
hxxp://cdn.globalsigncdn.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV
hxxp://cdn.globalsigncdn.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw==
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za
hxxp://a1158.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE=
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y=
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c=
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=	23.43.139.27
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i	74.125.232.226
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE=	23.43.139.27
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I	94.31.29.96
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==	23.43.139.27
hxxp://ocsp.globalsign.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV	104.16.26.216
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO	74.125.232.226
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11	74.125.232.226
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl	74.125.232.226
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	212.30.134.167
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy	74.125.232.226
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za	74.125.232.226
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	212.30.134.167
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI=	93.184.220.29
hxxp://tg.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU=	23.43.139.27
hxxp://evsecure-ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg=	23.43.139.27
hxxp://sf.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys=	23.43.139.27
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC	74.125.232.226
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM	104.16.26.216
hxxp://mscrl.microsoft.com/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl	93.184.221.200
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y=	5.45.205.235
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.174
hxxp://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw==	104.16.26.216
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	74.125.232.226
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=	93.184.220.29
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss=	93.184.220.29
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	212.30.134.167
hxxp://crl.comodoca.com/AddTrustExternalCARoot.crl	104.16.92.188
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://vassg142.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/	2.21.89.35
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe	74.125.232.226
hxxp://crl.microsoft.com/pki/crl/products/CodeSignPCA.crl	212.30.134.167
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=	93.184.220.29
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF	74.125.232.226
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=	93.184.220.29
hxxp://crl.omniroot.com/PublicSureServerSV.crl	93.184.220.20
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	212.30.134.167
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH	104.16.26.216
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	74.125.232.226
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR	74.125.232.226
hxxp://crl.comodoca.com/UTN-DATACorpSGC.crl	104.16.92.188
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c=	5.45.205.235
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+	74.125.232.226
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI=	23.43.139.27
hxxp://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0=	23.43.139.27
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA=	93.184.220.29
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso	94.31.29.96
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl	93.184.220.20

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Possible Zbot Activity Common Download Struct
ET CURRENT_EVENTS Zbot Generic URI/Header Struct .bin

Traffic

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1

Cache-Control: max-age = 564348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1362

content-transfer-encoding: binary

Cache-Control: max-age=482178, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 12:27:47 GMT

Expires: Thu, 10 Nov 2016 12:27:47 GMT

Date: Fri, 04 Nov 2016 22:34:50 GMT

Connection: keep-alive
0..N......G0..C.. .....0.....40..00.......j.#.p.e$.\ps.*.. .j..2016110
3122747Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:.....20161103122747Z....20161110122747Z0...*.H............
...A....(Ew.x.5......0.._...'F...*.n..O....N49.G.#j..z......|........\
R.X.KPP-k.%;..X.......Y.B...3.^.w~...Y...lu.].^.c.-....\..=.....g.....
)..x.Y.tr..\:}..]....L...z.*.L........t....&.,.~......&.%.8J.J<....
.e?..E...qP.=.F.)P.T.........G...o/...,..b{.R.X.......0...0..|0..d....
....:.0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...151203170230Z..161214170230Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 40.."0...*.H.............0.........[.c
.#zj......RME.....,......(..U......!-.l..R..E.~..%."./8mv..D...*...Rx.
.......mw.~2..Q5T\.H...Wk*..a.z.$._..T......;T.S.r(._*.G....^.P.!.3..t
.......s......P....C._.g.b.oK...EV..>...>.|.o.~quo.............v
4..Tt....Q.]A.Y......... w.E..=.%.n7.......{" *C........0..0...U.#..0.
...z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0...U.....
......0...U.......0.0 ..U....0...0.1.0...U....TGV-C-670...*.H.........
......aEc<..'R......]C.ri.Zm.....|..B.$..76..h....l...Xbxua...C.X.S
....~K..A..._.T@$.....9(.... ......\.*.....5.b.x...[QM.._9P.=..l...gf.
.L.?..3 ......Z....._...20R;...x.......C..0....l.G.A..5TS>d.U......
w.(\....v..9.z7.....J..;..'...u.Y...BB.@.2u.e..eW..J.U....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA= HTTP/1.1

Cache-Control: max-age = 500864

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 02:06:23 GMT

If-None-Match: "57feec1f-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=503521

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581c9786-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 14:13:26 GMT

Server: ECS (vie/F398)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......Z..{*....q..`.-.eu.X..2016110
4132000Z0s0q0I0... .........G.h...#......Vm.Q....Z..{*....q..`.-.eu.X.
...Z...I{.I..h.&.....20161104132000Z....20161111123500Z0...*.H........
...........PQ....X.R.....6.......Qw.......3WMY6QNIUR.O.....$.:........
......3V.g..#......g....G...c.R..5p......W.$..%"..[t.`5..t............
5..Nl{n..............E.U:L7U.f.....,R..q......~m#X..H.e.P12..=....f..Z
k.....0q._.....H......Lo..%hG.-.})R..F..l.q..!rd#.o....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI= HTTP/1.1

Cache-Control: max-age = 507829

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 03:40:21 GMT

If-None-Match: "57ff0225-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=499845

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cabe7-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 15:40:23 GMT

Server: ECS (vie/F2D3)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2016110
4145200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
...c.Y..6. Y.<..b....20161104145200Z....20161111140700Z0...*.H.....
..........L..mU.d.._..D.....0.......yh...s.sny.......O.k.IJW....0..{M.
...G..9.#f#.>....w.......g>B^..B...~..lt............A.].=w.::...
.....M6.....BWJ^...\..9..a.q.w.I..y:..n.1n$.o&9.2.u%..uV^Z..0).....e.R
`K..MnJ..bP.......c/..P..P/.CY...A.t...J......,...v.}9. ..C....
.


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= HTTP/1.1

Cache-Control: max-age = 510963

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:45:35 GMT

If-None-Match: "57ff116f-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=505362

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cbc70-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 16:50:56 GMT

Server: ECS (vie/F2AD)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......E.......1-Q...!..m....2016110
3210000Z0s0q0I0... ............@..D3=?..Mn8...Q..E.......1-Q...!..m...
....._..fuSC.o.P.....20161103210000Z....20161110210000Z0...*.H........
.....,...U..~a.@..%n.....d...U..).t..d(.W.".!.....uN...&.-w...X.......
... .B...........g....'..j....t ....@..J1./...a..SR. .F.._k,.:u-E.....
..m...?H..D....,......~.H...*.y.$cR...;.......9N.^.j.e...W'......s...-
%...AZ..8..jn.".&V.5..N<..2.......S...Kp........7......


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT

If-None-Match: "57ff143e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=505028

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cbbcf-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 16:48:15 GMT

Server: ECS (vie/F2D5)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1103210000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&...
.cd ........\..m. B.]......20161103210000Z....20161110210000Z0...*.H..
.............a......^gY..!.L......"....UE.M..`i~...o.......!....5sI...
....C.L...nM..:..."...u..h.|..........]..~f.r.7.J.@.....iF......I^.Loo
......ZB...rY..u........V...._=cO).u.%.....,53......J.........e......8
...8..Z.g.p..6..A6S5...;....w$G.l.b....4{.O...W....Le........


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Cache-Control: max-age = 512045

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:41:33 GMT

If-None-Match: "57ff1e8d-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511624

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cc8b3-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 17:43:15 GMT

Server: ECS (vie/F38D)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2016110
3210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
..........z....@7....20161103210000Z....20161110210000Z0...*.H........
..........}..]...u..*.....Y)o..'.h..b.....J=0R..[....).....<(_.w...
.7FE..Hi.d.K....Zt...X...un....v.....B .......m...,.D:..(....J73.2.Wi.
.*.).m%v~h..{T.V..P?..n1YQ...H.,c.......%<......q1.%.. ..v])>./.
....s......._.L.iP...g....n........:12.f.]M.ke.F..S.....<XoQ
....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o= HTTP/1.1

Cache-Control: max-age = 513888

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:42:27 GMT

If-None-Match: "57ff1ec3-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=508884

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cc8f8-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 17:44:24 GMT

Server: ECS (vie/F3B0)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..2016
1104170700Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb.
..Yr;....>...^......2K.....20161104170700Z....20161111162200Z0...*.
H.............D=..}.D?....j.0...%`F.>..B..L.L._..<.......oNS....
.'...0....E....@..i.t'*..L.u...=*...J.]..!...7.}.l..M....(ltC.MZ.#U...
..=Y...T~H.......r`..^ea`|.]..I.?xj..>...UZ...\.5...,2@..N..w.q.!.b
..6..ey..p..f...tC.).g0.....kbX u..%*...o...?..X..y.$.U.H....uY.c..Y.<
/font>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss= HTTP/1.1

Cache-Control: max-age = 516225

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:53:02 GMT

If-None-Match: "57ff2f4e-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=517072

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cdb1e-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 19:01:50 GMT

Server: ECS (vie/F3B1)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2016110
4181200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
.....A0#o(....}......20161104181200Z....20161111172700Z0...*.H........
.....5....)...E.$...5<..........g#...,y0.H.h;...o......b.7L.......V
............d.(.\..#...t....N~Y.....%2*..4\.....!.8.3.@go..4X@..l.q<
; .....8...I...t.d.Wd./.S..3..m.......u...........?.....:...) ...!Q.. 
.....9j.F..T......(>..I......M@.........<Q.O...v....>.M..nt>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= HTTP/1.1

Cache-Control: max-age = 517590

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:25:50 GMT

If-None-Match: "57ff28ee-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=511615

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cd30d-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 18:27:25 GMT

Server: ECS (vie/F3C2)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1103210000Z0s0q0I0... ............(..A...B..G@B.X....>.i...G...&...
.cd ....y.D.... .a_.k......20161103210000Z....20161110210000Z0...*.H..
.............].........A....V.lCI..ga,W....\D.R:cP.....\6..}.......\..
w...,E.8..l.....QM..xW.6.....dP...t.u..l....Z...../.J[.P'|............
..]..`..@w..*.._x.<....M`..gi.s;]...?.bj....rA...h...[2....7..PE...
..?.. ...1.......y..].).j&D@.^...v.a/...n.2...G...&..3....<2
....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE= HTTP/1.1

Cache-Control: max-age = 518191

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 06:43:19 GMT

If-None-Match: "57ff2d07-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=512053

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 22:34:50 GMT

Etag: "581cd6bf-1d7"

