MD5: 0d7afef25ce702b284d78e8f9af68dc3
SHA1: 0951aba6d17e4343fb35a9a0d1c780cff02da916
SHA256: e19251503627d63b35fbc7b54eb984d5b78ddbf3c5fb9c49c802087b49bfdffe
SSDeep: 24576:HO VIjbvfktCoPrZ06eH0aGaQ7bl50gOYIgkS/MyNYRSvQfRyYOcFZNwPoWWFV 7:Sv8VrawaiJ0Y7
Size: 1345792 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: Simple.Company
Created at: 2016-10-05 23:56:46
Analyzed on: Windows7 SP1 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

vbc.exe:3204
%original file name%.exe:2800
%original file name%.exe:1172

The Trojan injects its code into the following process(es):

%original file name%.exe:2464

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process vbc.exe:3204 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holderwb.txt (2 bytes)

The process %original file name%.exe:2464 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\pid.txt (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\pidloc.txt (39 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsUpdate.exe (8281 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holdermail.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holderwb.txt (0 bytes)

The process %original file name%.exe:2800 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7C.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7D.tmp (2712 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7C.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7D.tmp (0 bytes)

The process %original file name%.exe:1172 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD6DF.tmp (2712 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD6DE.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1212 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_C0EF0ACA283949F41711EFB55E3F0ABC (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_C0EF0ACA283949F41711EFB55E3F0ABC (1480 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD6DF.tmp (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD6DE.tmp (0 bytes)

Registry activity

The process %original file name%.exe:2464 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASMANCS]
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASAPI32]
"EnableFileTracing" = "0"
"EnableConsoleTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASMANCS]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASAPI32]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "1"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASMANCS]
"FileTracingMask" = "4294901760"

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASMANCS]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASAPI32]
"FileTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASMANCS]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASAPI32]
"ConsoleTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\0d7afef25ce702b284d78e8f9af68dc3_RASMANCS]
"EnableFileTracing" = "0"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Update" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsUpdate.exe"

The process %original file name%.exe:2800 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

The process %original file name%.exe:1172 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2D\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD]
"Blob" = "0F 00 00 00 01 00 00 00 20 00 00 00 52 29 BA 15"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"D69B561148F01C77C54578C10926DF5B856976AD"

Dropped PE files

There are no dropped PE files.

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: BioWare
Product Name: SWTOR Launcher
Product Version: 3.0.0
Legal Copyright: (c)2012 Electronic Arts, Inc.
Legal Trademarks:
Original Filename: bb.exe
Internal Name: bb.exe
File Version: 3.0.0
File Description: SWTOR Launcher
Comments: SWTOR Launcher
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEF1hApI4rsgHb3/CLkGL5Ek=
hxxp://whatismyipaddress.com/	23.7.198.147
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://a1158.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+
hxxp://crl.comodoca.com.cdn.cloudflare.net/UTN-DATACorpSGC.crl	104.16.91.188
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=
hxxp://a1363.dscg.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za
hxxp://a1363.dscg.akamai.net/pki/crl/products/WinPCA.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl
hxxp://gpla1.wac.v2cdn.net/PublicSureServerSV.crl
hxxp://gpla1.wac.v2cdn.net/CRL/Omniroot2025.crl
hxxp://cs3.wpc.v0cdn.net/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg=
hxxp://a1363.dscg.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon
hxxp://crl.comodoca.com.cdn.cloudflare.net/AddTrustExternalCARoot.crl	104.16.91.188
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=
hxxp://cdn.globalsigncdn.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI=
hxxp://cdn.globalsigncdn.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe
hxxp://cdn.globalsigncdn.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw==
hxxp://cdn.globalsigncdn.com/rootr3/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBT1nGh/JBjWKnkPdZIzB1bqhelHBwQUj/BLf6guRSSuTVD6Y5qL3uLdG7wCCwQAAAAAATGJxkTJ
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys=
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11
hxxp://clients.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA=
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=
hxxp://cs9.wac.phicdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE=
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://e8218.dscb1.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==
hxxp://e8218.dscb1.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0=
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c=
hxxp://cdn.yandex.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y=
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso
hxxp://ocsp-services.uzto.netdna-cdn.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
hxxp://e6845.dscb1.akamaiedge.net/crls/secureca.crl
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon	173.194.32.130
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy	173.194.32.130
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA=	93.184.220.29
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	212.30.134.167
hxxp://crl.comodoca.com/UTN-DATACorpSGC.crl	104.16.91.188
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c=	23.43.139.27
hxxp://ocsp2.globalsign.com/rootr3/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBT1nGh/JBjWKnkPdZIzB1bqhelHBwQUj/BLf6guRSSuTVD6Y5qL3uLdG7wCCwQAAAAAATGJxkTJ	104.16.27.216
hxxp://tg.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY=	23.43.139.27
hxxp://evsecure-ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+	173.194.32.130
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	212.30.134.167
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO	173.194.32.130
hxxp://ocsp.globalsign.com/rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV	104.16.28.216
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc=	93.184.220.29
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss=	93.184.220.29
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg==	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR	173.194.32.130
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI=	93.184.220.29
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe	173.194.32.130
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE=	93.184.220.29
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za	173.194.32.130
hxxp://vassg142.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/	2.21.89.26
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl	173.194.32.130
hxxp://s2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ=	23.43.139.27
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	212.30.134.167
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y=	5.45.205.233
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF	173.194.32.130
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE=	23.43.139.27
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8=	93.184.220.29
hxxp://crl.omniroot.com/PublicSureServerSV.crl	93.184.220.20
hxxp://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c=	5.45.205.233
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY	173.194.32.130
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM=	93.184.220.29
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.176
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	212.30.134.167
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I	94.31.29.96
hxxp://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso	94.31.29.96
hxxp://mscrl.microsoft.com/pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl	93.184.221.200
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg=	93.184.220.29
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o=	93.184.220.29
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0=	23.43.139.27
hxxp://sf.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEF1hApI4rsgHb3/CLkGL5Ek=	23.43.139.27
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
hxxp://sf.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys=	23.43.139.27
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH	104.16.28.216
hxxp://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw==	104.16.27.216
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM	104.16.28.216
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11	173.194.32.130
hxxp://sv.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0=	23.43.139.27
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i	173.194.32.130
hxxp://crl.comodoca.com/AddTrustExternalCARoot.crl	104.16.91.188
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl	93.184.220.20
smtp.bk.ru	217.69.139.163

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx+JOp7hVgTeaGFJ/CQgQUljtT8Hkzl699g+8uK8zKt4YecmYCECqcIayqpjo8WKe5MivulI0= HTTP/1.1

Cache-Control: max-age = 588368

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 05:31:11 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: sv.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1611

content-transfer-encoding: binary

Cache-Control: max-age=552471, public, no-transform, must-revalidate

Last-Modified: Tue, 25 Oct 2016 21:29:52 GMT

Expires: Tue, 1 Nov 2016 21:29:52 GMT

Date: Wed, 26 Oct 2016 12:06:35 GMT

Connection: keep-alive
0..G......@0..<.. .....0.....-0..)0......H.S.......J.?x.7T..a..2016
1025212952Z0s0q0I0... ...........C%.......`M.....B...;S.y3..}... .....
rf..*.!...:<X..2 .......20161025212952Z....20161101212952Z0...*.H..
..............*.R....(([..5...x.....t!.D.v.f.. .9...*N.x.(?....X..E..j
........L5z...F..c..=B(f8.....q....;..dh...*....6....U.>."O......%.
..k~!...5.......!........#`F./.t.Em...S. x..L...%c.sj.<\.......*.O.
..v.v.<...wD...X6....Qr.P.......!$<...;$..8..E~..4...C......k2..
..p0..l0..h0..P.......jVl_wg...'.i....0...*.H........0.1.0...U....US1.
0...U....Symantec Corporation1.0...U....Symantec Trust Network100...U.
..'Symantec Class 3 SHA256 Code Signing CA0...161002000000Z..161231235
959Z0A1?0=..U...6Symantec Class 3 SHA256 Code Signing CA OCSP Responde
r0.."0...*.H.............0............y.....l..f.......m./].j..mysU[d.
.....:..!...9......-._k..V.%.B'...'..e.S.....>....3..3..?../.hO#.c.
L.......T...<,..-....Bt...U..G.A%|..E..y=jf....%.Y*..x.b..F...'~.,.
[email protected].|!...R..8....:.N..,;zG.WN..{\c.Q.V!..l.....!h..d...T..
Ik....Nu.S.WK"...........0...0... .....0......0"..U....0...0.1.0...U..
..TGV-D-22120...U.#..0....;S.y3..}... .....rf0...U......H.S.......J.?x
.7T..a0...U.......0.0n..U. .g0e0c..`.H...E....0T0&.. .........hXXp://w
ww.symauth.com/cps0*.. .......0...  hXXp://VVV.symauth.com/rpa0...U.%.
.0... .......0...U...........0...*.H................a..).B.>@.`...-
.1..0..LJ.(S...s...U.'.;...N..Kp[..... B...&...K.|K..xd.....db....."\2
..J......l.....U.I..t C.8B...B.... .....v.!#.1.v7$..j......6>..
<<< skipped >>>

GET /UTN-DATACorpSGC.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Wed, 26 Oct 2016 12:06:27 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d38738f87640e11a1af7f1cb83652b7481477483587; expires=Thu, 26-Oct-17 12:06:27 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Wed, 26 Oct 2016 10:08:14 GMT

ETag: W/"5810808e-22c"

X-CCACDN-Mirror-ID: rmdccacrl10

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Wed, 26 Oct 2016 16:06:27 GMT

Server: cloudflare-nginx

CF-RAY: 2f7dc848b1494056-SOF
239..0..50......0...*.H........0..1.0...U....US1.0...U....UT1.0...U...
.Salt Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.u
sertrust.com1.0...U....UTN - DATACorp SGC..161026100814Z..161030100814
Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...S2........].N..
.E..O0...U........0...*.H.............u.@y~..fM..Sh.M.O. ..l.........I
[email protected] >..Xr=4.7..C.-L=..?........O.#..O.O.DZ...
w.Y..h.............o.....q!F........[k.f(G$.^#.....g..9.....>-.....
{.]. `.F.Y3.V.i... .B..e.U<E...Y.4.U...X..M......~~:../ .Lp|*.H:,..
 ..oE;m..kW.5..*..O.pe...0..HTTP/1.1 200 OK..Date: Wed, 26 Oct 2016 12
:06:27 GMT..Content-Type: application/x-pkcs7-crl..Transfer-Encoding: 
chunked..Connection: keep-alive..Set-Cookie: __cfduid=d38738f87640e11a
1af7f1cb83652b7481477483587; expires=Thu, 26-Oct-17 12:06:27 GMT; path
=/; domain=.comodoca.com; HttpOnly..Last-Modified: Wed, 26 Oct 2016 10
:08:14 GMT..ETag: W/"5810808e-22c"..X-CCACDN-Mirror-ID: rmdccacrl10..C
ache-Control: public, max-age=14400..CF-Cache-Status: HIT..Expires: We
d, 26 Oct 2016 16:06:27 GMT..Server: cloudflare-nginx..CF-RAY: 2f7dc84
8b1494056-SOF..239..0..50......0...*.H........0..1.0...U....US1.0...U.
...UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U.
...hXXp://VVV.usertrust.com1.0...U....UTN - DATACorp SGC..161026100814
Z..161030100814Z0#0!....^{.j.......^....161004055749Z.00.0...U.#..0...
S2........].N...E..O0...U........0...*.H.............u.@y~..fM..Sh.M.O
. [email protected] >..Xr=4.7..C.-L=..?...
<<< skipped >>>

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 19 Nov 2013 13:17:06 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com

HTTP/1.1 200 OK

Date: Wed, 26 Oct 2016 12:06:31 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=de52cbaa54defd8e470df0eed4d1a9cf51477483591; expires=Thu, 26-Oct-17 12:06:31 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Wed, 26 Oct 2016 10:08:14 GMT

ETag: W/"5810808e-228"