Expires: Fri, 11 Nov 2016 10:34:50 GMT

Last-Modified: Fri, 04 Nov 2016 18:43:11 GMT

Server: ECS (vie/F2BA)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2016110
3210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
.....n.u..C.rK.......20161103210000Z....20161110210000Z0...*.H........
..........H2V...1L#..0:.#$....$.om..t...tp>LV(^.b...p9..Pg...H.a...
~h.rN.-..cq1D........?B.qD..#!..D...u.7...!KKo....L.u]>f.@.O......C
..}. ]..=1.t..i...? ik.Q...#;p..u).....-......%#...?.HQ.........!...Rk
r.|...5.$=.... T.X....,f..F.2.5.z..|Y..N/...b'7.0..]...?.HTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=512053..Content-Type:
 application/ocsp-response..Date: Fri, 04 Nov 2016 22:34:50 GMT..Etag:
 "581cd6bf-1d7"..Expires: Fri, 11 Nov 2016 10:34:50 GMT..Last-Modified
: Fri, 04 Nov 2016 18:43:11 GMT..Server: ECS (vie/F2BA)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0........P5V.L
.f........=.U..20161103210000Z0s0q0I0... .........Q..2...}Q......b.U..
...P5V.L.f........=.U......n.u..C.rK.......20161103210000Z....20161110
210000Z0...*.H..................H2V...1L#..0:.#$....$.om..t...tp>LV
(^.b...p9..Pg...H.a...~h.rN.-..cq1D........?B.qD..#!..D...u.7...!KKo..
..L.u]>f.@.O......C..}. ]..=1.t..i...? ik.Q...#;p..u).....-......%#
...?.HQ.........!...Rkr.|...5.$=.... T.X....,f..F.2.5.z..|Y..N/...b'7.
0..]...?...
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:30 GMT

X-Varnish: 206488259 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 5
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= HTTP/1.1

Cache-Control: max-age = 432038

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 10:05:24 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=377941, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 07:30:43 GMT

Expires: Wed, 9 Nov 2016 07:30:43 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016110
2073043Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..=x..vI`.a}.....*....20161102073043Z....20161109073043Z0...*.H.....
...........X.~.......cNyt.......E.^...</........ .C.7.r. .. ..:.I.?
6.9.<.2..g|....M.....p.G...gX. ;yb.V....{.......fX.n8..cR.`m.x*..I.
[........>.3l...uP....3.H...$.~.4....Q.O...`........Oi~..SsE4"...G.
,..l...j..]R..D.?/X.. i....]T...tg..z......).wL...{..6.....pu>.....
0...0...0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2
006 VeriSign, Inc. - For authorized use only1E0C..U...<VeriSign Cla
ss 3 Public Primary Certification Authority - G50...151124000000Z..161
214235959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Sy
mantec Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responde
r Certificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m
.0Q..^f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.
Z.C.f.V...$7............G.D.....@T{.....|...msV...{.q...2..y..........
...".u.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0.
...TH.cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0
c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......
0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0..
. .....0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c
.K.... *.0...U.#..0.....e......0..C9...3130...*.H.................
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= HTTP/1.1

Cache-Control: max-age = 487662

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 01:30:20 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: s2.symcb.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=384805, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 09:26:17 GMT

Expires: Wed, 9 Nov 2016 09:26:17 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016110
2092617Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..~.Joo....?.eM:......20161102092617Z....20161109092617Z0...*.H.....
........Lw....UP...-T=....<.H...j.5....../.wx./m..|.'..W(...=Ujz...
yWn{k.....J.F.5W0. .RVr..3{.........(JO...xk.Wh....vI..C..1r......8..J
2.$...&.......,...X.i...0..l.....?..m..' .=n...K.6.6...~b..D..{s5....P
.......H"V..9T.G.T .. ....to....^..'.....$...MS\^..7.z.......0...0...0
.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...151124000000Z..161214235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..
A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V..
.$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.
p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.
Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H.
..E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http:
//VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0.
.....0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.
0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:14 GMT

X-Varnish: 206487045 206485799

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 3
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Cache-Control: max-age = 86400

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT

If-None-Match: "8017f9a85f10d21:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.download.windowsupdate.com

HTTP/1.1 304 Not Modified

Content-Type: application/vnd.ms-cab-compressed

Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT

ETag: "8017f9a85f10d21:0"

Cache-Control: max-age=604800

Date: Fri, 04 Nov 2016 22:34:50 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2
HTTP/1.1 304 Not Modified..Content-Type: application/vnd.ms-cab-compre
ssed..Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT..ETag: "8017f9a85f1
0d21:0"..Cache-Control: max-age=604800..Date: Fri, 04 Nov 2016 22:34:5
0 GMT..Connection: keep-alive..X-CCC: RU..X-CID: 2..

GET /gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw== HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Oct 2016 06:16:22 GMT

If-None-Match: "4a49c69908e933f536cd8546fd48854f6c2b3f7b"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:48 GMT

Content-Type: application/ocsp-response

Content-Length: 1570

Connection: keep-alive

Set-Cookie: __cfduid=dd54cb12f4cf270e57e9576c0a18640351478298888; expires=Sat, 04-Nov-17 22:34:48 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 19:32:48 GMT

Expires: Tue, 08 Nov 2016 19:32:48 GMT

ETag: "45aeec04cf5f75fd5535651bd4cd9a873159ef92"

Cache-Control: public, max-age=334680

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb891212d1401a-SOF
0..........0..... .....0......0...0.......M........u....%...G..2016110
4193248Z0o0m0E0... ..........M.=......r......{.....a....)S...};..@..|.
.........q."W....20161104193248Z....20161108193248Z0...*.H............
..".....d.6..2V/.B.{........*"8_l..!..Yt...t}.7.....1............TS!v.
_.......<c.../...m..5SU.6.B.Y..\.p..&....H...`.O-A..*[-.........VT}
.....@C......y...i....O.Q.E...7...<D2..j..M@.9 ..R...1./..~......v|
.1....AE..4.} .]#...:..........sz5.W..z...;.....~rb0....K0..G0..C0.. .
......*'....?...F$0...*.H........0f1.0...U....BE1.0...U....GlobalSign 
nv-sa1<0:..U...3GlobalSign Organization Validation CA - SHA256 - G2
0...161019091216Z..170119091216Z0..1.0...U....BE1.0...U....GlobalSign 
nv-sa1.0...U....2016072511411M0K..U...DGlobalSign Organization Validat
ion CA - SHA256 - G2 - OCSP Responder0.."0...*.H.............0........
.C..0j..R........0.".e.&.6'.d..._.....8...Y..../..z..-hi.k.......D....
.....u..>h....T2..~..*;...v.^.!d.......8.p.e..me...>..V...l...P.
6.V..G..;X.......12U.)D.E(ldQ...67..@......l...A.>l......m..e;.....
n.~..Wb.?..gE.......a.KM.F...}.qo;S...`/..s....6....G.a........0..0...
U.......M........u....%...G0...U.#..0.....a....)S...};..@..|0... .....
0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.
com/repository/0...U...........0...U.%..0... .......0...*.H...........
......v.bV.......)...c..}.....y=...........L.G%...N.<...8Qi..Y.....
......\.fd-.<V=.;0".4..h:v*j..N<M..*...i.Hz{?..[....ML..I.Y....r
.x.n.dS...J......d.JXT..:..P..B..~.KD....b..&..........."..oELo..I
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:14 GMT

X-Varnish: 206487057

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: MISS
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "bb4969ca5216e65f52a965c1ad15f69b:1478298631"

Last-Modified: Fri, 04 Nov 2016 22:30:31 GMT

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl
0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equi
fax Secure Certificate Authority..161104222300Z..161114222300Z0,0....%
...020514181157Z0.....3..020515130611Z0...*.H............Z.Ry.&R...$.?
. rLL*&,.......w2....4......W......:K..=iY..]...n.@P..M>...X.g.....
..j.....^...I.;b=WH.!.... ......%..0...7.E..,...HTTP/1.1 200 OK..Serve
r: Apache..ETag: "bb4969ca5216e65f52a965c1ad15f69b:1478298631"..Last-M
odified: Fri, 04 Nov 2016 22:30:31 GMT..Date: Fri, 04 Nov 2016 22:34:5
1 GMT..Content-Length: 325..Connection: keep-alive..Content-Type: appl
ication/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equi
fax1-0 ..U...$Equifax Secure Certificate Authority..161104222300Z..161
114222300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H.......
.....Z.Ry.&R...$.?. rLL*&,.......w2....4......W......:K..=iY..]...n.@P
..M>...X.g.......j.....^...I.;b=WH.!.... ......%..0...7.E..,.....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI= HTTP/1.1

Cache-Control: max-age = 356574

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 10 Oct 2016 12:54:45 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1612

content-transfer-encoding: binary

Cache-Control: max-age=479257, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 11:42:05 GMT

Expires: Thu, 10 Nov 2016 11:42:05 GMT

Date: Fri, 04 Nov 2016 22:34:48 GMT

Connection: keep-alive
0..H......A0..=.. .....0......0..*0......jwG.8s...r:ts.0.:.I...2016110
3114205Z0s0q0I0... .........H/..O.4..{.......:Q...l..`.....>.t c...
Y...64....&i.V.l..q2....20161103114205Z....20161110114205Z0...*.H.....
.........n..s.G...G.f..[H&Y ......h.......k..WF.......WB..*.k....P...O
.iO...V1p-.oQ...S\..l;8..o,.pg.g}..Eh.:. *.kN$..C...G.1g.._.........i.
.Oy~...d.2..V(...`......I@.......=..P'.}.w.6....5...cJ..."......!.]...
k..u.q......Ry..E.....J..}z......n%`.??B/.\.'V...^(x.$...q0..m0..i0..Q
.......h`(V......*....R0...*.H........0..1.0...U....US1.0...U....thawt
e, Inc.1(0&..U....Certification Services Division1806..U.../(c) 2008 t
hawte, Inc. - For authorized use only1$0"..U....thawte Primary Root CA
 - G30...151124000000Z..161214235959Z0..1.0...U....US1.0...U....thawte
, Inc.1(0&..U....Certification Services Division1503..U...,thawte Prim
ary Root CA - G3 OCSP Responder 40.."0...*.H.............0............
........Zs.8..W.D..c...H.....p.4I.........n..E...T.3...):w].s\`..t2...
.....G.Gj|w).~i18J`....D....'t..e&q.Ga]>tw...0s.|I.R..!o.-.....G.. 
F-.s.......O..7_p9.:.............^..i..}.K..S3.1.9Z..N|w...u...Ay.*|%.
...y.nU..U.q.y.y. ....\.w.j........Cu{.!k............0..0...U.%..0... 
.......0... .....0......0...U.......0.0...U...........0 ..U....0...0.1
.0...U....TGV-C-650...U......jwG.8s...r:ts.0.:.I.0...U.#..0....l..`...
..>.t c...Y.0...*.H...............A...../W.....x.V.Km.H7Q.[..(..i..
Y.........Ì....eI..j...|..O...k....X>r/{..\h.<..N.G...........
Y.8..@i`..>..W...?..{...^G.)0S.>;..;4a#..)(.O{..t.h.8...z.'.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU= HTTP/1.1

Cache-Control: max-age = 360742

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 10 Oct 2016 14:02:11 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: tg.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1451

content-transfer-encoding: binary

Cache-Control: max-age=516299, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 21:57:32 GMT

Expires: Thu, 10 Nov 2016 21:57:32 GMT

Date: Fri, 04 Nov 2016 22:34:48 GMT

Connection: keep-alive
0..........0..... .....0......0...0......|.....Q.......Uh..z...2016110
3215732Z0s0q0I0... ........U..2....i.*Y......[K.. .5...80.pz...v......
...8U.h.....v^yPu....20161103215732Z....20161110215732Z0...*.H........
.........Hr..9DL.&o....$c'i k4......T-.q.J...:"@.\.;{Fs...l...>....
.X(.J..M.7...*...).\.S...#vzE...].....:......2...VD..;.T......y..(.Ax.
....."\.a\..@"...."....o 'R..6.......h..Y.WbfB.U1'...c.....}.P-...eLL.
....o.:.D..%.d....wi`m&.h.... .....hqr.... 3:3$.sz.'......0...0...0...
.......e......L.B......0...*.H........0C1.0...U....US1.0...U....thawte
, Inc.1.0...U....thawte SHA256 SSL CA0...160829000000Z..161127235959Z0
O1.0...U....US1.0...U....thawte, Inc.1)0'..U... thawte SHA256 SSL OCSP
 Responder0.."0...*.H.............0................#.....]......F#...Q
...b:k.._n.X..!a.;<..a.......c....|.OsP..f..p.2r"2c&...8.:>vq...
......2P..U....r..2.."N.!.gN....8.Y......D2.zF......Ln...Z..J..)..B{.1
.p#|...e...$.A{...n.B.....o......L1...g...].......$cpYK.vC.D=.N..F2..j
...=.....Yi.......u..r...........0..0... .....0......0"..U....0...0.1.
0...U....TGV-D-17700...U.#..0... .5...80.pz...v.....0...U......|.....Q
.......Uh..z.0...U.......0.0...U.%..0... .......0...U...........0...*.
H.............C..7...X}.(.w9 9..*9.0x^Q.h....o. ..J...B.dc.6.%a_^?Z...
8V.....O.aMh..I...1u.......v.VE7..h....t.o.m.=......U.@.V..'......v...
.4.......!.xV.es.....\......eM...C.|....$..I...-.. ...n.c*......Tz..6T
..gU..XQ.^....P.LB..H....y.o}.i...I.......5...j!.g.D's........
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:08 GMT

X-Varnish: 206486611 206485799

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: subca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1651

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: MISS

Server: NetDNA-cache/2.2

X-Cache: HIT
0..o......h0..d.. .....0.....U0..Q0..-........0~1.0...U....PL1"0 ..U..
..Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"
0 ..U....Certum Validation Service..20161104222830Z0r0p0H0... ......y.
..bOm..(y.Y6B...}n...C..m.....i..J.`.:........@.eq_..(....(....2016110
4222830Z....20161111222830Z..0.0... .....0....0... .....0..0...*.H....
.......=.$...../.\J.!..b3` q..Dd.}M.u.p.s..b.......[g...=V....@...Y_0.
..?D.<..pB....Dz..bQ.j...........`O.Q...g.$...........*..9...$...R.
e#/v....'...(..e......1 .)P{.;Fe...G...>.n.(..7... .{.n.".*hOF.-...
.I....h}...b.7NF..c.h..<P.\...N.h.&. ......62.....B.....n......0...
0...0............Y\T..f..Y....HV0...*.H........0>1.0...U....PL1.0..
.U....Unizeto Sp. z o.o.1.0...U....Certum CA0...160107125922Z..1702061
25922Z0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Ce
rtum Certification Authority1"0 ..U....Certum Validation Service0.."0.
..*.H.............0..........3..>......]{7..\...$vl.....V......T...
-.:.....y..'...X..}.fA\...._.Uxl6.ti %.SS..#. Z.5.G"..S.....)Q...!..P.
...~0..32...Bmd...%.2...D.....J.........6....O.u..vm.l..V.'.L.4.._....
\.eK...MI.F.;H.;..%...KZ...H;e ..9.2..A.b......F.T..._........DY2...2Z
#L.D0)........0..0...U.......0.0...U.......L.oh.....2......|.=0R..U.#.
K0I.B.@0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certu
m CA.... 0...U...........0...U.%..0... .......0... .....0......0...*.H
.............0.r._(...,.QowB....:......p.....ju.:..-."...e.......Y.b..
..<.[..m...qO.A.}....n^..w...=.f...]..mR....j..5...C.(....:a.f.
<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: subca.ocsp-certum.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1663

Connection: keep-alive

Content-transfer-encoding: binary

X-Cached: HIT

Server: NetDNA-cache/2.2

X-Cache: HIT
0..{......t0..p.. .....0.....a0..]0..-........0~1.0...U....PL1"0 ..U..
..Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"
0 ..U....Certum Validation Service..20161104223038Z0r0p0H0... .......:
L..!..O'...Q.)..&....v....$.........7Fu......G...dR.oz5I..H....2016110
4223038Z....20161111223038Z..0.0... .....0....0... .....0..0...*.H....
.........b...$:..........5. ...F.bm08..Y x.).h..|W.....g.y(.....}....w
......ha.Oi..I...[c?:>c.....q....m5:.[.UIHZ.#....oO$..W.....x,.OtF\
..n<..../.U.(....3.S..Kc;%L.&....)..6..os.....b...^. ....#3\..=e..[
.(123...f.~......T....i.0(5...6.L?K&....l.....|jEW.?.W.........0...0..
.0..........x....4P^..o.@oz.0...*.H........0~1.0...U....PL1"0 ..U....U
nizeto Technologies S.A.1'0%..U....Certum Certification Authority1"0 .
.U....Certum Trusted Network CA0...160107130439Z..170206130439Z0~1.0..
.U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certific
ation Authority1"0 ..U....Certum Validation Service0.."0...*.H........
.....0..........AB...I....z..#U......oD.L.....UX....j.....S.K......".&
gt;w.;.r8....C...Zc...U.}%.....@Ff..`.&.j.`.......ci.Io........pW.....
......#.s............tR@...N.......L....U..t.>su...OyH.E...v...r.].
"m..7.... ....@.....>.X......M.P@......./.......k...O....@v7.d.....
.......0..0...U.......0.0...U..........Lw..l..n..n...~.0...U.#..0....v
....$.........7Fu.0...U...........0...U.%..0... .......0... .....0....
..0...*.H.................Rg.....O~y.G G...XJ..S.e.Z0y.h..Np8.=&.P.?..
..R...t..>.2........P.......l}..;=c....@C..9..[..^.?:.yFSu.r.D.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0= HTTP/1.1

Cache-Control: max-age = 588368

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:31:11 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: sv.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1611

content-transfer-encoding: binary

Cache-Control: max-age=541165, public, no-transform, must-revalidate

Last-Modified: Fri, 4 Nov 2016 04:50:17 GMT

Expires: Fri, 11 Nov 2016 04:50:17 GMT

Date: Fri, 04 Nov 2016 22:34:50 GMT

Connection: keep-alive
0..G......@0..<.. .....0.....-0..)0......H.S.......J.?x.7T..a..2016
1104045017Z0s0q0I0... ...........C%.......`M.....B...;S.y3..}... .....
rf..*.!...:<X..2 .......20161104045017Z....20161111045017Z0...*.H..
............P..71O.].~..?l.(s'yVNS]....A-..q..fq.N..7..."..g..9e.Sn7..
.J{..U.s.......P.U S....I.x.o.m.&.P.a.;..&.Z...~@?.9N.l.{4.{k.4.a..Y..
p.. yw...v......!.G#...'.Fq!.(......!....P...2..U.......\....5...T.N.b
'<Y.#M..'V.?...`.....V.1.2...y......>L...i|.....9`y.to1d....p0..
l0..h0..P.......jVl_wg...'.i....0...*.H........0.1.0...U....US1.0...U.
...Symantec Corporation1.0...U....Symantec Trust Network100...U...'Sym
antec Class 3 SHA256 Code Signing CA0...161002000000Z..161231235959Z0A
1?0=..U...6Symantec Class 3 SHA256 Code Signing CA OCSP Responder0.."0
...*.H.............0............y.....l..f.......m./].j..mysU[d......:
..!...9......-._k..V.%.B'...'..e.S.....>....3..3..?../.hO#.c.L.....
..T...<,..-....Bt...U..G.A%|..E..y=jf....%.Y*..x.b..F...'~.,.g6....
..?..@e.v.|!...R..8....:.N..,;zG.WN..{\c.Q.V!..l.....!h..d...T..Ik....
Nu.S.WK"...........0...0... .....0......0"..U....0...0.1.0...U....TGV-
D-22120...U.#..0....;S.y3..}... .....rf0...U......H.S.......J.?x.7T..a
0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://VVV.sym
auth.com/cps0*.. .......0...  hXXp://VVV.symauth.com/rpa0...U.%..0... 
.......0...U...........0...*.H................a..).B.>@.`...-.1..0.
.LJ.(S...s...U.'.;...N..Kp[..... B...&...K.|K..xd.....db....."\2..J...
...l.....U.I..t C.8B...B.... .....v.!#.1.v7$..j......6>.....j.7
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys= HTTP/1.1

Cache-Control: max-age = 444549

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 13:33:22 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: sf.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1725

content-transfer-encoding: binary

Cache-Control: max-age=386656, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 09:55:44 GMT