X-CCACDN-Mirror-ID: rmdccacrl3

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Wed, 26 Oct 2016 16:06:31 GMT

Server: cloudflare-nginx

CF-RAY: 2f7dc86131f24056-SOF
25a..0..V0..>...0...*.H........0o1.0...U....SE1.0...U....AddTrust A
B1&0$..U....AddTrust External TTP Network1"0 ..U....AddTrust External 
CA Root..161026100814Z..161030100814Z0i0!..S{vVO)...iC.".,y..151214155
830Z0!..F....L...e.n.B.d..151214155830Z0!..:...u....t........151214155
830Z.00.0...U.#..0......z4.&...&T....$.T.0...U........0...*.H.........
....A.4..................dl..D.g.4..##.FC.f4...i2..UrQ....S^l..g..Q..2
#g....dg....'....$.7.S.{a3......F.....l.).....s;...,..I[>.l .%....N
.d...h..../.y2..~.R=....>..<.....]..Q......d...).....OSB)y.....T
z.....).*~S..PG......z....N.q...7.Q.jI.m3...P...\D.8./[email protected]/1
.1 200 OK..Date: Wed, 26 Oct 2016 12:06:31 GMT..Content-Type: applicat
ion/x-pkcs7-crl..Transfer-Encoding: chunked..Connection: keep-alive..S
et-Cookie: __cfduid=de52cbaa54defd8e470df0eed4d1a9cf51477483591; expir
es=Thu, 26-Oct-17 12:06:31 GMT; path=/; domain=.comodoca.com; HttpOnly
..Last-Modified: Wed, 26 Oct 2016 10:08:14 GMT..ETag: W/"5810808e-228"
..X-CCACDN-Mirror-ID: rmdccacrl3..Cache-Control: public, max-age=14400
..CF-Cache-Status: HIT..Expires: Wed, 26 Oct 2016 16:06:31 GMT..Server
: cloudflare-nginx..CF-RAY: 2f7dc86131f24056-SOF..25a..0..V0..>...0
...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U....AddTrust
 External TTP Network1"0 ..U....AddTrust External CA Root..16102610081
4Z..161030100814Z0i0!..S{vVO)...iC.".,y..151214155830Z0!..F....L...e.n
.B.d..151214155830Z0!..:...u....t........151214155830Z.00.0...U.#..0..
....z4.&...&T....$.T.0...U........0...*.H.............A.4.........
<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:30:22 GMT

If-None-Match: "b6a46da3cf1aa70c10b101b12c9733f4:1476351022"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "632fb7b0483fca7ee48d2da473885e13:1477483226"

Last-Modified: Wed, 26 Oct 2016 12:00:26 GMT

Date: Wed, 26 Oct 2016 12:06:36 GMT

Content-Length: 325

Connection: keep-alive

Content-Type: application/pkix-crl
0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equi
fax Secure Certificate Authority..161026114300Z..161105114300Z0,0....%
...020514181157Z0.....3..020515130611Z0...*.H.............K\.`..^.KNYs
Ken.3..JcH.Qf.efPcj...92.%C$..U.}OO....^..pY.c.Q8....=.oJo..Ve...S....
.........a.T....D&.LW... .#.{.[ ....Y....=.h.HTTP/1.1 200 OK..Server: 
Apache..ETag: "632fb7b0483fca7ee48d2da473885e13:1477483226"..Last-Modi
fied: Wed, 26 Oct 2016 12:00:26 GMT..Date: Wed, 26 Oct 2016 12:06:36 G
MT..Content-Length: 325..Connection: keep-alive..Content-Type: applica
tion/pkix-crl..0..A0..0...*.H........0N1.0...U....US1.0...U....Equifax
1-0 ..U...$Equifax Secure Certificate Authority..161026114300Z..161105
114300Z0,0....%...020514181157Z0.....3..020515130611Z0...*.H..........
...K\.`..^.KNYsKen.3..JcH.Qf.efPcj...92.%C$..U.}OO....^..pY.c.Q8....=.
oJo..Ve...S.............a.T....D&.LW... .#.{.[ ....Y....=.h...

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBTkLVLomfJQOu5CFIgPOR73ljBRHAQU+L36r3N3xscb+UtNEafRM6+vchECFEOZrYpYgDwxeWGj/HetMtWiXvU/ HTTP/1.1

Cache-Control: max-age = 339923

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 09:41:21 GMT

If-None-Match: "c06e9a4e33eec9dd813b8faff15397229f914d2a"

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg142.ocsp.omniroot.com

HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1746

Last-Modified: Wed, 26 Oct 2016 12:00:23 GMT

ETag: "e28aa787d691f5df76d41a92ce77106c40276a95"

Cache-Control: public, no-transform, must-revalidate, max-age=339632

Expires: Sun, 30 Oct 2016 10:26:59 GMT

Date: Wed, 26 Oct 2016 12:06:27 GMT

Connection: keep-alive
0..........0..... .....0......0...0......\r...Ev.C..*....omJ...2016102
6120023Z0w0u0M0... .........-R...P:.B...9...0Q.......sw....KM...3..r..
.C...X.<1ya..w.2..^.?....20161026120023Z....20161030120023Z0...*.H.
............%.u...<[email protected].;..2..Zf.5^i!v9....._?WkJ..B...-......
..A...Mb....(...)..Z..R..._...........5_..&<y......&....i .jQw.~..V
.A.M..{h.$.uF......Y.e....E..7I.X;..p.I ..3.}A..`...t.KA....i.......:.
S..VoI...E...-....B]...?,sF^OFsB*..O.9c...E\.D.........aF.zH...%....0.
..0...0...........1....n.SsnC.K.]I.w90...*.H........0..1.0...U....NL1.
0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0...U....Cy
bertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA20...1604070641
54Z..170407064154Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U....Veriz
on Enterprise Solutions1.0...U....Cybertrust1%0#..U....vassg142-OCSP R
esponder 20160.."0...*.H.............0.........w.;..Eu..'f.c^....Qe.O.
..U.....d.\?.....S.r'g.d..ES.NA.t....<.....#?.."...*Pm.<..s.....
...v...<[email protected]$.T..8=......\....>......z=t3?(.
....i.>t.^.....]7.9..j.E. ....{.$w..Y,...hf..6......L._9,.....i...S
...)/.."^.K.O...bb^....V....'p...'V..........H0..D0... .....0......0L.
.U. .E0C0A.. .....>..0402.. ........&hXXps://secure.omniroot.com/re
pository0~.. ........r0p06.. .....0..*hXXps://cacert.a.omniroot.com/va
ssg142.crt06.. .....0..*hXXps://cacert.a.omniroot.com/vassg142.der0...
U...........0...U.%..0... .......0...U.#..0.......sw....KM...3..r.0...
U......\r...Ev.C..*....omJ.0...*.H.............l/0j.Z.z.......n-..
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEBpQyPxtf4zfzSziKHSWP+c= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: yandex.ocsp-responder.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Wed, 26 Oct 2016 12:06:35 GMT

Content-Type: application/ocsp-response

Content-Length: 1548

Connection: keep-alive

Keep-Alive: timeout=5

Content-transfer-encoding: binary

X-Cached: MISS

X-Cache: HIT
0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U...
.Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..201610
26113438Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M..
.P..m....,.(t.?.....20161026113438Z....20161102113438Z..0.0... .....0.
...0... .....0..0...*.H...........]....dl...;.......;.#qe..L2........u
z..E.*..q...T#~..N.A...c..Y}..#...,j~....e.X..G.Y.D.x%..^........EV9n.
{..\[..,.L..mgZ..[.....4p.o.K .U/....B.)B.x.K..[..Y..{|..'.B.`yRw.....
K1.N.mp.&=..jA.g....K....g.. bxXF..:..sj....SW.U...[VO...M....u.....;.
S.b...#.......0...0...0..........u.iE...........,0...*.H........0_1.0.
..U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Authorit
y1.0...U....Yandex CA0...160810103627Z..161108103627Z0U1.0...U....PL1"
0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation Service
0.."0...*[email protected])=DbS.4...v.....v..U...1Vf.....
6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd..JU..
... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H...B-C..
.>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..ji...n.
...ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\.......N....
...\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0... ...
....0... .....0......0...*.H..............p.....hu..l...k...;)....m..4
.*..UM.9($.....J..?.Ged...J..p...J...&.T.K ._Z,.........{.....VX....)?
r.c.1Z<..S.qR...q.|..<.=....O"i...&7...gn...../p...Ri..D..nW;..S
...3.d...p;o.....f.....%0.<..................R....t...u^..|...K
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CEC4iWwN324kytd+8GcSoH5Y= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: yandex.ocsp-responder.com

HTTP/1.1 200 OK

Server: nginx/1.8.1

Date: Wed, 26 Oct 2016 12:06:35 GMT

Content-Type: application/ocsp-response

Content-Length: 1548

Connection: keep-alive

Keep-Alive: timeout=5

Content-transfer-encoding: binary

X-Cached: MISS

X-Cache: HIT
0..........0..... .....0......0...0.........W0U1.0...U....PL1"0 ..U...
.Unizeto Technologies S.A.1"0 ..U....Certum Validation Service..201610
26114543Z0q0o0G0... ........#.}.rYE....PV.G.K...7\.......N.......\5M..
."[.w..2............20161026114543Z....20161102114543Z..0.0... .....0.
...0... .....0..0...*.H...........8I...m..i..,......3"../t..V.8.....k.
.n...........%.*.....l0.G..o.L......~.......j.j...>...]X.y....B...,
.G8..opX.n..............(V../.fj....$"n.TF.Y...7..]_H.H2,...T...5.....
..a.3R..|..wX...cCCn...;M..;fx...Ip?.N..v<.F1{.#.c..b.-|.1....1...5
........Oi..-.._....0...0...0..........u.iE...........,0...*.H........
0_1.0...U....RU1.0...U....Yandex LLC1'0%..U....Yandex Certification Au
thority1.0...U....Yandex CA0...160810103627Z..161108103627Z0U1.0...U..
..PL1"0 ..U....Unizeto Technologies S.A.1"0 ..U....Certum Validation S
ervice0.."0...*[email protected])=DbS.4...v.....v..U...1V
f.....6f.h..HVLXf..Z,.V.4.b.e...J...'.t...B..v...e.v7..m..L..|._....qd
..JU..... X~.=u......[..T..X> .\y.\E..........).-`wv.)....8j...9H..
.B-C...>IV6......a.......y.<..qJ,..#Hn.4...}=.&.ZA.......[..M..j
i...n....ZL....ag!..|...........0..0...U.......0.0...U.#..0...7\......
.N.......\5M0...U......'2.zbn7g.W.g..F.]\.Z0...U...........0...U.%..0.
.. .......0... .....0......0...*.H..............p.....hu..l...k...;)..
..m..4.*..UM.9($.....J..?.Ged...J..p...J...&.T.K ._Z,.........{.....VX
....)?r.c.1Z<..S.qR...q.|..<.=....O"i...&7...gn...../p...Ri..D..
nW;..S...3.d...p;o.....f.....%0.<..................R....t...u^.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEBEqAG035RBv1sp8w++6zBg= HTTP/1.1

Cache-Control: max-age = 471678

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 28 Nov 2013 01:44:29 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: evsecure-ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=546485, public, no-transform, must-revalidate

Last-Modified: Tue, 25 Oct 2016 19:50:44 GMT

Expires: Tue, 1 Nov 2016 19:50:44 GMT

Date: Wed, 26 Oct 2016 12:06:31 GMT

Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016102
5195044Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13...*.m7..o..|.........20161025195044Z....20161101195044Z0...*.H.....
.........f..\[email protected]#!).b..._..G..:....ye...j.J.).....W%W....
?....).>..H...........%...."V..O...u.b0..y..wMvm....r....%.2_.S....
e.dZ........|a-./...M...*i./..7._bU.d.r.q.`...}..).p.:Iuf.Mr..Y.....o.
.....bh. ...... .,.k....)..4...%8...l..m.".....H...3.d*......0...0...0
.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...151124000000Z..161214235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..
A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V..
.$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.
p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.
Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H.
..E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http:
//VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0.
.....0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.
0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 29 Oct 2013 05:02:50 GMT