Expires: Wed, 9 Nov 2016 09:55:44 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0.......].[ .A.|1.rC_H.5F....2016110
2095544Z0s0q0I0... ...................F....0.yV......{&.K......&......
.L@......zW.Et.......20161102095544Z....20161109095544Z0...*.H........
........L;.;..*-...6......T...P.4..%?.aS@"kD...=7..<.|t.|.H..d.'..8
p......,.....y.j.._.0..G$......d.....\.iP.(.3^.......a.K..k/.....vE.m.
>..AW......r.....b...0...P.....)..M.Cp....G.....XG.Q....}o......km7
...B..9.....{....L.v.{p.9....V.}.]w.1C.n-...:..".I{....^ ....0...0...0
...........3..-......F....0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Code S
igning 2010 CA0...160928000000Z..161227235959Z0..1.0...U....US1.0...U.
...VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSign 
Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0.....
.....0CTS.....D7.=.s/..|..P...mS.....,.,).?C..r8.H...]....R.&....#..}.
[G8C.|P.Z...[........Y.m..5...#.{yp^d;..^.=c~}P5.....=0...U..."!j.1.(.
Q...n....O3.-:.R.;..A...............}.......JN..1E....I..!.y.:u.Jw..S.
.....8.s..P..d........ ..t.u......X.cM...N:."a ...........0...0...U...
.0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign
.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. 
by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U......
..0... .....0......0"..U....0...0.1.0...U....TGV-D-21700...*.H........
.....h.S...i..v...l.p,'JO....*.mGF`...(..MU|.vn.....*.^.2..._.$..j
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:08 GMT

X-Varnish: 206486617 206485799

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 2
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT

If-None-Match: "200da-5b6-4eb453c33260e"

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Date: Fri, 04 Nov 2016 22:34:45 GMT

Etag: "200c0-b1c-53fb55344ca83"

Last-Modified: Tue, 25 Oct 2016 19:15:02 GMT

Server: ECS (arn/45CB)

X-Cache: HIT

Content-Length: 2844
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..161025180751Z..17012
0180751Z0.._0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..1004
14175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....10021
6203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208
175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...1101141
62156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0
.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...1
20111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..10
0414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101
208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..1103
02154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..10041
4175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714
160903Z0....'s...130123162633Z0....'....130904190524Z0....'....1310242
14319Z0....'....140129172435Z0....'....140129172453Z0....'....13102421
4310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155
638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...1506031846
05Z0....'k...150603185020Z0....'k...150603185058Z0....'k...15060318513
1Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909
Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:19 GMT

X-Varnish: 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: MISS
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1

Cache-Control: max-age = 547348

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 21:12:41 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=512823, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 20:57:28 GMT

Expires: Thu, 10 Nov 2016 20:57:28 GMT

Date: Fri, 04 Nov 2016 22:34:45 GMT

Connection: keep-alive
0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...2
0161103205728Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5
..........^.3@..cL.1.......20161103205728Z....20161110205728Z0...*.H..
............?....eGB.!...w.}d..5y..!3P..j...1oL..v.......8&...8.i.].4.
.Z.?..<............Kh.....4.LT%.%Jh ..../.....u.s4QP54.}.5.].b.5.}w
..%...<...9y..Lp*].........n1..Nz<..Hc..P....................P.L
.$.}......,.....a$..._C..7k.s.p...VS^P.?@...^......l......Q.9RZ..z...#
0...0...0..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0.
..U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms
 of use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class
 3 Code Signing 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U...
.US1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U..
.2Terms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3Veri
Sign Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H............
.0..........&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m..
....@U...T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{
W. ....J].M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a..
.dd..*o..&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A......
.......0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........h
ttps://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=Veri
Sign's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0...
 .......0...U........0... .....0......0"..U....0...0.1.0...U....TG
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= HTTP/1.1

Cache-Control: max-age = 363986

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sun, 17 Nov 2013 16:06:48 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1452

content-transfer-encoding: binary

Cache-Control: max-age=404268, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 14:50:27 GMT

Expires: Wed, 9 Nov 2016 14:50:27 GMT

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0..........0..... .....0......0...0.........Yt...........z.(...2016110
2145027Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.%...0a.. ...M|......20161102145027Z....20161109145027Z0...*.H........
.....$...4.x..a .*$=v<.g..t.......]..9.U:"......!o.a....vK.D....%..
...%...9..._'.....Y........_<m..H..;......2 .b..1....#;.&aX...V..x.
...l-....*..ed.z...*P3.E..t......[. ..y..x...U.....'l&.;..$....4..I.M.
...ULHX...J..=...0.x.$W38e...I..;7/ .^..-....:......u.B......0...0...0
..2.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....Ver
iSign, Inc.1705..U....Class 3 Public Primary Certification Authority0.
..151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corp
oration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PC
A - G1 OCSP Responder Certificate 40.."0...*.H.............0..........
K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.b
y.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?.
.....g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.
......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U.
...0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/
cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...
U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H...
.........o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd..
......#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`
8......
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY= HTTP/1.1

Cache-Control: max-age = 512217

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 09:17:20 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 5

content-transfer-encoding: binary

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0....HTTP/1.1 200 OK..Server: nginx/1.4.7..Content-Type: application/o
csp-response..Content-Length: 5..content-transfer-encoding: binary..Da
te: Fri, 04 Nov 2016 22:34:46 GMT..Connection: keep-alive..0....>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1452

content-transfer-encoding: binary

Cache-Control: max-age=557368, public, no-transform, must-revalidate

Last-Modified: Fri, 4 Nov 2016 09:20:23 GMT

Expires: Fri, 11 Nov 2016 09:20:23 GMT

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0..........0..... .....0......0...0.........Yt...........z.(...2016110
4092023Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20161104092023Z....20161111092023Z0...*.H........
........>@..W..=vlg..........Vy...m......wZ !Zl..../.z&..z.:.1.....
.k.....c).....%..0...8....!li.~..w\.y..W...)F.....J......|...@..w1..C.
IX........h...m[....v....o.i~.GE.'A:.......... ..... l.....cv.... ....
.....O.l.E..S.dx9....bxV.,.M.#m......AF.......o.6..~......0...0...0..2
.......@1Kyh.i.L....p..0...*.H........0_1.0...U....US1.0...U....VeriSi
gn, Inc.1705..U....Class 3 Public Primary Certification Authority0...1
51124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corpora
tion1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PCA -
 G1 OCSP Responder Certificate 40.."0...*.H.............0..........K..
.8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.by.z
..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?....
..g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g....
...gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U....
0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps
0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U..
......0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H......
......o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd.....
...#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`8..
....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE= HTTP/1.1

Cache-Control: max-age = 589790

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 20 Nov 2013 09:32:32 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 5

content-transfer-encoding: binary

Date: Fri, 04 Nov 2016 22:34:47 GMT

Connection: keep-alive
0....HTTP/1.1 200 OK..Server: nginx/1.4.7..Content-Type: application/o
csp-response..Content-Length: 5..content-transfer-encoding: binary..Da
te: Fri, 04 Nov 2016 22:34:47 GMT..Connection: keep-alive..0....>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Cache-Control: max-age = 435806

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 11 Oct 2016 11:05:46 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=401349, public, no-transform, must-revalidate

Last-Modified: Wed, 2 Nov 2016 14:00:49 GMT

Expires: Wed, 9 Nov 2016 14:00:49 GMT

Date: Fri, 04 Nov 2016 22:34:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...2
0161102140049Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5
........M.s.Q~...@?j.......20161102140049Z....20161109140049Z0...*.H..
.............D..#i.F.Z....faQ.#...SP...n.~.....b.. ...J2e4...U.yC.....
.E...g`6...7........W.....i.G.v...H.8.(.......T .).A\..Kd.q....].OK...
zrrz.Y...4......dmV....,..G....cW....r......._...X3..!..`......*...S,.
cC...1..;..._yN?Y....F2n=0...G..z..J)"{"~..%^!...5IJ.L......#0...0...0
..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
...&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m......@U...
T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. ....J]
.M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd..*o..
&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.............0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-D-21870
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Cache-Control: max-age = 584393

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:26:54 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=486074, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 13:32:39 GMT

Expires: Thu, 10 Nov 2016 13:32:39 GMT

Date: Fri, 04 Nov 2016 22:34:51 GMT

Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016110
3133239Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..R...%V.......K3.....20161103133239Z....20161110133239Z0...*.H.....
...........o.2.s.j).H.'8..`.?..b...,\...Qj..... . .f...@...:@f....LPq.
..=D.....W....././U.3b..!.... ......v..9/.2>......8y.Z0fB..(...)*oz
......v.b. ...K...)_..........}#......f..d.P... ...U.e./...N%q.1.=....
A_.../.~..~..36S\}.......n...,.VMp.4.xaC.c....W.O=~.W........0...0...0
.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...151124000000Z..161214235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..
A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V..
.$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.
p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.
Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H.
..E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http:
//VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0.
.....0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.
0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ HTTP/1.1

Cache-Control: max-age = 339923

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:41:21 GMT

If-None-Match: "c06e9a4e33eec9dd813b8faff15397229f914d2a"

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg142.ocsp.omniroot.com

HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1746

Last-Modified: Fri, 04 Nov 2016 22:16:08 GMT

ETag: "5fc52ba3045cb8822c18fe74c1700365587a44c6"

Cache-Control: public, no-transform, must-revalidate, max-age=339695

Expires: Tue, 08 Nov 2016 20:56:23 GMT

Date: Fri, 04 Nov 2016 22:34:48 GMT

Connection: keep-alive
0..........0..... .....0......0...0......\r...Ev.C..*....omJ...2016110
4221608Z0w0u0M0... .........-R...P:.B...9...0Q.......sw....KM...3..r..
.C...X.<1ya..w.2..^.?....20161104221608Z....20161108221608Z0...*.H.
............}bkI.yrT......u....s..[.......V.gc6..Q2.CZ.....2......5...
{.r..p....~}...s..-.V=..dK...rg.o"SS...8]...4.....i....{?U[.X.=)ry..U.
.&o..4..7...$.u.{....4.#.........X..v..G.j..f.=..._........@.....~.. .
..`h3;/.V.Z*.'........?.....b....L.TA....../....Oe0...dX.A....0...0...
0...........1....n.SsnC.K.]I.w90...*.H........0..1.0...U....NL1.0...U.
...Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cybertru
st1.0,..U...%Verizon Akamai SureServer CA G14-SHA20...160407064154Z..1
70407064154Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Verizon Ent
erprise Solutions1.0...U....Cybertrust1%0#..U....vassg142-OCSP Respond
er 20160.."0...*.H.............0.........w.;..Eu..'f.c^....Qe.O...U...
..d.\?.....S.r'g.d..ES.NA.t....<.....#?.."...*Pm.<..s........v..
.<....8......A@.....7h...r$.T..8=......\....>......z=t3?(.....i.
>t.^.....]7.9..j.E. ....{.$w..Y,...hf..6......L._9,.....i...S...)/.
."^.K.O...bb^....V....'p...'V..........H0..D0... .....0......0L..U. .E
0C0A.. .....>..0402.. ........&hXXps://secure.omniroot.com/reposito
ry0~.. ........r0p06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142
.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.der0...U.....
......0...U.%..0... .......0...U.#..0.......sw....KM...3..r.0...U.....
.\r...Ev.C..*....omJ.0...*.H.............l/0j.Z.z.......n-..2.?.e.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg= HTTP/1.1