If-None-Match: "b8b5df1d64d4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 27 Sep 2016 05:00:38 GMT

Accept-Ranges: bytes

ETag: "773de167c18d21:0"

Server: Microsoft-IIS/8.5

VTag: 279261256600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Wed, 26 Oct 2016 12:06:27 GMT

Connection: keep-alive
0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..160926163316Z..161226045316Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......a0... .....7......161225164316Z0.
..*.H.............&............G.$.-..dc.....7.m..N.`.U......^F.V....%
ej..p4...>.[)0.......Z..v.../..b-.....v.A$......z.k.U....@S.._...I.
........h*@6.)WM..u....I....ew.7...._.....Y...iFWaQ.}....X.........Y.!
..J.j*............<L......L,...Y...c...:.WE..C..Q..|G....j<..z~6
q..HTTP/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modified:
 Tue, 27 Sep 2016 05:00:38 GMT..Accept-Ranges: bytes..ETag: "773de167c
18d21:0"..Server: Microsoft-IIS/8.5..VTag: 279261256600000000..P3P: CP
="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAM
o CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content
-Length: 554..Cache-Control: max-age=900..Date: Wed, 26 Oct 2016 12:06
:27 GMT..Connection: keep-alive..0..&0......0...*.H........0y1.0...U..
..US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpor
ation1#0!..U....Microsoft Code Signing PCA..160926163316Z..16122604531
6Z.a0_0...U.#..0..........X..7.3...L...0... .....7.........0...U......
a0... .....7......161225164316Z0...*.H.............&............G.$.-.
.dc.....7.m..N.`.U......^F.V....%ej..p4...>.[)0.......Z..v.../..b-.
....v.A$......z.k.U....@S.._...I.........h*@6.)WM..u....I....ew.7...._
.....Y...iFWaQ.}....X.........Y.!..J.j*............<L......L,..
<<< skipped >>>

GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 20 Sep 2013 05:02:11 GMT

If-None-Match: "96d8890beb5ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 18 Aug 2016 00:36:25 GMT

Accept-Ranges: bytes

ETag: "43ea118de8f8d11:0"

Server: Microsoft-IIS/8.5

VTag: 438385705400000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Wed, 26 Oct 2016 12:06:29 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..160817211657Z..161116093657Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......90... .....7......161115212657Z0...*.
H.............j..~...,.Iq....f.0...?...w..0...%....|..".u.'..u.....K8B
2T..5..qJ..5.;...5.....H....Ac=..MH...B.%....=.i....j.k....uU.......d.
[email protected].#)51o.kr]..L.VI..s....rk.mk&.-.'.N...6QK*Y2
d.....f~C.T..D...Hd.....4.dX..zQ...3h/..........W....r..jz..HTTP/1.1 2
00 OK..Content-Type: application/pkix-crl..Last-Modified: Thu, 18 Aug 
2016 00:36:25 GMT..Accept-Ranges: bytes..ETag: "43ea118de8f8d11:0"..Se
rver: Microsoft-IIS/8.5..VTag: 438385705400000000..P3P: CP="ALL IND DS
P COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM IN
T NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 550
..Cache-Control: max-age=900..Date: Wed, 26 Oct 2016 12:06:29 GMT..Con
nection: keep-alive..0.."0......0...*.H........0w1.0...U....US1.0...U.
...Washington1.0...U....Redmond1.0...U....Microsoft Corporation1!0...U
....Microsoft Time-Stamp PCA..160817211657Z..161116093657Z._0]0...U.#.
.0...#[email protected].. ..5..0... .....7.......0...U......90... .....7....
..161115212657Z0...*.H.............j..~...,.Iq....f.0...?...w..0...%..
..|..".u.'..u.....K8B2T..5..qJ..5.;...5.....H....Ac=..MH...B.%....=.i.
[email protected].#)51o.kr]..L.VI..s....
rk.mk&.-.'.N...6QK*Y2d.....f~C.T..D...Hd.....4.dX..zQ...3h/.......
<<< skipped >>>

GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Tue, 01 Oct 2013 05:02:51 GMT

If-None-Match: "8071417b63bece1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 02 Dec 2015 18:30:06 GMT

Accept-Ranges: bytes

ETag: "0cb60772f2dd11:0"

Server: Microsoft-IIS/8.5

VTag: 791804826200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 530

Cache-Control: max-age=900

Date: Wed, 26 Oct 2016 12:06:29 GMT

Connection: keep-alive
0...0.....0...*.H........0..1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Windows
 Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0.......p.
...........<.J0... .....7.......0...U......90...*.H..............I.
..MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G..s.D....
.....g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~..mS./p..F
......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C)....U..3Mt
.}......X......H.....|d...s..`.8F.l.......R.C....HTTP/1.1 200 OK..Cont
ent-Type: application/pkix-crl..Last-Modified: Wed, 02 Dec 2015 18:30:
06 GMT..Accept-Ranges: bytes..ETag: "0cb60772f2dd11:0"..Server: Micros
oft-IIS/8.5..VTag: 791804826200000000..P3P: CP="ALL IND DSP COR ADM CO
No CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PH
Y PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 530..Cache-Cont
rol: max-age=900..Date: Wed, 26 Oct 2016 12:06:29 GMT..Connection: kee
p-alive..0...0.....0...*.H........0..1.0...U....US1.0...U....Washingto
n1.0...U....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsof
t Windows Verification PCA..151202080000Z..430418080000Z.A0?0...U.#..0
.......p............<.J0... .....7.......0...U......90...*.H.......
.......I...MYp.....yh..$3..F.D....Qe]....~...>.Ye.h...L.nQ..091.=.G
..s.D.........g)...4.'........B....l#....c...e..U......Z .[.,.x..h:M~.
.mS./p..F......l.G.H<.".y.B.5.."\|.Hi`N=j.....;w.......o.*......C).
...U..3Mt.}......X......H.....|d...s..`.8F.l.......R.C.....
<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 808

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 09 Oct 2013 05:02:17 GMT

If-None-Match: "9c3f3dbaacc4ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Tue, 06 Sep 2016 05:01:54 GMT

Accept-Ranges: bytes

ETag: "6b18dc9fb7d21:0"

Server: Microsoft-IIS/8.5

VTag: 279107828100000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Wed, 26 Oct 2016 12:06:31 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..160905204847Z..
161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......00... .....7......161204205847
Z0...*.H.............".....s..B#.bK..Hv...m,x..e.ec..j...y....6.e.....
.Cp.....7G.0..AH..A.e......I...j....W.obU0.?.....Q.#.\.t..v.4E.......j
F.Zm....u...P....88.....nC./.._2&.. .h....Q..z{wl.....?...M..'..s[..\M
.t....J.Vb..,G..t....nk._...t.T.c[...kKW&D...#.."9.....X./.w.....%..0.
...K%.H...x.%..'..}.....P.3;.Y...pe z.!...:X..f..r..i1...F...0.......2
.~x.n.R.E...' ..>.)...}GT...>...P.^..]....{..> 2..N.m....!..1
[email protected]...|%.q..-../.....(.Xm.X...r9........
...[.DQ.......Y..;.. U.......xu-%*.-....~..$U.../...HTTP/1.1 200 OK..C
ontent-Type: application/pkix-crl..Last-Modified: Tue, 06 Sep 2016 05:
01:54 GMT..Accept-Ranges: bytes..ETag: "6b18dc9fb7d21:0"..Server: Micr
osoft-IIS/8.5..VTag: 279107828100000000..P3P: CP="ALL IND DSP COR ADM 
CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL 
PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Content-Length: 813..Cache-Co
ntrol: max-age=900..Date: Wed, 26 Oct 2016 12:06:31 GMT..Connection: k
eep-alive..0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&.
..,d....microsoft1-0 ..U...$Microsoft Root Certificate Authority..1609
05204847Z..161205090847Z0.0...a......../..100208014912Z._0]0...U.#..0.
.....`@V'..%..*..S.Y..0... .....7.......0...U......00... .....7...
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEFIA5aolVvwahu2WydRLM8c= HTTP/1.1

Cache-Control: max-age = 584393

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 04:26:54 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1761

content-transfer-encoding: binary

Cache-Control: max-age=528546, public, no-transform, must-revalidate

Last-Modified: Tue, 25 Oct 2016 14:51:02 GMT

Expires: Tue, 1 Nov 2016 14:51:02 GMT

Date: Wed, 26 Oct 2016 12:05:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016102
5145102Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..R...%V.......K3.....20161025145102Z....20161101145102Z0...*.H.....
........B....h.......lG.!..x.O..LF.......8........,.....7..p.8a....0n.
B.6....,...<.....L/e.V.|......,-/.)...m.9..q*J.]..jU.R|_/...y.p..m.
.w...`E...w.....6........7.....v.1...X03.].....Y...0.HR........xAi...:
...U.l..}.R..ng..4C.t..9.m'....MPL.......D.G..I..8.Z.$.~e....0...0...0
.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...151124000000Z..161214235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^f..
A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.V..
.$7............G.D.....@T{.....|...msV...{.q...2..y.............".u.d.
p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.cB.
Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`.H.
..E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...http:
//VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... .....0.
.....0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K.... *.
0...U.#..0.....e......0..C9...3130...*.H.................qL.....R.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRVuMwyhZnBGWkFKlkeoNe9zdlbSwQUK5o1rgEYODDhcHoF4BF2o869kBQCEBbfOFWwaAAL65vNdl55UHU= HTTP/1.1

Cache-Control: max-age = 360742

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 10 Oct 2016 14:02:11 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: tg.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1451

content-transfer-encoding: binary

Cache-Control: max-age=546376, public, no-transform, must-revalidate

Last-Modified: Tue, 25 Oct 2016 19:50:09 GMT

Expires: Tue, 1 Nov 2016 19:50:09 GMT

Date: Wed, 26 Oct 2016 12:06:32 GMT

Connection: keep-alive
0..........0..... .....0......0...0......|.....Q.......Uh..z...2016102
5195009Z0s0q0I0... ........U..2....i.*Y......[K.. .5...80.pz...v......
...8U.h.....v^yPu....20161025195009Z....20161101195009Z0...*.H........
.........W...g.J.......z...o1.......\..._.P.'......{...ui(q..r........
&......... =M:/....0{[email protected] .n.........
(.}.\.}C-cH...k ..O<..B..Sghw5...Lu.....i=>9.3.\}....C=1.... W?.
8.fCY.....I.v...>.O^..;...7...w).a.w4.@....{..C.....M...F....0...0.
..0..........e......L.B......0...*.H........0C1.0...U....US1.0...U....
thawte, Inc.1.0...U....thawte SHA256 SSL CA0...160829000000Z..16112723
5959Z0O1.0...U....US1.0...U....thawte, Inc.1)0'..U... thawte SHA256 SS
L OCSP Responder0.."0...*.H.............0................#.....]......
F#...Q...b:k.._n.X..!a.;<..a.......c....|.OsP..f..p.2r"2c&...8.:>
;vq.........2P..U....r..2.."N.!.gN....8.Y......D2.zF......Ln...Z..J..)
..B{.1.p#|...e...$.A{...n.B.....o......L1...g...].......$cpYK.vC.D=.N.
.F2..j...=.....Yi.......u..r...........0..0... .....0......0"..U....0.
..0.1.0...U....TGV-D-17700...U.#..0... .5...80.pz...v.....0...U......|
.....Q.......Uh..z.0...U.......0.0...U.%..0... .......0...U...........
0...*.H.............C..7...X}.(.w9 9..*9.0x^Q.h....o. ..J...B.dc.6.%a_
^[email protected]..'....
..v....4.......!.xV.es.....\......eM...C.|....$..I...-.. ...n.c*......
Tz..6T..gU..XQ.^....P.LB..H....y.o}.i...I.......5...j!.g.D's........
<<< skipped >>>