Cache-Control: max-age = 471678

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 28 Nov 2013 01:44:29 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: evsecure-ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=493882, public, no-transform, must-revalidate

Last-Modified: Thu, 3 Nov 2016 15:42:58 GMT

Expires: Thu, 10 Nov 2016 15:42:58 GMT

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016110
3154258Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13...*.m7..o..|.........20161103154258Z....20161110154258Z0...*.H.....
...........b.B..... .7..n...].......q...X.[...Nb............".9..z.M.C
v#I....cbZ.,BW...$G....&{...9q...h[[....#...`.. ...VC.E.>.j=......s
..]....aJ..l......).2.....s......Z.x.W..2.F...OY..,.\.T...8......1....
.....f.k.N.R.=......t..j...H..V.}.....or.]..*.....cm.........0...0...0
.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...151124000000Z..161214235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..
A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V..
.$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.
p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.
Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H.
..E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http:
//VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0.
.....0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.
0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: yandex.ocsp-responder.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1548

Connection: keep-alive

Keep-Alive: timeout=5

Content-transfer-encoding: binary

X-Cached: MISS

X-Cache: HIT
0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U...
.Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..201611
04213325Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M..
."[.w..2............20161104213325Z....20161111213325Z..0.0... .....0.
...0... .....0..0...*.H.................... 7..m...w{......'`.%.%.....
$...H.y.qTsGy..6....q%].=Q ....8;..~..ir..m)..yO..y...D#..yS......y...
*..m.....}L5......T.5O5.........lR..d)..1.GV?....I. R.{,.p..t....)P...
.H.,.!*..\N.eB/.....;.S]Kx.....y....4.p.0....m/...._4$4.k0E.=..G...J;x
.w(<.X........0...0...0..........F.......4..or"<i0...*.H........
0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Au
thority1.0...U....Yandex CA0...161027084144Z..170125084144Z0U1.0...U..
..PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation S
ervice0.."0...*.H.............0..........&@.L)=DbS.4...v.....v..U...1V
f.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd
..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H..
.B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..j
i...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\......
.N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0.
.. .......0... .....0......0...*.H................ ....k....@.........
xZ.v..a.0.h.$........K.....V.1'v........&#.H..A.V)*Pe..Q...:\FeJ.s%...
........~:t......;..!...r.~...kxd...;.f>.I..5.....?.....L.uWQg.....
...Ja.wt.U.'*$.J.!1....;`..XN....A...]...>.jO...?.eg...........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: yandex.ocsp-responder.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Fri, 04 Nov 2016 22:34:51 GMT

Content-Type: application/ocsp-response

Content-Length: 1548

Connection: keep-alive

Keep-Alive: timeout=5

Content-transfer-encoding: binary

X-Cached: MISS

X-Cache: HIT
0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U...
.Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..201611
04215138Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M..
.P..m....,.(t.?.....20161104215138Z....20161111215138Z..0.0... .....0.
...0... .....0..0...*.H...........4YBR...%.......F7......aGU...]....g.
2x`D.G[1=.x.rU.!.4W....,.zZ......].0.?....45. c.q...1..H.....a.CEC..I{
......D]y.C..Po.w.V6.$*.".WW....re..KG. Q.......(F>..~$F.@..c.y....
.]p.}..........A(2.r..._..]d...X....C4.........}.g.,.yn. .Sn.6.zg..H..
...._.).T-.......0...0...0..........F.......4..or"<i0...*.H........
0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Au
thority1.0...U....Yandex CA0...161027084144Z..170125084144Z0U1.0...U..
..PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation S
ervice0.."0...*.H.............0..........&@.L)=DbS.4...v.....v..U...1V
f.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd
..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H..
.B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..j
i...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\......
.N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0.
.. .......0... .....0......0...*.H................ ....k....@.........
xZ.v..a.0.h.$........K.....V.1'v........&#.H..A.V)*Pe..Q...:\FeJ.s%...
........~:t......;..!...r.~...kxd...;.f>.I..5.....?.....L.uWQg.....
...Ja.wt.U.'*$.J.!1....;`..XN....A...]...>.jO...?.eg...........
<<< skipped >>>

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:45 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d75bbd26e58b4db91ab3b562b2f8660c91478298885; expires=Sat, 04-Nov-17 22:34:45 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT

ETag: W/"581bdf7e-227"

X-CCACDN-Mirror-ID: rmdccacrl7

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Sat, 05 Nov 2016 02:34:45 GMT

Server: cloudflare-nginx

CF-RAY: 2fcb8905462e401a-SOF
25a..0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust A
B1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External 
CA Root..161104010814Z..161108010814Z0i0!..S{vVO)...iC.".,y..151214155
830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155
830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H.........
.....E3.l.3G...@O..G...G...}..X.X*Q.Xy./,Y...iR.q....3*U.kel.."..]..0|
.( ..nd...0u.f.iu.n....i.......nJ....n.......2..]A....j.av .......(`.u
.....)>.4S......;......I..._.\........&Vw..........d..^...(?gT~...T
i0...a..1-".pf.X....Bgi.?....M...WT.P.....v.8e\\.@h.O..0..HTTP/1.1 200
 OK..Date: Fri, 04 Nov 2016 22:34:45 GMT..Content-Type: application/x-
pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..Set-Coo
kie: __cfduid=d75bbd26e58b4db91ab3b562b2f8660c91478298885; expires=Sat
, 04-Nov-17 22:34:45 GMT; path=/; domain=.comodoca.com; HttpOnly..Last
-Modified: Fri, 04 Nov 2016 01:08:14 GMT..ETag: W/"581bdf7e-227"..X-CC
ACDN-Mirror-ID: rmdccacrl7..Cache-Control: public, max-age=14400..CF-C
ache-Status: HIT..Expires: Sat, 05 Nov 2016 02:34:45 GMT..Server: clou
dflare-nginx..CF-RAY: 2fcb8905462e401a-SOF..25a..0..V0..>...0...*.H
........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust Exter
nal TTP Network1"0 ..U....AddTrust External CA Root..161104010814Z..16
1108010814Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n.B.d..
151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0......z4
.&...&T....$.T.0...U........0...*.H..............E3.l.3G...@O..G..
<<< skipped >>>

GET /UTN-DATACorpSGC.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:46 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=dab2b16133ff7d811973ec1520f4f1a221478298886; expires=Sat, 04-Nov-17 22:34:46 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 01:08:14 GMT

ETag: W/"581bdf7e-22d"

X-CCACDN-Mirror-ID: rmdccacrl8

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Sat, 05 Nov 2016 02:34:46 GMT

Server: cloudflare-nginx

CF-RAY: 2fcb890a32fe401a-SOF
239..0..50......0...*.H........0..1.0...U....US1.0...U....UT1.0...U...
.Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.u
sertrust.com1.0...U....UTN - DATACorp SGC..161104010814Z..161108010814
Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S2........].N..
.E..O0...U........0...*.H..............'H....6..;.;phx.....i....&.....
...F[..c...W.....q..@U...g./.k....Q.YHa.Yr......u...c..Q..T..&.7.~;..u
..v.....K..Y<-.....k.../.J.uNzS$.U..@OO..W....r)~...'..I..GU..~zA..
.,.z2....ry{.Z.......al..(...t....a..X.'........<c._.H<}6.w.....
#... ?Y...=..G..i.L95.d..0..HTTP/1.1 200 OK..Date: Fri, 04 Nov 2016 22
:34:46 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: 
chunked..Connection: keep-alive..Set-Cookie: __cfduid=dab2b16133ff7d81
1973ec1520f4f1a221478298886; expires=Sat, 04-Nov-17 22:34:46 GMT; path
=/; domain=.comodoca.com; HttpOnly..Last-Modified: Fri, 04 Nov 2016 01
:08:14 GMT..ETag: W/"581bdf7e-22d"..X-CCACDN-Mirror-ID: rmdccacrl8..Ca
che-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: Sat
, 05 Nov 2016 02:34:46 GMT..Server: cloudflare-nginx..CF-RAY: 2fcb890a
32fe401a-SOF..239..0..50......0...*.H........0..1.0...U....US1.0...U..
..UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U..
..hXXp://VVV.usertrust.com1.0...U....UTN - DATACorp SGC..161104010814Z
..161108010814Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S
2........].N...E..O0...U........0...*.H..............'H....6..;.;phx..
...i....&........F[..c...W.....q..@U...g./.k....Q.YHa.Yr......u...
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Fri, 04 Nov 2016 19:03:25 GMT

Expires: Tue, 08 Nov 2016 19:03:25 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 12683

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
4070222Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
..0A..%[.....20161104070222Z....20161111070222Z0...*.H.............@K.
n..f.......w3D..%..Z.r*.........c...(..ds.=..)......oii...H.8.<E...
......h.....2=(.oN...l..).......6/......D.......M.\.Y....nu..{........
`......_J.Y...#..Bi.}.|k2....Y.H.t0N.;M..1H.7Y.W....RR. .*j.#K.#62....
h..f..;...&pa.8.h,.aX.A.N`...K.m9..,..@...........


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 03:43:33 GMT

Expires: Mon, 07 Nov 2016 03:43:33 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 154275

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
2190348Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.u...5:......20161102190348Z....20161109190348Z0...*.H...............3
I..-b`O..\..........`.............q......O.g..%6.xo........`.7.d.../..
v.~......I.!X...'._.....\.....L...@HGs..u\...n.TE.g..1..b.^9.A.);.Y`S)
&..y..}..F..N\>.&..~....t.9.{....Y.............*M.?.:.....Ug*^}.a.T
A..tHN_.G.oDL<#../..UUQ..6B...B.R.K........ ......


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCBW8iC8YNRkC HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 13:58:35 GMT

Expires: Sat, 05 Nov 2016 13:58:35 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 290173

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
1070311Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
..../.5......20161101070311Z....20161108070311Z0...*.H.............RL.
...U..WQ..<..@.6*...`-..........6.`..kXh.]w..zk. ....#!...[.L......
.Da|MZ......".Y...%..v...[.......oQ../QL...vH..........J.T?..c.3.dC...
tn.hL.Ps.6..4Q)d[..k.........t...~.hq.n..dc_..Z"K....t,.....9Q......R.
$..s.W.l]kf.}.z......].%>...8.....(.-.b.O...9.....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 02:51:47 GMT

Expires: Mon, 07 Nov 2016 02:51:47 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 157381

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
2190122Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.fb....$.....20161102190122Z....20161109190122Z0...*.H.............|_.
.X].*......p&.........K}......G...K.W.\f..g,".Q0.&..(.......8........c
c.`....`EV....].w..1....|......W..Z8..?R9.'.x.R..:.....h.....a...|."..
....$Lv..........=.(.=..BKuy#.$.,...3%..A....%....!/.#.z...I.#i@.Ni.g.
........W.....gw.$}...V.= ...V....kn......B....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Wed, 02 Nov 2016 12:38:49 GMT

Expires: Sun, 06 Nov 2016 12:38:49 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Cache-Control: public, max-age=345600

Age: 208559
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
2010418Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
..[..D7fZ....20161102010418Z....20161109010418Z0...*.H..............y.
ze.*H...........t`D...2....j. ..0...C..!..j5..r...r..V.3{.......m.j.&Z
... .7.{.!MZd...~:'.)....D.7...muOZ..a.b..L..F...;.m....--..rC$..~.%..
o..a.}.....c...%.......?N..v0|.D..}....#a..|;C..k.5..q.F..L..%u..'..`.
y..J.._uFgzj..... .<hyEv*....6.g.@...8.Z...HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Wed, 02 Nov 2016 12:38:49 GMT.
.Expires: Sun, 06 Nov 2016 12:38:49 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Cache-Control: public, max-age=345600..Age: 208559..0.........
.0..... .....0......0...0......J......h.v....b..Z./..20161102010418Z0k
0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...[..D7fZ.
...20161102010418Z....20161109010418Z0...*.H..............y.ze.*H.....
......t`D...2....j. ..0...C..!..j5..r...r..V.3{.......m.j.&Z... .7.{.!
MZd...~:'.)....D.7...muOZ..a.b..L..F...;.m....--..rC$..~.%..o..a.}....
.c...%.......?N..v0|.D..}....#a..|;C..k.5..q.F..L..%u..'..`.y..J.._uFg
zj..... .<hyEv*....6.g.@...8.Z.......


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 04:58:50 GMT

Expires: Mon, 07 Nov 2016 04:58:50 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 149758

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
2190248Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.#. o..>b....20161102190248Z....20161109190248Z0...*.H.............
.E;`.'{.._$}...ig\.^....].......ux2n..@.j..3..5Ix..Zy"..bc~....2......
...'.........=.=\..C......./eF......K=....B...0../z.....N....^;.e...NO
7!EsBzO....... *U.8.2.<?..F.L/m....6.....^...%/.....v$.*o1..KO...N.
1......'.')_9a(ws;...b9_..i./...L&`k%'.p.[ ..%...HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Thu, 03 Nov 2016 04:58:50 G
MT..Expires: Mon, 07 Nov 2016 04:58:50 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 149758..Cache-Control: public, max-age=345600..0......
....0..... .....0......0...0......J......h.v....b..Z./..20161102190248
Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..#. o..
>b....20161102190248Z....20161109190248Z0...*.H..............E;`.'{
.._$}...ig\.^....].......ux2n..@.j..3..5Ix..Zy"..bc~....2.........'...
......=.=\..C......./eF......K=....B...0../z.....N....^;.e...NO7!EsBzO
....... *U.8.2.<?..F.L/m....6.....^...%/.....v$.*o1..KO...N.1......
'.')_9a(ws;...b9_..i./...L&`k%'.p.[ ..%.......
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 14:10:59 GMT

Expires: Sat, 05 Nov 2016 14:10:59 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 289429

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
1070302Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.CM.{...N....20161101070302Z....20161108070302Z0...*.H.............J^.
.8. .GU...*....=..7O....X.\*..<...IcC...z....Ie;E.>...).....F.kp
....|..2...C.?.....).....dp.....w...........}...Q...).......ll.\...`R#
.E# zJ.[}..d..0.........|tu....LY...?.~!...$.d4Z.I...........,...1..J.
nO#.^...R9.....6\.........Y.T.3f.........S.8....$....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 14:21:58 GMT

Expires: Sat, 05 Nov 2016 14:21:58 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 288771

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
1070030Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.).(.I.0^....20161101070030Z....20161108070030Z0...*.H................
N.].[...=...AL|./....%2. .s.:...y1.....|.A.O<..X..T_....fh..o.....2
hAM....P.&.. ML>.....m......m.......z....JV#.....r..Z.u..P..c._... 
Q...%...$/_...1......r....2.[.j.......IYpa.s .il..-z..&2~..wX.........
..bq....&).....cf!.={....x3.GG.W.67...=......S.. HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Tue, 01 Nov 2016 14:21:58 G
MT..Expires: Sat, 05 Nov 2016 14:21:58 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 288771..Cache-Control: public, max-age=345600..0......
....0..... .....0......0...0......J......h.v....b..Z./..20161101070030
Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..).(.I.
0^....20161101070030Z....20161108070030Z0...*.H................N.].[..
.=...AL|./....%2. .s.:...y1.....|.A.O<..X..T_....fh..o.....2hAM....
P.&.. ML>.....m......m.......z....JV#.....r..Z.u..P..c._... Q...%..
.$/_...1......r....2.[.j.......IYpa.s .il..-z..&2~..wX...........bq...
.&).....cf!.={....x3.GG.W.67...=......S.. ....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11 HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 02:26:35 GMT

Expires: Mon, 07 Nov 2016 02:26:35 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 158894

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
2190208Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.<...k..u....20161102190208Z....20161109190208Z0...*.H.............
........m..c..!..C..N....w.1.........:d&.hq...#.....G'.m.>...Jz.u..
........-...i.|r..7,RY.3.:.....WKH J....By.v.6d...}J...n.[[C...f..0S..
j..56;...n.}...P....97...F(.WBRH..........CY..#9Iv..c...XW....wVm._E..
..I..P{.......'6.u.\4mQNT..X...fp..-.C.q..jv[.huWHTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Thu, 03 Nov 2016 02:26:35 G
MT..Expires: Mon, 07 Nov 2016 02:26:35 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 158894..Cache-Control: public, max-age=345600..0......
....0..... .....0......0...0......J......h.v....b..Z./..20161102190208
Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..<..
.k..u....20161102190208Z....20161109190208Z0...*.H....................
.m..c..!..C..N....w.1.........:d&.hq...#.....G'.m.>...Jz.u.........
.-...i.|r..7,RY.3.:.....WKH J....By.v.6d...}J...n.[[C...f..0S..j..56;.
..n.}...P....97...F(.WBRH..........CY..#9Iv..c...XW....wVm._E....I..P{
.......'6.u.\4mQNT..X...fp..-.C.q..jv[.huW....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Thu, 03 Nov 2016 10:27:55 GMT

Expires: Mon, 07 Nov 2016 10:27:55 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 130014

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
3010227Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.x.L.-.).....20161103010227Z....20161110010227Z0...*.H.............<
;.X.g....S.....$.......#.."b.1Bh..R.....[..G...{y?<.a..........si..
....K7%......'W.f.... !_...]<@..d...<>/<.p....Y_..b...H>
;...E........<...,<.t..;.....-2.u%./......7..0...6...lG|...'...$
6.?l..u.d9vA..~Kq`.....x c..(.>].....H..TC...)ea.......C....... .3I
.......


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 01 Nov 2016 21:41:58 GMT

Expires: Sat, 05 Nov 2016 21:41:58 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 262371

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016110
1130128Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.D.....V.....20161101130128Z....20161108130128Z0...*.H.............B..
..\..=s...$.EO&=.6.. K.?...J.wQ..P....P$..(..b....B\...7.u..m........ 
.l.A......&...n\.  ...=......|@...Z...g....T@N..N....@..{..s.s.-<..
....{'.K...X.k...V8.g.]......Q.......U.(\...N.bp.L....P.....DN...S.PQ.
..0.......Q('..'..)1........c.2..b..h.. ....4.HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 01 Nov 2016 21:41:58 GMT.
.Expires: Sat, 05 Nov 2016 21:41:58 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 262371..Cache-Control: public, max-age=345600..0.........
.0..... .....0......0...0......J......h.v....b..Z./..20161101130128Z0k
0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..D.....V..
...20161101130128Z....20161108130128Z0...*.H.............B....\..=s...
$.EO&=.6.. K.?...J.wQ..P....P$..(..b....B\...7.u..m........ .l.A......
&...n\.  ...=......|@...Z...g....T@N..N....@..{..s.s.-<......{'.K..
.X.k...V8.g.]......Q.......U.(\...N.bp.L....P.....DN...S.PQ...0.......
Q('..'..)1........c.2..b..h.. ....4...

GET /PublicSureServerSV.crl HTTP/1.1

Cache-Control: max-age = 150326

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 20 Nov 2013 09:46:05 GMT

If-None-Match: "2b0037-c0d1-a6553140"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=864000

Content-Type: application/x-pkcs7-crl

Date: Fri, 04 Nov 2016 22:34:47 GMT

Etag: "4029b-51347-5407ce3d0400e"

Expires: Mon, 14 Nov 2016 22:34:47 GMT

Last-Modified: Fri, 04 Nov 2016 17:20:25 GMT

Server: ECS (arn/46BA)

X-Cache: HIT

X-Cntnt-Length: 332615

Content-Length: 332615
0...B0...)...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybe
rtrust Public SureServer SV CA..161104165625Z..161114165625Z0...z0....
..... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I
..101116165848Z0.........,U./...101116173007Z0.........,U.h...10111617
2944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0....
.....,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z
..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..10111619
5619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0....
.....-..4...110315204303Z0........../P....120206141831Z0..........I..@
..120124180322Z0..........JP....110222182509Z0..........Jf/Y..12021314
2815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0....
......YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu.
..120220131416Z0..........^..^..111007192320Z0..........`.w...12021314
4727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0....
......hlG...120213145015Z0..........h.....120130140408Z0............j.
..120110213653Z0...........}....110406160143Z0............$...11040100
5006Z0................110401005536Z0............W...120308151704Z0....
.........h..120228141105Z0................110314145902Z0............`.
..110322142311Z0................110322142551Z0............lb..12011021
3802Z0.............0..130201130700Z0............OB..110321165802Z0....
.........o..110321172720Z0...........g.:..120221183148Z0...........Ud.
..110516131110Z0............h5..120229174140Z0................1202
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:29 GMT