GET / HTTP/1.1

Host: whatismyipaddress.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 59

Date: Wed, 26 Oct 2016 12:06:11 GMT

Connection: keep-alive
Access Denied (AK1).  Contact [email protected]/1.1 20
0 OK..Content-Type: text/html..Content-Length: 59..Date: Wed, 26 Oct 2
016 12:06:11 GMT..Connection: keep-alive..Access Denied (AK1).  Contac
t [email protected]..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSySC/85E/LNAiBe/rxiqbyloQ6UQQUrWyqlGCc7eT/+j4KdCtjA/e2Wb8CEDY0nhjJnCZptlYubOWtcTI= HTTP/1.1

Cache-Control: max-age = 356574

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 10 Oct 2016 12:54:45 GMT

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1612

content-transfer-encoding: binary

Cache-Control: max-age=537853, public, no-transform, must-revalidate

Last-Modified: Tue, 25 Oct 2016 17:30:02 GMT

Expires: Tue, 1 Nov 2016 17:30:02 GMT

Date: Wed, 26 Oct 2016 12:06:32 GMT

Connection: keep-alive
0..H......A0..=.. .....0......0..*0......jwG.8s...r:ts.0.:.I...2016102
5173002Z0s0q0I0... .........H/..O.4..{.......:Q...l..`.....>.t c...
Y...64....&i.V.l..q2....20161025173002Z....20161101173002Z0...*.H.....
..........{...\.,....._..P.?.S..g..x..R.,[email protected].'....{1
n....z..6..Q ..{v.*_.X....a.&8i.`.S.=...0..8.A.a........a.k .v.N....(H
7......js.....,..Yn....... Wx.Pk&......Z...Y.`.h<.t...Z..".{...4l&g
t;..$'i..'L..xt.o%O........][email protected]....=.a...ä.a..rI..N......q0..m0.
.i0..Q.......h`(V......*....R0...*.H........0..1.0...U....US1.0...U...
.thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 
2008 thawte, Inc. - For authorized use only1$0"..U....thawte Primary R
oot CA - G30...151124000000Z..161214235959Z0..1.0...U....US1.0...U....
thawte, Inc.1(0&..U....Certification Services Division1503..U...,thawt
e Primary Root CA - G3 OCSP Responder 40.."0...*.H.............0......
..............Zs.8..W.D..c...H.....p.4I.........n..E...T.3...):w].s\`.
.t2........G.Gj|w).~i18J`....D....'t..e&q.Ga]>tw...0s.|I.R..!o.-...
..G.. F-.s.......O..7_p9.:.............^..i..}.K..S3.1.9Z..N|w...u...A
y.*|%....y.nU..U.q.y.y. ....\.w.j........Cu{.!k............0..0...U.%.
.0... .......0... .....0......0...U.......0.0...U...........0 ..U....0
...0.1.0...U....TGV-C-650...U......jwG.8s...r:ts.0.:.I.0...U.#..0....l
..`.....>.t c...Y.0...*.H...............A...../W.....x.V.Km.H7Q.[..
(..i..Y.........Ì....eI..j...|..O...k....X>r/{..\h.<..N.G.....
......Y.8..@i`..>..W...?..{...^G.)0S.>;..;4a#..)(.O{..t.h.8.
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAURO8EJH HTTP/1.1

Cache-Control: max-age = 10800

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 13 Oct 2016 07:50:34 GMT

If-None-Match: "6b9ba9eca642c891cc02365fc6161341647bd9fc"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com

HTTP/1.1 200 OK

Date: Wed, 26 Oct 2016 12:06:32 GMT

Content-Type: application/ocsp-response

Content-Length: 1518

Connection: keep-alive

Set-Cookie: __cfduid=dbc919545a4380a5b04287ed20ed4908f1477483592; expires=Thu, 26-Oct-17 12:06:32 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Wed, 26 Oct 2016 10:49:42 GMT

Expires: Sun, 30 Oct 2016 10:49:42 GMT

ETag: "cb2275c0c639cba128cd5cd0bc98324612e42b33"

Cache-Control: max-age=10800,public,no-transform,must-revalidate

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2f7dc86207ec401a-SOF
0..........0..... .....0......0...0.......ue......$I1......dO..2016102
6104942Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
.......DN.BG....20161026104942Z....20161030104942Z0...*.H.............
aq.~..........c.jS..K......U...t......h............'..U`.Y..S.(T.<"
Q>......{....R..5.N.Df. .,.Z.;]....6.....",...O...*..!..c....g~....
Z6.b.i...w.....j...."i....A..#.....A~,..#z...L5..hOd../....-...l.nB...
KIt.i..;.....$.d..3.n.....M)."Q.M.;........_......4S....0...0...0.....
.....H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign
 nv-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z
..161115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(Gl
obalSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.......
..ga..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}...4...8.sU....@..
.h.3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#
.M.vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p
.6.E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U.
..........0...U.%..0... .......0...U.......0.0...U.......ue......$I1..
....dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.
. .....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.
H..............$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..
k,[email protected]...=.C.....0(*..........
..........1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..
P...H. [email protected].....$.....3....P6.'.$.........
<<< skipped >>>

GET /rootr2/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm+IHV2ccHsBqBt5ZtJot39wZhi4CCwQAAAAAAURO8EpV HTTP/1.1

Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 08:41:57 GMT
If-None-Match: "682f048b8d31cb3f1cc888edf96fec2777d7e64b"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com


HTTP/1.1 200 OK
Date: Wed, 26 Oct 2016 12:06:32 GMT
Content-Type: application/ocsp-response
Content-Length: 1507
Connection: keep-alive
Set-Cookie: __cfduid=dbc919545a4380a5b04287ed20ed4908f1477483592; expires=Thu, 26-Oct-17 12:06:32 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Wed, 26 Oct 2016 08:28:05 GMT
Expires: Sun, 30 Oct 2016 08:28:05 GMT
ETag: "21b85260328f96cad616ba4ababc74354b6ef91f"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2f7dc86300fb401a-SOF
0..........0..... .....0......0...0...........1.IVp*.@N~.......2016102
6082805Z0n0l0D0... .........\.1n........U.:.yB......Wg...j..Y..-......
.......DN.JU....20161026082805Z....20161030082805Z0...*.H.............
.Pa1......7..._..s9JN...B.`.....Zw.c$.d9.%.?f..f....HxF..........s....
x..(Q...;.Soc....u..^'qB......WTQ.d.`...........M.....$Ud9....e,.O<
...4.........., &r...,.......Qg..R..".0V.t...|%..s.!.fX.....0 .U.e....
..@......./.s6.y...$}.mYI.|_M...G<..}.Y#.n../........0...0...0.....
.....H.j...N... .<i0...*.H........0L1 0...U....GlobalSign Root CA -
 R21.0...U....GlobalSign1.0...U....GlobalSign0...161007000000Z..170115
000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign
 OCSP for Root R2 - Signer 1.10.."0...*.H.............0.........N.....
..B>.|[email protected]|G.....,......|.b..K.T.x<
;L.K...6Q..zeh.....Zd.n...0km86...\...n..v..O.......9...)...|...#.....
j.......%W..vH`..Z.=..1[.d.y...)..n.&3,Z...#..Q....A.&...i..r"0.!6.g._
..7...&.]..4 .$........IG..sw.....c.J.../.7b.........0..0...U.........
..0...U.%..0... .......0...U.......0.0...U...........1.IVp*.@N~.....0.
..U.#..0......Wg...j..Y..-.....0... .....0......0L..U. .E0C0A.. .....2
._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.......
......s2..o"..2]=~.=..K.D...{n......,hd.....~TKr.R...K..u.&....lx...^.
G...n9.x..~..o.R..:...\I..c<.]I..Ps..uh...<.(..HnJT....m..o.f%..
'4^.)...z.-...$s.iI......M....B..3y./..3. .]2.......v.-.l...,..r.k.{^.
OW!.......b.k......_Px'....IF............m.(.~.:...r#t#[.3.
<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1

Cache-Control: max-age = 10800
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 17 Oct 2016 10:49:02 GMT
If-None-Match: "e3867d2220551f2da9177af5b0ae04352c03d02f"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.globalsign.com


HTTP/1.1 200 OK
Date: Wed, 26 Oct 2016 12:06:32 GMT
Content-Type: application/ocsp-response
Content-Length: 1518
Connection: keep-alive
Set-Cookie: __cfduid=dbc919545a4380a5b04287ed20ed4908f1477483592; expires=Thu, 26-Oct-17 12:06:32 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Wed, 26 Oct 2016 11:37:21 GMT
Expires: Sun, 30 Oct 2016 11:37:21 GMT
ETag: "04c351bafde71d044b2e2d5b438b75a08cb851cc"
Cache-Control: max-age=10800,public,no-transform,must-revalidate
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2f7dc8662470401a-SOF
0..........0..... .....0......0...0.......ue......$I1......dO..2016102
6113721Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
......./N.E.....20161026113721Z....20161030113721Z0...*.H.............
$.5.'@.ux.yL..<...aU...2..S8.^[email protected]..}W...Q.....C..^.
..1...H6._.IN...M.:...[&...e..........*......v"HV)%C...........Rw7tFs-
...#_do.N.........E..........7..e......w..:.?..p....j.....2(..I7..x...
.\.......?..&%.7D...._.zQD...6p].S:.T.`.l[...J..4....0...0...0........
..H.i..E...\...I0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv
-sa1.0...U....Root CA1.0...U....GlobalSign Root CA0...160807000000Z..1
61115000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(Globa
lSign OCSP for Root R1 - Signer 1.20.."0...*.H.............0.........g
a..)..*.n/X..z.<.....E'..rB(Z\'1..,....g.e.{.}[email protected].
3D.C......i.LKu..7..uv.#...3hN....1.-..u[.........D../jS.....`....#.M.
vm.:Pj~.t].Fq......B.M.NI~H`..L.n....2.W.....f_>5b. ....]......p.6.
E. ..P..a....Y......W.......:....K.~..2%G......^0.........0..0...U....
.......0...U.%..0... .......0...U.......0.0...U.......ue......$I1.....
.dO0...U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .
....2._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H..
............$..L...N.x4..FX.j.u.......;.0..>.C)9........z....n..k,.
[email protected]...=.C.....0(*.............
.......1..R.B|..Zn..u.......=2H..^..63.......?!_s..b]J...._...o.B..P..
.H. [email protected].....$.....3....P6.'.$...........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEF1hApI4rsgHb3/CLkGL5Ek= HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: sf.symcd.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1725
content-transfer-encoding: binary
Cache-Control: max-age=459022, public, no-transform, must-revalidate
Last-Modified: Mon, 24 Oct 2016 19:35:06 GMT
Expires: Mon, 31 Oct 2016 19:35:06 GMT
Date: Wed, 26 Oct 2016 12:05:50 GMT
Connection: keep-alive
0..........0..... .....0......0...0.......].[ .A.|1.rC_H.5F....2016102
4193506Z0s0q0I0... ...................F....0.yV......{&.K......&......
.]a..8...o...A..I....20161024193506Z....20161031193506Z0...*.H........
.....2......E......cF.'..Y.*I.....=Y....c...L....:.>...?8..W......F
...X..k...[B.d..,s....... Ad3...U..V..c.{. u.Z....?4...K..O.X.i...T...
`H...0..3l>...6V..(.hR..q6Z_#eH..8NB.UKb}h..{..0..'..$....C.Sx...%.
~b.3.e.x...oUR.S.0v..<..Qs .....{.$."..:........Z"F}.........0...0.
..0...........3..-......F....0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 Cod
e Signing 2010 CA0...160928000000Z..161227235959Z0..1.0...U....US1.0..
.U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1VeriSi
gn Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............0..
........0CTS.....D7.=.s/..|..P...mS.....,.,).?C..r8.H...]....R.&....#.
.}.[G8C.|P.Z...[........Y.m..5...#.{yp^d;..^.=c~}P5.....=0...U..."!j.1
.(.Q...n....O3.-:.R.;..A...............}.......JN..1E....I..!.y.:u.Jw.
.S......8.s..P..d........ ..t.u......X.cM...N:."a ...........0...0...U
....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.veris
ign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incor
p. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U...
.....0... .....0......0"..U....0...0.1.0...U....TGV-D-21700...*.H.....
........h.S...i..v...l.p,'JO....*.mGF`...(..MU|.vn.....*.^.2..._.$
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEEsY6Q+7vYaPyv66+coRxyE= HTTP/1.1
Cache-Control: max-age = 589790
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 20 Nov 2013 09:32:32 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 5
content-transfer-encoding: binary
Date: Wed, 26 Oct 2016 12:06:28 GMT
Connection: keep-alive
0........