X-Varnish: 206488254 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 4
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:24 GMT

X-Varnish: 206487949 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 3
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 08:39:04 GMT

If-None-Match: "06a163dbd612a346836873636bdef55a96277740"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 21:35:50 GMT

Expires: Tue, 08 Nov 2016 21:35:50 GMT

ETag: "a44b6f2498f2c689d96d5918d635d092ebfa0fcb"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb891095574050-SOF
0..........0..... .....0......0...0.......ue......$I1......dO..2016110
4213550Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
......./N.E.....20161104213550Z....20161108213550Z0...*.H.............
.y..#H....T...A=..R..;*K.V/4.}....O.2........s..x.........].....n....!
...7U.u....LZ.........o..F..b....)....[s.r|L....:6..k...aBh...p.......
$e...vu.'.a.a........xy`3....K..%nB..OS.%..... ...n.=..n..S.E#._.W...`
L@ ..._|f.d...c.K.~0.S!O...'.W69.7......NV.o.)....0...0...0..........H
.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa
1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z..1611
15000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSi
gn OCSP for Root R1 - Signer 1.20.."0...*.H.............0.........ga..
)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU....@...h.3D.
C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#.M.vm.
:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p.6.E. 
..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U.......
....0...U.%..0... .......0...U.......0.0...U.......ue......$I1......dO
0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. ....
.2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.....
.........$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..k,....
f...K....A...a..@...b.qZ....Z......4.L.i...=.C.....0(*................
....1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..P...H.
 .s7..s.~..P..@...S...l..9.....$.....3....P6.'.$...........
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 07:50:34 GMT

If-None-Match: "6b9ba9eca642c891cc02365fc6161341647bd9fc"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 20:07:29 GMT

Expires: Tue, 08 Nov 2016 20:07:29 GMT

ETag: "116835402ed3e6687ea7e1347babccca0ce09762"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb8910e5ad4050-SOF
0..........0..... .....0......0...0.......ue......$I1......dO..2016110
4200729Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
.......DN.BG....20161104200729Z....20161108200729Z0...*.H.............
.w.sqWkRJC#QVx....8N/. R.).vx...'.F.t.g..9{.y.......6%GN...*LU.._n....
8x.....OQ..v..Sx..A....y.*r............?...HE.......#Xj5.E9y....K....q
l..n........3...8......."...GX.B......6..A.d......G>.[..X....<..
....z.n..J....g/>MG2.13.p...pH.G.!...<3X...d....4.&P....0...0...
0..........H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....Glob
alSign nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...1608070
00000Z..161115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U
...(GlobalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.
........ga..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU.
...@...h.3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....
`....#.M.vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....].
.....p.6.E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..
0...U...........0...U.%..0... .......0...U.......0.0...U.......ue.....
.$I1......dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .
E0C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/
0...*.H..............$..L...N.x4..FX.j.u.......;.0..>.C)9........z.
...n..k,....f...K....A...a..@...b.qZ....Z......4.L.i...=.C.....0(*....
................1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._..
.o.B..P...H. .s7..s.~..P..@...S...l..9.....$.....3....P6.'.$......
<<< skipped >>>

GET /rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 08:41:57 GMT

If-None-Match: "682f048b8d31cb3f1cc888edf96fec2777d7e64b"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Fri, 04 Nov 2016 22:34:47 GMT

Content-Type: application/ocsp-response

Content-Length: 1507

Connection: keep-alive

Set-Cookie: __cfduid=d5b92977ed4f654258a2a200a13c712f41478298887; expires=Sat, 04-Nov-17 22:34:47 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Fri, 04 Nov 2016 19:40:47 GMT

Expires: Tue, 08 Nov 2016 19:40:47 GMT

ETag: "9a5e0e2eda739d824031f795d956a4198eca2c4e"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2fcb891136044050-SOF
0..........0..... .....0......0...0...........1.IVp*.@N~.......2016110
4194047Z0n0l0D0... .........\.1n........U.:.yB......Wg...j..Y..-......
.......DN.JU....20161104194047Z....20161108194047Z0...*.H.............
.X{[}...Y.6ab..e....p..b.F..7.F(..\rp....#>......./>........4..0
d.DZ..........).....r6_..>..<.. ...........8...*.h...Gem....&.:.
S.t.....L\.c#=-....*<jn..#V...C.5..%V....\*w.>v..)ih.F.....m`..1
...Lc.9.........!.:..w.T./b_....oXv.QXQ....u....._...7.....A...R....0.
..0...0..........H.j...N... .<i0...*.H........0L1 0...U....GlobalSi
gn Root CA - R21.0...U....GlobalSign1.0...U....GlobalSign0...161007000
000Z..170115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U..
.(GlobalSign OCSP for Root R2 - Signer 1.10.."0...*.H.............0...
......N.......B>.|..S...@.......C.a.C.........V...Cf|G.....,......|
.b..K.T.x<L.K...6Q..zeh.....Zd.n...0km86...\...n..v..O.......9...).
..|...#.....j.......%W..vH`..Z.=..1[.d.y...)..n.&3,Z...#..Q....A.&...i
..r"0.!6.g._..7...&.]..4 .$........IG..sw.....c.J.../.7b.........0..0.
..U...........0...U.%..0... .......0...U.......0.0...U...........1.IVp
*.@N~.....0...U.#..0......Wg...j..Y..-.....0... .....0......0L..U. .E0
C0A.. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0.
..*.H.............s2..o"..2]=~.=..K.D...{n......,hd.....~TKr.R...K..u.
&....lx...^.G...n9.x..~..o.R..:...\I..c<.]I..Ps..uh...<.(..HnJT.
...m..o.f%..'4^.)...z.-...$s.iI......M....B..3y./..3. .]2.......v.-.l.
..,..r.k.{^.OW!.......b.k......_Px'....IF............m.(.~.:...r#t
<<< skipped >>>

GET /pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl HTTP/1.1

Cache-Control: max-age = 6793

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 18 Nov 2013 23:37:31 GMT

If-None-Match: "b61f5b26b7e4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: mscrl.microsoft.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=7200

Content-Type: application/pkix-crl

Date: Fri, 04 Nov 2016 22:34:45 GMT

Etag: "ad925b8a3c1d11:0"

Last-Modified: Wed, 08 Jun 2016 16:35:08 GMT

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

Server: ECAcc (arn/46C8)

VTag: 791539655600000000

X-Cache: HIT

X-Powered-By: ASP.NET

Content-Length: 163018
0..|.0..{....0...*.H........0..1.0.....&...,d....com1.0.....&...,d....
microsoft1.0.....&...,d....corp1.0.....&...,d....redmond1.0...U....MSI
T Machine Auth CA 2..160608162453Z..160616164453Z0..z.0)....=.........
130522112904Z0.0...U.......0).....3........130522112904Z0.0...U.......
0)..M.\.........130522100146Z0.0...U.......0)....K.........13052210014
5Z0.0...U.......0)...........Z..130522100145Z0.0...U.......0).....j...
..I..130522100145Z0.0...U.......0)....q.....q...130522094611Z0.0...U..
.....0).....C....q=..130522055646Z0.0...U.......0)..P.......j...130522
055646Z0.0...U.......0)..c.......:...130522053344Z0.0...U.......0)..[.
.x....F0..130521142635Z0.0...U.......0)..[.......F...130521142635Z0.0.
..U.......0)..`.ii....9...130521142635Z0.0...U.......0)..`.X.....9...1
30521142635Z0.0...U.......0)..[.......F/..130521142143Z0.0...U.......0
).....9....p...130520132837Z0.0...U.......0)..Q.4u....]...130520115050
Z0.0...U.......0).....p....p...130520110806Z0.0...U.......0)...z......
fQ..130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U...
....0)..........e...130520094526Z0.0...U.......0)... K.....p...1305200
94519Z0.0...U.......0)... H.....p...130520094519Z0.0...U.......0)...zF
,....o...130520070955Z0.0...U.......0)..f..E....P...130518074816Z0.0..
.U.......0...\,jN....FD..130402211200Z0...../w....U...130328232900Z0..
.p.R.....G1..130226223400Z0....e......?...130220163500Z0....[......*..
.121221223500Z0...A......."...121206221900Z0...A......."...12120622190
0Z0...A......."...121206221800Z0...A..\...."...121206221700Z0...A.
<<< skipped >>>

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:19 GMT

X-Varnish: 206487540 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /protected/data/serve/config.bin HTTP/1.1

Accept: */*

Connection: Close

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: acgplug.org

Cache-Control: no-cache

HTTP/1.1 404 Not Found

Content-Type: text/html; charset=iso-8859-1

Server:  - Web acceleration by hXXp://VVV.unixy.net/varnish 

X-Cacheable: YES

Content-Length: 348

Accept-Ranges: bytes

Date: Fri, 04 Nov 2016 22:34:24 GMT

X-Varnish: 206487941 206487530

Via: 1.1 varnish

Connection: close

age: 0

X-Cache: HIT

X-Cache-Hits: 2
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html>&
lt;head>.<title>404 Not Found</title>.</head><
body>.<h1>Not Found</h1>.<p>The requested URL /pr
otected/data/serve/config.bin was not found on this server.</p>.
<p>Additionally, a 404 Not Found.error was encountered while try
ing to use an ErrorDocument to handle the request.</p>.</body
></html>...

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 20 Sep 2013 05:02:11 GMT

If-None-Match: "96d8890beb5ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Nov 2016 05:01:26 GMT

Accept-Ranges: bytes

ETag: "82c52e2ac634d21:0"

Server: Microsoft-IIS/8.5

VTag: 438100426000000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:45 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..161101211705Z..170131093705Z._0]0...U.#..0...#4..RFp..@.v.. .
.5..0... .....7.......0...U......:0... .....7......170130212705Z0...*.
H...............j!f......L..W.O...i..4...(cZ...x?y...........-a.N.q...
...........O.$l.....>........]........Y>.....^..99&I..{;a....{.X
.c..........>K.9..lp.....u|..N] .l...;..a...y.q.c .......9....f....
.B..:....).#..x.IN.."s..s.P<b*3!nw.i.....CnWe...gZ .............#6.
._HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: 
Wed, 02 Nov 2016 05:01:26 GMT..Accept-Ranges: bytes..ETag: "82c52e2ac6
34d21:0"..Server: Microsoft-IIS/8.5..VTag: 438100426000000000..P3P: CP
="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAM
o CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content
-Length: 550..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34
:45 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U..
..US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpor
ation1!0...U....Microsoft Time-Stamp PCA..161101211705Z..170131093705Z
._0]0...U.#..0...#4..RFp..@.v.. ..5..0... .....7.......0...U......:0..
. .....7......170130212705Z0...*.H...............j!f......L..W.O...i..
4...(cZ...x?y...........-a.N.q..............O.$l.....>........]....
....Y>.....^..99&I..{;a....{.X.c..........>K.9..lp.....u|..N] .l
...;..a...y.q.c .......9....f.....B..:....).#..x.IN.."s..s.P<b*
<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Dec 2015 18:30:06 GMT

Accept-Ranges: bytes

ETag: "0cb60772f2dd11:0"

Server: Microsoft-IIS/8.5

VTag: 791804826200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 530

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows
 Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p.
...........<.J0... .....7.......0...U......90...*.H..............I.
..MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D....
.....g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F
......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt
.}......X......H.....|d...s..`.8F.l.......R.C........


GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 29 Oct 2013 05:02:50 GMT

If-None-Match: "b8b5df1d64d4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 27 Sep 2016 05:00:38 GMT

Accept-Ranges: bytes

ETag: "773de167c18d21:0"

Server: Microsoft-IIS/8.5

VTag: 279261256600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..160926163316Z..161226045316Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......a0... .....7......161225164316Z0.
..*.H.............&............G.$.-..dc.....7.m..N.`.U......^F.V....%
ej..p4...>.[)0.......Z..v.../..b-.....v.A$......z.k.U....@S.._...I.
........h*@6.)WM..u....I....ew.7...._.....Y...iFWaQ.}....X.........Y.!
..J.j*............<L......L,...Y...c...:.WE..C..Q..|G....j<..z~6
q......


GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 808

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT

If-None-Match: "9c3f3dbaacc4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 06 Sep 2016 05:01:54 GMT

Accept-Ranges: bytes

ETag: "6b18dc9fb7d21:0"

Server: Microsoft-IIS/8.5

VTag: 279107828100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:46 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..160905204847Z..
161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......00... .....7......161204205847
Z0...*.H.............".....s..B#.bK..Hv...m,x..e.ec..j...y....6.e.....
.Cp.....7G.0..AH..A.e......I...j....W.obU0.?.....Q.#.\.t..v.4E.......j
F.Zm....u...P....88.....nC./.._2&.. .h....Q..z{wl.....?...M..'..s[..\M
.t....J.Vb..,G..t....nk._...t.T.c[...kKW&D...#.."9.....X./.w.....%..0.
...K%.H...x.%..'..}.....P.3;.Y...pe z.!...:X..f..r..i1...F...0.......2
.~x.n.R.E...' ..>.)...}GT...>...P.^..]....{..> 2..N.m....!..1
gL..jl@...B..5.o....s..6...d..N.u...|%.q..-../.....(.Xm.X...r9........
...[.DQ.......Y..;.. U.......xu-%*.-....~..$U.../...HTTP/1.1 200 OK..C
ontent-Type: application/pkix-crl..Last-Modified: Tue, 06 Sep 2016 05:
01:54 GMT..Accept-Ranges: bytes..ETag: "6b18dc9fb7d21:0"..Server: Micr
osoft-IIS/8.5..VTag: 279107828100000000..P3P: CP="ALL IND DSP COR ADM 
CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL 
PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 813..Cache-Co
ntrol: max-age=900..Date: Fri, 04 Nov 2016 22:34:46 GMT..Connection: k
eep-alive..0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&.
..,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..1609
05204847Z..161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0.
.....`@V'..%..*..S.Y..0... .....7.......0...U......00... .....7...
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com

HTTP/1.1 404 Not Found

Date: Fri, 04 Nov 2016 22:34:46 GMT

Content-Type: text/html; charset=UTF-8

Server: ocsp_responder

Content-Length: 1668

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha
<<< skipped >>>

GET /pki/crl/products/CodeSignPCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Mon, 16 Apr 2012 23:49:48 GMT

Accept-Ranges: bytes

ETag: "0f6669b2b1ccd1:0"

Server: Microsoft-IIS/8.5

VTag: 438195957300000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 558

Cache-Control: max-age=900

Date: Fri, 04 Nov 2016 22:34:14 GMT

Connection: keep-alive
0..*0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 20
00 Microsoft Corp.1#0!..U....Microsoft Code Signing PCA..111110211944Z
..420416234935Z.7050...U.#..0...%. K].rT....*.....S.0... .....7.......
..0...*.H...............&..%PIu@.....\0KF....0..^.h9=.1jT,5.L....Ed ..
6.......i.6.xva....oX.^f'....s...!......O...h.1a..Ud);.?....J_...Fu...
.<v.zx..t..h.0JU%.nk;..B[4.?&Zm^..M.!.'...w.u.\T..Tr..Ch.[.z:....#.
..T.4Ct.......,...c..}F..U....:..7J...%.#..D6 . ....G..#....T..G;.....
.HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified: M
on, 16 Apr 2012 23:49:48 GMT..Accept-Ranges: bytes..ETag: "0f6669b2b1c
cd1:0"..Server: Microsoft-IIS/8.5..VTag: 438195957300000000..P3P: CP="
ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo 
CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-L
ength: 558..Cache-Control: max-age=900..Date: Fri, 04 Nov 2016 22:34:1
4 GMT..Connection: keep-alive..0..*0......0...*.H........0..1.0...U...
.US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpora
tion1 0)..U..."Copyright (c) 2000 Microsoft Corp.1#0!..U....Microsoft 
Code Signing PCA..111110211944Z..420416234935Z.7050...U.#..0...%. K].r
T....*.....S.0... .....7.........0...*.H...............&..%PIu@.....\0
KF....0..^.h9=.1jT,5.L....Ed ..6.......i.6.xva....oX.^f'....s...!.....
.O...h.1a..Ud);.?....J_...Fu....<v.zx..t..h.0JU%.nk;..B[4.?&Zm^..M.
!.'...w.u.\T..Tr..Ch.[.z:....#...T.4Ct.......,...c..}F..U....:..7J
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;<)?$*%,

71.(5;4=

(203,2$0

/?./,5 <

:>(<<44=3%

8%/<8/?)?/

%/><!8?>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4;

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso\vixih.zel

C:\Users\"%CurrentUserName%"\AppData\Roaming\Mafoso

vixih.zel

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

Explorer.EXE_284_rwx_039E0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;<)?$*%,

71.(5;4=

(203,2$0

/?./,5 <

:>(<<44=3%

8%/<8/?)?/

%/><!8?>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

Dwm.exe_528_rwx_010A0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;<)?$*%,

71.(5;4=

(203,2$0

/?./,5 <

:>(<<44=3%

8%/<8/?)?/

%/><!8?>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

TPAutoConnect.exe_2068_rwx_00550000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;<)?$*%,

71.(5;4=

(203,2$0

/?./,5 <

:>(<<44=3%

8%/<8/?)?/

%/><!8?>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4U

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

conhost.exe_2076_rwx_000D0000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;<)?$*%,

71.(5;4=

(203,2$0

/?./,5 <

:>(<<44=3%

8%/<8/?)?/

%/><!8?>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

conhost.exe_3452_rwx_00070000_00027000:

.text

`.data

.reloc

hXXp://VVV.google.com/webhp

PR_OpenTCPSocket

gdiplus.dll

GdiplusShutdown

ole32.dll

gdi32.dll

: ;2*8.>

3.#70!2)

x#m`a`cmddt-

6 !26!1'1

7"52),,>

;<)?$*%,

71.(5;4=

(203,2$0

/?./,5 <

:>(<<44=3%

8%/<8/?)?/

%/><!8?>!

HTTP/1.1

userenv.dll

del "%s"

if exist "%s" goto d

del /F "%s"

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)

urlmon.dll

cabinet.dll

hXXp://

hXXps://

HTTP/1.

SSSh,4

GetProcessHeap

KERNEL32.dll

SetKeyboardState

ExitWindowsEx

MsgWaitForMultipleObjects

MapVirtualKeyW

GetKeyboardState

OpenWindowStationW

GetProcessWindowStation

CreateWindowStationW

CloseWindowStation

SetProcessWindowStation

USER32.dll

RegOpenKeyExW

RegEnumKeyExW

RegCloseKey

RegCreateKeyExW

ADVAPI32.dll

PathIsURLW

UrlUnescapeA

SHDeleteKeyW

SHLWAPI.dll

ShellExecuteW

SHELL32.dll

Secur32.dll

SetViewportOrgEx

GDI32.dll

WS2_32.dll

PFXImportCertStore

CertDeleteCertificateFromStore

CertOpenSystemStoreW

CertCloseStore

CertEnumCertificatesInStore

CertDuplicateCertificateContext

PFXExportCertStoreEx

CRYPT32.dll

HttpSendRequestExA

HttpQueryInfoA

HttpSendRequestExW

HttpSendRequestW

HttpSendRequestA

InternetCrackUrlA

HttpOpenRequestA

HttpAddRequestHeadersA

GetUrlCacheEntryInfoW

HttpAddRequestHeadersW

WININET.dll

OLEAUT32.dll

NETAPI32.dll

6 6&6/656{6

cGlobal\XXX

nspr4.dll

nss3.dll

SysShadow

kernel32.dll

"%s" %s

/c "%s"

%sx.%s

%sx

Global\{B883D320-21C9-04F9-1D42-79894B2F994B}

C:\Users\"%CurrentUserName%"\AppData\Roaming

{2EF86105-93EC-9282-1D42-79894B2F994B}

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Scan a system with an anti-rootkit tool.
   
2. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   WinMail.exe:2824
   %original file name%.exe:1024
   

3. Delete the original Trojan file.
   
4. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab19E6.tmp (51 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (42552 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Drafts\winmail.fol (560 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.pat (16 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Junk E-mail\winmail.fol (592 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.log (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Sent Items\winmail.fol (592 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml (1924 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.fol (608 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Outbox\winmail.fol (560 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.fol (544 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\tmp.edb (1728 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.log (18592 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edb.chk (300 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735 (558 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.MSMessageStore (99 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735 (968 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ppcrlui_2824_2 (1281 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\WindowsMail.pat (400 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7FE6449A-00000001.eml:OECustomProperty (260 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows Mail\edbtmp.log (3466 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar19E7.tmp (2712 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\tmpbe57d30b.bat (179 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\Nonase\wino.exe (1053 bytes)

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.