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEDO099rCgtT22XaI8/R3kQY= HTTP/1.1

Cache-Control: max-age = 512217
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 09:17:20 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 5
content-transfer-encoding: binary
Date: Wed, 26 Oct 2016 12:06:28 GMT
Connection: keep-alive
0....HTTP/1.1 200 OK..Server: nginx/1.4.7..Content-Type: application/o
csp-response..Content-Length: 5..content-transfer-encoding: binary..Da
te: Wed, 26 Oct 2016 12:06:28 GMT..Connection: keep-alive..0....>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAKQll6RM0DNpmNM7zH3/Qc= HTTP/1.1

Cache-Control: max-age = 547348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 19 Nov 2013 21:12:41 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=555670, public, no-transform, must-revalidate
Last-Modified: Tue, 25 Oct 2016 22:25:19 GMT
Expires: Tue, 1 Nov 2016 22:25:19 GMT
Date: Wed, 26 Oct 2016 12:06:29 GMT
Connection: keep-alive
0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...2
0161025222519Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5
..........^[email protected]...*.H..
............[...{..L.{.9..3...2y.1....Q..I*.]......t\...p...Y?i.Y^<
....<"y...."...VQ.....:?.ObNy{U.A.Y...L.&.R.-#....=.....?..{.A.._QJ
..-....W.:.3.,....y..*h...YX..N...6oW....5.U3........AH{....e.B..g....
uT.k.b.......{&.....~I .,.\..&.U..#.O](...@.'.... Ds.Pt|.|7..Q....#0..
.0...0..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of
 use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 
Code Signing 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US
1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2T
erms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSig
n Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.
.........&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m.....
[email protected]\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. 
....J].M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd
..*o..&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.........
....0...0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........http
s://VVV.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSig
n's CPS incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... ..
.....0...U........0... .....0......0"..U....0...0.1.0...U....TGV-D
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Cache-Control: max-age = 440358
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 13:12:21 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1452
content-transfer-encoding: binary
Cache-Control: max-age=566528, public, no-transform, must-revalidate
Last-Modified: Wed, 26 Oct 2016 01:25:55 GMT
Expires: Wed, 2 Nov 2016 01:25:55 GMT
Date: Wed, 26 Oct 2016 12:06:31 GMT
Connection: keep-alive
0..........0..... .....0......0...0.........Yt...........z.(...2016102
6012555Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20161026012555Z....20161102012555Z0...*.H........
........urAj?...B;.1.".'l..4.<..9.=......d.......8S`..........W.k$.
ko.].B.'...b........{...|.9.#..P.....}<.xe.hd.{..R....c..q(..t.@.|.
\..6.5.Lk.a...W../@..t...:.q.....\\.57.)....Lu.G..x.T..#....k.FP.$\.F.
..!J57..6....y.`..K2...V.\../..l8...u9..{#...A. ...e.va.O....0...0...0
[email protected]...*.H........0_1.0...U....US1.0...U....Ver
iSign, Inc.1705..U....Class 3 Public Primary Certification Authority0.
..151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corp
oration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PC
A - G1 OCSP Responder Certificate 40.."0...*.H.............0..........
K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.b
y.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?.
.....g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.
......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U.
...0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/
cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...
U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H...
.........o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd..
......#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`
8......
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18+P0= HTTP/1.1

Cache-Control: max-age = 363986
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sun, 17 Nov 2013 16:06:48 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1452
content-transfer-encoding: binary
Cache-Control: max-age=487089, public, no-transform, must-revalidate
Last-Modified: Tue, 25 Oct 2016 03:21:00 GMT
Expires: Tue, 1 Nov 2016 03:21:00 GMT
Date: Wed, 26 Oct 2016 12:06:32 GMT
Connection: keep-alive
0..........0..... .....0......0...0.........Yt...........z.(...2016102
5032100Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.%...0a.. ...M|......20161025032100Z....20161101032100Z0...*.H........
........3..(c.......=.UH J.W..s...q......$.4U.xo:.G..%.........X..Xo..
.5.../Zkq..9....%.....<z.FG.....J..k?.....6..&b..*g?E>1.....J...
...!....../..UF...&^.....`2.;.Rb.....P.`....X?....lC4v../Mr...(cr.*...
.}[Mx7...S..OPH9....g8..#*n../....$.3. .36....,......c..V....0...0...0
[email protected]...*.H........0_1.0...U....US1.0...U....Ver
iSign, Inc.1705..U....Class 3 Public Primary Certification Authority0.
..151124000000Z..161214235959Z0..1.0...U....US1.0...U....Symantec Corp
oration1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3 PC
A - G1 OCSP Responder Certificate 40.."0...*.H.............0..........
K...8..p...<.\"J6.A!../.nL...6.........!.),......9].N6Kz.WC..8.)z.b
y.z..[% #..^t.^...*..M....p..{AW..[...d.]p...VY..F..d....>wv.5...?.
.....g>qJ...oF.jOW:.'n....4vK.....p..@.%......=..^..1.^..e^..w...g.
......gM...H..m..P..t (..)B.....1,`..!&.Ry.=:.6-c..=w........0..0...U.
...0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/
cps0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...
U........0... .....0......0 ..U....0...0.1.0...U....TGV-C-570...*.H...
.........o....8qO..."....5.E.....S.k&.Bd...2T@=._..H...S%...m. ...Gd..
......#.Ty/r..GH/..].G....o5..J.v.$...."...R.><....Jl..z.....=^`
8......
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Cache-Control: max-age = 435806
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 11:05:46 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.verisign.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1790
content-transfer-encoding: binary
Cache-Control: max-age=451724, public, no-transform, must-revalidate
Last-Modified: Mon, 24 Oct 2016 17:33:08 GMT
Expires: Mon, 31 Oct 2016 17:33:08 GMT
Date: Wed, 26 Oct 2016 12:06:33 GMT
Connection: keep-alive
0..........0..... .....0......0...0......75.<.2/.H....G%>*K^...2
0161024173308Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5
........M.s.Q~...@?j.......20161024173308Z....20161031173308Z0...*.H..
...........Ld..N doD().a...11#..)O5...........X..#...;.}F)././Cj..0..S
Y..V.....\..:..... .............JE..:..-......E...k...E:N{.q....v.....
 MN.A:D.-........J.T-... EQ.....z7.ai...=.X=..4.?:..Nn.s..a..P.E..*g. 
B..tDgJ.;..q2.. ....(.....6....1.J._W...3.......OY...z.,....#0...0...0
..........m.&..{.)K..8...I0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...160929000000Z..161228235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
...&;AD.cf.......S..g$/.\......."...D..L.............k!.h.m......@U...
T8...g..7\..3.C0.b....CR.....p...\Y..C.[`l....Q......G(.....{W. ....J]
.M`......y!<...3.@j.&....._/..j.c{.&v-Y....L....a]C....a...dd..*o..
&.[.O#..>....Q.....F ..e....<.' =...m.@$.w{>.A.............0.
..0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://ww
w.verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CP
S incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0
...U........0... .....0......0"..U....0...0.1.0...U....TGV-D-21870
<<< skipped >>>

GET /pki/mscorp/crl/MSIT Machine Auth CA 2(1).crl HTTP/1.1
Cache-Control: max-age = 6793
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 18 Nov 2013 23:37:31 GMT
If-None-Match: "b61f5b26b7e4ce1:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: mscrl.microsoft.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=6573
Content-Type: application/pkix-crl
Date: Wed, 26 Oct 2016 12:06:31 GMT
Etag: "ad925b8a3c1d11:0"
Last-Modified: Wed, 08 Jun 2016 16:35:08 GMT
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Server: ECAcc (arn/46C8)
VTag: 791986605800000000
X-Cache: HIT
X-Powered-By: ASP.NET
Content-Length: 163018
0..|.0..{....0...*.H........0..1.0.....&...,d....com1.0.....&...,d....
microsoft1.0.....&...,d....corp1.0.....&...,d....redmond1.0...U....MSI
T Machine Auth CA 2..160608162453Z..160616164453Z0..z.0)....=.........
130522112904Z0.0...U.......0).....3........130522112904Z0.0...U.......
0)..M.\.........130522100146Z0.0...U.......0)....K.........13052210014
5Z0.0...U.......0)...........Z..130522100145Z0.0...U.......0).....j...
..I..130522100145Z0.0...U.......0)....q.....q...130522094611Z0.0...U..
.....0).....C....q=..130522055646Z0.0...U.......0)..P.......j...130522
055646Z0.0...U.......0)..c.......:...130522053344Z0.0...U.......0)..[.
.x....F0..130521142635Z0.0...U.......0)..[.......F...130521142635Z0.0.
..U.......0)..`.ii....9...130521142635Z0.0...U.......0)..`.X.....9...1
30521142635Z0.0...U.......0)..[.......F/..130521142143Z0.0...U.......0
).....9....p...130520132837Z0.0...U.......0)..Q.4u....]...130520115050
Z0.0...U.......0).....p....p...130520110806Z0.0...U.......0)...z......
fQ..130520094526Z0.0...U.......0)..........e...130520094526Z0.0...U...
....0)..........e...130520094526Z0.0...U.......0)... K.....p...1305200
94519Z0.0...U.......0)... H.....p...130520094519Z0.0...U.......0)...zF
,....o...130520070955Z0.0...U.......0)..f..E....P...130518074816Z0.0..
.U.......0...\,jN....FD..130402211200Z0...../w....U...130328232900Z0..
.p.R.....G1..130226223400Z0....e......?...130220163500Z0....[......*..
.121221223500Z0...A......."...121206221900Z0...A......."...12120622190
0Z0...A......."...121206221800Z0...A..\...."...121206221700Z0...A.
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141/l2SWCyYX308B7Khio= HTTP/1.1
Cache-Control: max-age = 432038
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 10:05:24 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: s2.symcb.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1761
content-transfer-encoding: binary
Cache-Control: max-age=421403, public, no-transform, must-revalidate
Last-Modified: Mon, 24 Oct 2016 09:05:55 GMT
Expires: Mon, 31 Oct 2016 09:05:55 GMT
Date: Wed, 26 Oct 2016 12:06:33 GMT
Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016102
4090555Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..=x..vI`.a}.....*....20161024090555Z....20161031090555Z0...*.H.....
.........{...R...S.#..8..4d....w>..rc....j..s..).w.....H.../.eB 9X.
....S\. ..}M...........B....XK....$.gsw..|y.)y:_.Uv....Ew..(.,*.9...K.
v.;..>.............YXV...-.. .2...=5t.j.oh.......%b.y...Y .W.......
'.%;%..S..Y.......9.I.......?.....o...Y.0Z.....p..v)i7..........0...0.
..0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 Ve
riSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 P
ublic Primary Certification Authority - G50...151124000000Z..161214235
959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec
 Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Cert
ificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^
f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.
V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u
.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.
cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`
.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...ht
tp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... ....
.0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K....
 *.0...U.#..0.....e......0..C9...3130...*.H.................qL....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7/LTfz+tZU062rQ= HTTP/1.1

Cache-Control: max-age = 487662
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 01:30:20 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: s2.symcb.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1761
content-transfer-encoding: binary
Cache-Control: max-age=446266, public, no-transform, must-revalidate
Last-Modified: Mon, 24 Oct 2016 16:00:39 GMT
Expires: Mon, 31 Oct 2016 16:00:39 GMT
Date: Wed, 26 Oct 2016 12:06:34 GMT
Connection: keep-alive
0..........0..... .....0......0...0......l..T.#4...c.K.... *...2016102
4160039Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..~.Joo....?.eM:......20161024160039Z....20161031160039Z0...*.H.....
...........yp."[email protected]&..0.....S......P ..Q...5.C....
.>..NA.@........&...|..C....5...cD.... .Q.....c...1.c.p.R3S?....e..
....c......e.....gT.....oA....3.....n?....h. [email protected] %/.6[l.
..!.E.....F....~...R.O..rB......n....p..M<.z=.(.....yB..6....0...0.
..0.......... .7.$.T.4.....u.0...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 Ve
riSign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 P
ublic Primary Certification Authority - G50...151124000000Z..161214235
959Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec
 Trust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Cert
ificate 40.."0...*.H.............0........./..C.n..RRd-G..mB...m.0Q..^
f..A...av.9....?Q..(.j(..$..P..?[v....9. ...u....v..-<l....^.Z.C.f.
V...$7............G.D.....@T{.....|...msV...{.q...2..y.............".u
.d.p.%... U.I.0..0.x.-`..Yi....6.lw<....N.k\.....]s...O... 0....TH.
cB.Q.Z...}...p.1....>2 ..........0...0...U.......0.0l..U. .e0c0a..`
.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...ht
tp://VVV.symauth.com/rpa0...U.%..0... .......0...U...........0... ....
.0......0 ..U....0...0.1.0...U....TGV-C-600...U......l..T.#4...c.K....
 *.0...U.#..0.....e......0..C9...3130...*.H.................qL....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo/X8AUm7+PSp50CEExA26X5iPrlelfWRXSV+Ys= HTTP/1.1
Cache-Control: max-age = 444549
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Tue, 11 Oct 2016 13:33:22 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: sf.symcd.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1725
content-transfer-encoding: binary
Cache-Control: max-age=402086, public, no-transform, must-revalidate
Last-Modified: Mon, 24 Oct 2016 03:45:11 GMT
Expires: Mon, 31 Oct 2016 03:45:11 GMT
Date: Wed, 26 Oct 2016 12:06:33 GMT
Connection: keep-alive
0..........0..... .....0......0...0.......].[ .A.|1.rC_H.5F....2016102
4034511Z0s0q0I0... ...................F....0.yV......{&.K......&......
[email protected]...*.H........
.......f....P.u....xU....3..8V.X$...gN...W...0Y%..D.%g.z'..|.gTC\.W7i.
....".y....M.4....-.Z.#...........ab......k.n..,.K....$....P*..w..*..`
....Q4s7Ki7^<..c`.Z/.C..e..$'J..>.<...RK.T5..<. @......%.M
..x..g........T......`.;..fT.1..... :$eE.w9"..s(@.3d.%...b.........0..
.0...0...........3..-......F....0...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of
 use at hXXps://VVV.verisign.com/rpa (c)101.0,..U...%VeriSign Class 3 
Code Signing 2010 CA0...160928000000Z..161227235959Z0..1.0...U....US1.
0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1Ver
iSign Class 3 Code Signing 2010 OCSP Responder0.."0...*.H.............
0..........0CTS.....D7.=.s/..|..P...mS.....,.,).?C..r8.H...]....R.&...
.#..}.[G8C.|P.Z...[........Y.m..5...#.{yp^d;..^.=c~}P5.....=0...U..."!
j.1.(.Q...n....O3.-:.R.;..A...............}.......JN..1E....I..!.y.:u.
Jw..S......8.s..P..d........ ..t.u......X.cM...N:."a ...........0...0.
..U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.ve
risign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS in
corp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U
........0... .....0......0"..U....0...0.1.0...U....TGV-D-21700...*.H..
...........h.S...i..v...l.p,'JO....*.mGF`...(..MU|.vn.....*.^.2...
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt+lGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAnmWtgHuEl7B0nUFWjWJtA= HTTP/1.1
Cache-Control: max-age = 500864
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 02:06:23 GMT
If-None-Match: "57feec1f-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=491890
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "58100fd6-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Wed, 26 Oct 2016 02:07:18 GMT
Server: ECS (vie/F398)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Z..{*....q..`.-.eu.X..2016102
6012000Z0s0q0I0... .........G.h...#......Vm.Q....Z..{*....q..`.-.eu.X.
...Z...I{.I..h.&.....20161026012000Z....20161102003500Z0...*.H........
.....h....d..4u.8..Td../.*...........v$..c..^WK....)^....g0.-D..[.X...
....mI..#......`Y..V. .0K.5...N].^.},.,.T.j'....D0.Nw..........H....-.
-...cy...85.....f:..OBR.$A...Top...i..........H.U.. A.y(:'...(......?b
.Zgj...!!X,...6&......A.]..S..0i..]~.v{.e...E.A...-HTTP/1.1 200 OK..Ac
cept-Ranges: bytes..Cache-Control: max-age=491890..Content-Type: appli
cation/ocsp-response..Date: Wed, 26 Oct 2016 12:06:34 GMT..Etag: "5810
0fd6-1d7"..Expires: Wed, 02 Nov 2016 00:06:34 GMT..Last-Modified: Wed,
 26 Oct 2016 02:07:18 GMT..Server: ECS (vie/F398)..X-Cache: HIT..Conte
nt-Length: 471..0..........0..... .....0......0...0......Z..{*....q..`
.-.eu.X..20161026012000Z0s0q0I0... .........G.h...#......Vm.Q....Z..{*
....q..`.-.eu.X....Z...I{.I..h.&.....20161026012000Z....20161102003500
Z0...*.H.............h....d..4u.8..Td../.*...........v$..c..^WK....)^.
...g0.-D..[.X.......mI..#......`Y..V. .0K.5...N].^.},.,.T.j'....D0.Nw.
.........H....-.-...cy...85.....f:..OBR.$A...Top...i..........H.U.. A.
y(:'...(......?b.Zgj...!!X,...6&......A.]..S..0i..]~.v{.e...E.A...-ont>....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEALtY5xZGvk2wytZGzzmpmI= HTTP/1.1

Cache-Control: max-age = 507829
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 03:40:21 GMT
If-None-Match: "57ff0225-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=493501
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "5810315d-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Wed, 26 Oct 2016 04:30:21 GMT
Server: ECS (vie/F2D3)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2016102
6025200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
...c.Y..6. Y.<..b....20161026025200Z....20161102020700Z0...*.H.....
.........q!. ....`R8A......d.8h%.)<..%......S!.....G.aE....W~.|...A
|p..dm}..6..3SP...o#.~G.....%..q......@...[6Y..~.........=.Y......XR..
.K8......8....A..*...fG.....c...9a....]..c...m.....Q...{..v......3-{i4
..E.e.s....1;....6...&I.....SG....{..a."..(h`9F......YSd.....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir/SSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW+VUAg= HTTP/1.1

Cache-Control: max-age = 510963
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:45:35 GMT
If-None-Match: "57ff116f-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=480677
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580fe12d-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Tue, 25 Oct 2016 22:48:13 GMT
Server: ECS (vie/F2AD)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......E.......1-Q...!..m....2016102
5210000Z0s0q0I0... [email protected]=?..Mn8...Q..E.......1-Q...!..m...
....._..fuSC.o.P.....20161025210000Z....20161101210000Z0...*.H........
........... Jg]..F....i.`....2. '...&.4..v*...=w.. ...z*h.........a.K.
..J..j.z..w.!V.L......x6..Of....5.....-U.5......ea)Z....i...>CU.j..
...T2...F}.~.O...*u1l...}.X.{0.l..D.....i)..h._$4..]....Oz.q........bv
I.2k.!.......L..y.8.......R...y,.o.0.p....iK#PZ....Z{ ....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8= HTTP/1.1

Cache-Control: max-age = 511667
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 04:57:34 GMT
If-None-Match: "57ff143e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=480583
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580fe0c4-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Tue, 25 Oct 2016 22:46:28 GMT
Server: ECS (vie/F2D5)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1025210000Z0s0q0I0... ............([email protected]....>.i...G...&...
.cd ........\..m. B.]......20161025210000Z....20161101210000Z0...*.H..
...........R.....6>..=..P,..0>?..9....B.........Is.PFYi.,..A....
.lC....vw.N..O-.......XS..>n....c?f.N.J.. .Fe..s.Z].J.......-..f)..
u..Z..fc.MW.{`f..z.!.b.u?u...."AgUU.P.l.#.FH...tv......yM.}b..!...F...
....S.6I...Q......Dw..&...o.$K.v{[email protected]..........}.3B...X.k....nt>....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAaeHbd/zx37qXr15cmiQDc= HTTP/1.1

Cache-Control: max-age = 512045
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 05:41:33 GMT
If-None-Match: "57ff1e8d-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=479937
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580fede1-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Tue, 25 Oct 2016 23:42:25 GMT
Server: ECS (vie/F38D)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2016102
5210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
[email protected]...*.H........
.....s1t.W.z..w...s..[D...)~N|"z..sy...a....(N.}...f..:.....M ..1.Z.K.
..sd...]./~.&.......Z...[d.Om....Xi`p%.`.X`.....#.g7y(..!......uy....c
.32x...v.......}.......IX.I..g....Ss..V..........k.#.-........v..;`.W.
..b.....[...y.....j............[no..LX...._#. oB.^.....


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY+sl+j4yzQuAcL2oQno5fCgQUUWj/kK8CB3U8zNllZGKiErhZcjsCEAaPPusu414KjPjj6PQyS9o= HTTP/1.1

Cache-Control: max-age = 513888
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 05:42:27 GMT
If-None-Match: "57ff1ec3-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=484316
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580fee20-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Tue, 25 Oct 2016 23:43:28 GMT
Server: ECS (vie/F3B0)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0......Qh.....u<..edb...Yr;..2016
1025230700Z0s0q0I0... .........&....~...B../j..._...Qh.....u<..edb.
..Yr;....>...^......2K.....20161025230700Z....20161101222200Z0...*.
H.............@@.I.Q...,.B..j.....Z..X|....-....].....]t=....=.%..M.&g
t;..Y&.|.0C......=...H.$....-.'<Mi=...{../M.._...F._...].^8....%|k.
Xn.p.5....vl..@.%.e...\.....q.#S......a#jC...$E^....^.k.S.....y(......
P.....I........ .(...q..nu.w^I..zL\...C.H..t.-.M.>r<.{..XL... .q
......


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQgppSLAb7oJaQ6RVV2Zh9VwZIGMwQUkHHbN+tzyO/c1R4StjS6K1qgppICEAfR2ttBMCNvKN8FgxN91ss= HTTP/1.1

Cache-Control: max-age = 516225
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 06:53:02 GMT
If-None-Match: "57ff2f4e-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=491199
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580ffe1b-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Wed, 26 Oct 2016 00:51:39 GMT
Server: ECS (vie/F3B1)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......q.7.s.......4. Z.....2016102
6001200Z0s0q0I0... ........ ......%.:EUvf.U...3...q.7.s.......4. Z....
.....A0#o(....}......20161026001200Z....20161101232700Z0...*.H........
.....2*M..AZ.....#.]a.ZRw...z=..G.q?6 .....A.........a.bq.z.~.doDs...2
SC(Z.?.R7. 3...L.....2OO.o.ND..3......x...NO.MZ.....4g.....n...j.H.;Y.
....;[email protected].^... .
...%[email protected].../.n...t.....E.S\..U.fS.._.........


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX+JrHYM= HTTP/1.1

Cache-Control: max-age = 517590
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 06:25:50 GMT
If-None-Match: "57ff28ee-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=485441
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580ff714-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Wed, 26 Oct 2016 00:21:40 GMT
Server: ECS (vie/F3C2)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2016
1025210000Z0s0q0I0... ............([email protected]....>.i...G...&...
.cd ....y.D.... .a_.k......20161025210000Z....20161101210000Z0...*.H..
..............M.p...../a(s\^..Rx4G.U.7......jDl.895..4B./m....3[......
...=.....7!j....p......."...htJ.....,'.r...g.z...IH&.. ....j..u.W.L.4`
.E...b...|.L..$..K?.....3.....#.%.;.m....1..9_..6.g'..p..N-...ASf.f..}
..&.YW.:.;.[-c.G^y...J...."....2%4..g-.....S.]..q.6..........


GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh/sBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o+tuynXIiEOLckvPvJE= HTTP/1.1

Cache-Control: max-age = 518191
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 13 Oct 2016 06:43:19 GMT
If-None-Match: "57ff2d07-1d7"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.digicert.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=487190
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 12:06:34 GMT
Etag: "580ffbef-1d7"
Expires: Wed, 02 Nov 2016 00:06:34 GMT
Last-Modified: Wed, 26 Oct 2016 00:42:23 GMT
Server: ECS (vie/F2BA)
X-Cache: HIT
Content-Length: 471
0..........0..... .....0......0...0........P5V.L.f........=.U..2016102
5210000Z0s0q0I0... .........Q..2...}Q......b.U.....P5V.L.f........=.U.
.....n.u..C.rK.......20161025210000Z....20161101210000Z0...*.H........
.....<'[email protected]..^5.p.P]..j...E.^l.n.m.c..|..O..
.}.Y<.el..['..,..*.E{..I`..U.-(m..:..u?.....[.-*....L..0.2!M8..G...
.S..!=b5t...)....j.c...|.s...`.<^.(.......6..lh....ix..!..h..gc:.c.
[email protected][email protected]...._.q....%.../..!.HTTP/1.1 2
00 OK..Accept-Ranges: bytes..Cache-Control: max-age=487190..Content-Ty
pe: application/ocsp-response..Date: Wed, 26 Oct 2016 12:06:34 GMT..Et
ag: "580ffbef-1d7"..Expires: Wed, 02 Nov 2016 00:06:34 GMT..Last-Modif
ied: Wed, 26 Oct 2016 00:42:23 GMT..Server: ECS (vie/F2BA)..X-Cache: H
IT..Content-Length: 471..0..........0..... .....0......0...0........P5
V.L.f........=.U..20161025210000Z0s0q0I0... .........Q..2...}Q......b.
U.....P5V.L.f........=.U......n.u..C.rK.......20161025210000Z....20161
101210000Z0...*.H.............<'[email protected]..^5.p.P
]..j...E.^l.n.m.c..|..O...}.Y<.el..['..,..*.E{..I`..U.-(m..:..u?...
..[.-*....L..0.2!M8..G....S..!=b5t...)....j.c...|.s...`.<^.(.......
6..lh....ix..!..h..gc:[email protected][email protected]...._
.q....%.../..!...
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCGZimYWX7CS+ HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 25 Oct 2016 08:54:36 GMT
Expires: Sat, 29 Oct 2016 08:54:36 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 97911
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
5010119Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.fb....$.....20161025010119Z....20161101010119Z0...*.H.............]tm
V#J..p....Z...g...l[./B*.f.a.M..*........i.].T....in.....C....W..|/.C.
.}.... ..1....n.<.4..,.J..R3...w.Kw.>.}&..............b..or...'.
_..E.Q....x.ZF......w?D&.y.B}.P..=..o.fy.d..T...|.n.)...2....5.L7.B...
..n...rE/?... 7'.'x....hm8....u.6.m.X.t`.)I...~.YHTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Tue, 25 Oct 2016 08:54:36 G
MT..Expires: Sat, 29 Oct 2016 08:54:36 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 97911..Cache-Control: public, max-age=345600..0.......
...0..... .....0......0...0......J......h.v....b..Z./..20161025010119Z
0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..fb....$
.....20161025010119Z....20161101010119Z0...*.H.............]tmV#J..p..
..Z...g...l[./B*.f.a.M..*........i.].T....in.....C....W..|/.C..}.... .
.1....n.<.4..,.J..R3...w.Kw.>.}&..............b..or...'._..E.Q..
..x.ZF......w?D&.y.B}.P..=..o.fy.d..T...|.n.)...2....5.L7.B.....n...rE
/?... 7'.'x....hm8....u.6.m.X.t`.)I...~.YHTTP/1.1 200 OK..Content-Type
: application/ocsp-response..Date: Tue, 25 Oct 2016 06:26:07 GMT..Expi
res: Sat, 29 Oct 2016 06:26:07 GMT..Server: ocsp_responder..Content-Le
ngth: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAMEORIGI
N..Age: 106821..Cache-Control: public, max-age=345600..0..........
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCO1K2+o5D5i HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 25 Oct 2016 08:50:20 GMT
Expires: Sat, 29 Oct 2016 08:50:20 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 98169
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
5010237Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.#. o..>b....20161025010237Z....20161101010237Z0...*.H.............
...J...[..;..{.c.{|.Lu..|.....UU.._.......W.;.>e.vKF7..A.a.^.W.,X.!
. I`....1......o.x..q..42/.....H.G*.s. ......h.W......G(|..!J3};.z..g/
.0....xq.s..H.]x....D.d-.....=...6...u.f.4...rRN4.$64..=L,I.<..\.H.
k...J.....)...G......6..l...E.."....!...`.O.u.....J.....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAMwQYKxJVsR HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sat, 22 Oct 2016 13:01:59 GMT
Expires: Wed, 26 Oct 2016 13:01:59 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 342270
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
2010207Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
..0A..%[.....20161022010207Z....20161029010207Z0...*.H...............4
.....u..ks.z'.8j0....._....0`.).S@*.............7.e.RX.VU/).5...2..xY.
......QEL...L...[...."...........`..<.!.?.....JJs...7....t"W.Qj..fr
X..B...:....6.Cp..1...3........85|o.......-&..xd.v.4.'...H.}...lT.~/.z
}XV!k...i..v>..9.).`E[,..Y....{..Ql.,.l..q2...HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Sat, 22 Oct 2016 13:01:59 G
MT..Expires: Wed, 26 Oct 2016 13:01:59 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 342270..Cache-Control: public, max-age=345600..0......
....0..... .....0......0...0......J......h.v....b..Z./..20161022010207
Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...0A..%
[.....20161022010207Z....20161029010207Z0...*.H...............4.....u.
.ks.z'.8j0....._....0`.).S@*.............7.e.RX.VU/).5...2..xY.......Q
EL...L...[...."...........`..<.!.?.....JJs...7....t"W.Qj..frX..B...
:....6.Cp..1...3........85|o.......-&..xd.v.4.'...H.}...lT.~/.z}XV!k..
.i..v>..9.).`E[,..Y....{..Ql.,.l..q2.......
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAFb1O5EN2Za HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 25 Oct 2016 12:20:40 GMT
Expires: Sat, 29 Oct 2016 12:20:40 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 85549
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
5010407Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
..[..D7fZ....20161025010407Z....20161101010407Z0...*.H............./G.
..?>P..s...x.4.3..N.....h3..6....A....S...(#...z..p}(....p...-. ."Q
..h........>8k...46..T.....6L..Zy9....R.7_VmN......7...&...K.......
.!{[email protected].... .g. .......4Y..b.)....[R..z(.ad....).....
...XG...<....@?..>.r#.^..h(.........g..V...q..~..HTTP/1.1 200 OK
..Content-Type: application/ocsp-response..Date: Tue, 25 Oct 2016 12:2
0:40 GMT..Expires: Sat, 29 Oct 2016 12:20:40 GMT..Server: ocsp_respond
er..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Opti
ons: SAMEORIGIN..Age: 85549..Cache-Control: public, max-age=345600..0.
.........0..... .....0......0...0......J......h.v....b..Z./..201610250
10407Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./...
[..D7fZ....20161025010407Z....20161101010407Z0...*.H............./G...
?>P..s...x.4.3..N.....h3..6....A....S...(#...z..p}(....p...-. ."Q..
h........>8k...46..T.....6L..Zy9....R.7_VmN......7...&...K........!
{[email protected].... .g. .......4Y..b.)....[R..z(.ad....).......
.XG...<....@?..>.r#.^..h(.........g..V...q..~......
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHUW2dw1OuXl HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 03:40:51 GMT
Expires: Sun, 30 Oct 2016 03:40:51 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 30338
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
5190332Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.u...5:......20161025190332Z....20161101190332Z0...*.H.............VGL
.....bH..{ .....]..jI.H.........f:.x..A......5.&..2......6$.....T.u.6.
k...q;..;.)..n.#...fz....h..r..v....gQH..K..SC-.g...|......_.s...o...)
@F6.c.lW.E...v.\..lU...u.T*jJ...$.Z .Gn.w.....Z...${.....)To ...$X..j.
..m.eF.=~.}eT....s[B_...&E..Hx}.....>B1.c.fHTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Wed, 26 Oct 2016 03:40:51 GMT.
.Expires: Sun, 30 Oct 2016 03:40:51 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 30338..Cache-Control: public, max-age=345600..0..........
0..... .....0......0...0......J......h.v....b..Z./..20161025190332Z0k0
i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..u...5:....
..20161025190332Z....20161101190332Z0...*.H.............VGL.....bH..{ 
.....]..jI.H.........f:.x..A......5.&..2......6$.....T.u.6.k...q;..;.)
..n.#...fz....h..r..v....gQH..K..SC-.g...|......_.s...o...)@F6.c.lW.E.
..v.\..lU...u.T*jJ...$.Z .Gn.w.....Z...${.....)To ...$X..j...m.eF.=~.}
eT....s[B_...&E..Hx}.....>B1.c.f....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAisW18hq2CY HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 404 Not Found
Date: Wed, 26 Oct 2016 12:06:31 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEAdrg7dKqon HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 404 Not Found
Date: Wed, 26 Oct 2016 12:06:31 GMT
Content-Type: text/html; charset=UTF-8
Server: ocsp_responder
Content-Length: 1668
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
<!DOCTYPE html>.<html lang=en>.  <meta charset=utf-8>
;.  <meta name=viewport content="initial-scale=1, minimum-scale=1, 
width=device-width">.  <title>Error 404 (Not Found)!!1</ti
tle>.  <style>.    *{margin:0;padding:0}html,code{font:15px/2
2px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body
{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px
}* > body{background:url(//VVV.google.com/images/errors/robot.png) 
100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:h
idden}ins{color:#777;text-decoration:none}a img{border:0}@media screen
 and (max-width:772px){body{background:none;margin-top:0;max-width:non
e;padding-right:0}}#logo{background:url(//VVV.google.com/images/brandi
ng/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:
-5px}@media only screen and (min-resolution:192dpi){#logo{background:u
rl(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_color_150
x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//VVV.googl
e.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}
@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{backgr
ound:url(//VVV.google.com/images/branding/googlelogo/2x/googlelogo_col
or_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{di
splay:inline-block;height:54px;width:150px}.  </style>.  <a h
ref=//VVV.google.com/><span id=logo aria-label=Google></sp
an></a>.  <p><b>404.</b> <ins>Tha
<<< skipped >>>

GET /PublicSureServerSV.crl HTTP/1.1
Cache-Control: max-age = 150326
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 20 Nov 2013 09:46:05 GMT
If-None-Match: "2b0037-c0d1-a6553140"
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.omniroot.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=864000
Content-Type: application/x-pkcs7-crl
Date: Wed, 26 Oct 2016 12:06:29 GMT
Etag: "402a1-5123f-53fc264679dd0"
Expires: Sat, 05 Nov 2016 12:06:29 GMT
Last-Modified: Wed, 26 Oct 2016 10:50:24 GMT
Server: ECS (arn/46BA)
X-Cache: HIT
X-Cntnt-Length: 332351
Content-Length: 332351
0...:0...!...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybe
rtrust Public SureServer SV CA..161026104307Z..161105104307Z0...r0....
..... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I
..101116165848Z0.........,U./...101116173007Z0.........,U.h...10111617
2944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0....
.....,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z
..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..10111619
5619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0....
.....-..4...110315204303Z0........../P....120206141831Z0..........I..@
..120124180322Z0..........JP....110222182509Z0..........Jf/Y..12021314
2815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0....
......YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu.
..120220131416Z0..........^..^..111007192320Z0..........`.w...12021314
4727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0....
......hlG...120213145015Z0..........h.....120130140408Z0............j.
..120110213653Z0...........}....110406160143Z0............$...11040100
5006Z0................110401005536Z0............W...120308151704Z0....
.........h..120228141105Z0................110314145902Z0............`.
..110322142311Z0................110322142551Z0............lb..12011021
3802Z0.............0..130201130700Z0............OB..110321165802Z0....
.........o..110321172720Z0...........g.:..120221183148Z0...........Ud.
..110516131110Z0............h5..120229174140Z0................1202
<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6kg== HTTP/1.1
Cache-Control: max-age = 564348
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 12 Oct 2016 22:33:53 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: g.symcd.com


HTTP/1.1 200 OK
Server: nginx/1.4.7
Content-Type: application/ocsp-response
Content-Length: 1362
content-transfer-encoding: binary
Cache-Control: max-age=521455, public, no-transform, must-revalidate
Last-Modified: Tue, 25 Oct 2016 12:55:29 GMT
Expires: Tue, 1 Nov 2016 12:55:29 GMT
Date: Wed, 26 Oct 2016 12:06:34 GMT
Connection: keep-alive
0..N......G0..C.. .....0.....40..00.......j.#.p.e$.\ps.*.. .j..2016102
5125529Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:.....20161025125529Z....20161101125529Z0...*.H............
..^M]....=.\..m.$.v...Um.4=.e........6c....vF.Z.....<N#....~.a3..*.
.g...L*..ogP....|....O=< ...$.gd......L@....$1......0...D.$....$4.k
..\.ho..Q=.%^j~g.\.z....Q..#V.Z"......b@..`{.q ....THP.IE>..a.g....
..$...%[email protected].'...]..^."....Kef. |>....0...0..
|0..d........:.0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1
.0...U....GeoTrust Global CA0...151203170230Z..161214170230Z02100...U.
..'GeoTrust Global CA TGV OCSP Responder 40.."0...*.H.............0...
......[.c.#zj......RME.....,......(..U......!-.l..R..E.~..%."./8mv..D.
..*...Rx........mw.~2..Q5T\.H...Wk*..a.z.$._..T......;T.S.r(._*.G....^
.P.!.3..t.......s......P....C._.g.b.oK...EV..>...>.|.o.~quo.....
........v4..Tt....Q.]A.Y......... w.E..=.%.n7.......{" *C........0..0.
..U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .......0
...U...........0...U.......0.0 ..U....0...0.1.0...U....TGV-C-670...*.H
...............aEc<..'R......]C.ri.Zm.....|..B.$..76..h....l...Xbxu
a...C.X.S....~K..A..._.T@$.....9(.... ......\.*.....5.b.x...[QM.._9P.=
..l...gf..L.?..3 ......Z....._...20R;...x.......C..0....l.G.A..5TS>
d.U......w.(\....v..9.z7.....J..;..'[email protected]....
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 86400
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 16 Sep 2016 21:16:59 GMT
If-None-Match: "8017f9a85f10d21:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: VVV.download.windowsupdate.com


HTTP/1.1 304 Not Modified
Content-Type: application/vnd.ms-cab-compressed
Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT
ETag: "8017f9a85f10d21:0"
Cache-Control: max-age=604800
Date: Wed, 26 Oct 2016 12:06:34 GMT
Connection: keep-alive
X-CCC: RU
X-CID: 2
HTTP/1.1 304 Not Modified..Content-Type: application/vnd.ms-cab-compre
ssed..Last-Modified: Fri, 16 Sep 2016 21:16:59 GMT..ETag: "8017f9a85f1
0d21:0"..Cache-Control: max-age=604800..Date: Wed, 26 Oct 2016 12:06:3
4 GMT..Connection: keep-alive..X-CCC: RU..X-CID: 2..


GET /gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDBoenwTt2h3GcY8iVw== HTTP/1.1
Cache-Control: max-age = 64077
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 14 Oct 2016 07:30:46 GMT
If-None-Match: "9c3a3a655480a34bcd0009a4de25540c7eea9e9a"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Wed, 26 Oct 2016 12:06:33 GMT
Content-Type: application/ocsp-response
Content-Length: 1570
Connection: keep-alive
Set-Cookie: __cfduid=da6a27fe408427c3fb98cabd52ebea0e41477483593; expires=Thu, 26-Oct-17 12:06:33 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Wed, 26 Oct 2016 09:13:44 GMT
Expires: Sun, 30 Oct 2016 09:13:44 GMT
ETag: "2a45e8796d2de1c06bd6f9b02e47f5e9bdb687be"
Cache-Control: public, max-age=335231
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2f7dc8688043403e-SOF
0..........0..... .....0......0...0.......M........u....%...G..2016102
6091344Z0o0m0E0... ..........M.=......r......{.....a....)S...};..@..|.
.........q."W....20161026091344Z....20161030091344Z0...*.H............
.<].......-..'y.......k.H.....P.I.N..b...#38|..I..}q|..w.A..$A..s.A
...`......5&.L<...5.(..u......ai.*.Z.C..!.:...|..xR $.[.]...e<&g
t;.;:.F....z...N[...aYy.V....,.J..........n.&?.JY.NL..G.d -.y.O.H...'.
F..t.5..S.......]n..z........'.....>.`.%.c..5....v.....3./....K0..G
0..C0.. .......*'....?...F$0...*.H........0f1.0...U....BE1.0...U....Gl
obalSign nv-sa1<0:..U...3GlobalSign Organization Validation CA - SH
A256 - G20...161019091216Z..170119091216Z0..1.0...U....BE1.0...U....Gl
obalSign nv-sa1.0...U....2016072511411M0K..U...DGlobalSign Organizatio
n Validation CA - SHA256 - G2 - OCSP Responder0.."0...*.H.............
0.........C..0j..R........0.".e.&.6'.d..._.....8...Y..../..z..-hi.k...
....D.........u..>h....T2..~..*;...v.^.!d.......8.p.e..me...>..V
...l...P.6.V..G..;X.......12U.)D.E([email protected].>l......m
..e;.....n.~..Wb.?..gE.......a.KM.F...}.qo;S...`/..s....6....G.a......
..0..0...U.......M........u....%...G0...U.#..0.....a....)S...};..@..|0
... .....0......0L..U. .E0C0A.. .....2._0402.. ........&hXXps://VVV.gl
obalsign.com/repository/0...U...........0...U.%..0... .......0...*.H..
...............v.bV.......)...c..}.....y=...........L.G%...N.<...8Q
i..Y...........\.fd-.<V=.;0".4..h:v*j..N<M..*...i.Hz{?..[....ML.
.I.Y....r.x.n.dS...J......d.JXT..:..P..B..~.KD....b..&..........."
<<< skipped >>>

GET /rootr3/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBT1nGh/JBjWKnkPdZIzB1bqhelHBwQUj/BLf6guRSSuTVD6Y5qL3uLdG7wCCwQAAAAAATGJxkTJ HTTP/1.1

Cache-Control: max-age = 63784
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Fri, 14 Oct 2016 07:25:53 GMT
If-None-Match: "f081b263d43d33062b0353681d446c25c81fc298"
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp2.globalsign.com


HTTP/1.1 200 OK
Date: Wed, 26 Oct 2016 12:06:33 GMT
Content-Type: application/ocsp-response
Content-Length: 1507
Connection: keep-alive
Set-Cookie: __cfduid=da6a27fe408427c3fb98cabd52ebea0e41477483593; expires=Thu, 26-Oct-17 12:06:33 GMT; path=/; domain=.globalsign.com; HttpOnly
Last-Modified: Wed, 26 Oct 2016 11:52:18 GMT
Expires: Sun, 30 Oct 2016 11:52:18 GMT
ETag: "af8bf92e4699a45708b16423cdbf03cd526e38db"
Cache-Control: public, max-age=344745
CF-Cache-Status: HIT
Server: cloudflare-nginx
CF-RAY: 2f7dc868d094403e-SOF
0..........0..... .....0......0...0......V.I.."JuS]..r......;..2016102
6115218Z0n0l0D0... ..........h.$..*y.u.3.V...G.....K...E$.MP.c........
.......1..D.....20161026115218Z....20161030115218Z0...*.H.............
<...u......_...Lr..........Eh..l!..ZLF...&&.:.Z..S....SYvS6{.......
.{~n..^..wA..q.k.:..Z!.h.J.o... I..Y......Pk|.L...q..9Q.0n.(.>.~#o.
4!J..{.8q.1U..b.U..............j06...Nr..L...i.wN).....e..v{][email protected]
.......mC... .TT....o(oaKu&|..e..mc...N.....5'....*.....0...0...0.....
.....H.i.......3j..0...*.H........0L1 0...U....GlobalSign Root CA - R3
1.0...U....GlobalSign1.0...U....GlobalSign0...160807000000Z..161115000
000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign OC
SP for Root R3 - Signer 1.20.."0...*.H.............0..........so......
.pc....u\.......".@..!...5"tJ.T........|[email protected] 7.@>.=.c..$....
..N..$.[..........u.C$a.I.1.a.cm.i..{ .7.8;..O6.."..".....F..3..'.clY.
Z..!E...S..xp,.....p....=X.v...."...dD...a38\.......>.~|.W\..._....
.hX?...M2..3....6...*s..>...MOY..w.@}..1..........0..0...U.........
..0...U.%..0... .......0...U.......0.0...U......V.I.."JuS]..r......;0.
..U.#..0.....K...E$.MP.c.......0... .....0......0L..U. .E0C0A.. .....2
._0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.......
........}.#..e.a.O._?..K5...^..VX...D.R....Y|.......A._!..sy.N..krV."K
)7.c.F.k.e...e6U..l.........T.......<..#...H..Iw.~....2..*..m0g...E
vEv.....Z......X{u......R...k..!.k......7..;.6.~s{"5F...l".......-... 
..Y......1v.8J..;...r-......J...#T..............8EOc..L..
<<< skipped >>>

GET /CRL/Omniroot2025.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Sat, 16 Nov 2013 06:15:02 GMT
If-None-Match: "200da-5b6-4eb453c33260e"
User-Agent: Microsoft-CryptoAPI/6.1
Host: cdp1.public-trust.com


HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/x-pkcs7-crl
Date: Wed, 26 Oct 2016 12:06:30 GMT
Etag: "200c0-b1c-53fb55344ca83"
Last-Modified: Tue, 25 Oct 2016 19:15:02 GMT
Server: ECS (arn/45CB)
X-Cache: HIT
Content-Length: 2844
0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..161025180751Z..17012
0180751Z0.._0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'yr..150701184507Z0....'#...100303201301Z0....''q..1004
14175202Z0....'L...110224181251Z0....'Pn..110309142119Z0....'....10021
6203312Z0....'#...100303201213Z0....'3#..100908172555Z0....''n..101208
175627Z0....''m..101208175749Z0....''p..101208175916Z0....'H...1101141
62156Z0#...'X>..110815145134Z0.0...U.......0#...'Z2..110818184101Z0
.0...U.......0....'g...120111164333Z0....'g...120111164409Z0....'g...1
20111164519Z0....'....100216213519Z0....''s..100414175225Z0....''k..10
0414181839Z0....'3"..100908172705Z0....'3$..100908172728Z0....''o..101
208175645Z0....''l..101208175727Z0....'H...110119195142Z0....'Nz..1103
02154045Z0....'c...111207220933Z0....'g...120111164445Z0....''r..10041
4175143Z0....'8...101012182723Z0....'e...120111163041Z0....'VJ..110714
160903Z0....'s...130123162633Z0....'....130904190524Z0....'....1310242
14319Z0....'....140129172435Z0....'....140129172453Z0....'....13102421
4310Z0....'....131101204601Z0....'....140219171632Z0....'.^..140409155
638Z0....'i...140709171930Z0....'/:..141119193302Z0....'J...1506031846
05Z0....'k...150603185020Z0....'k...150603185058Z0....'k...15060318513
1Z0....'k...120111220827Z0....'8...140716191203Z0....'....131219195909
Z0....'....140219171545Z0....'k...151105070000Z0....'q...160126173
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCENN6nuImvRO HTTP/1.1
Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Mon, 24 Oct 2016 21:26:25 GMT
Expires: Fri, 28 Oct 2016 21:26:25 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 139207
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
4130253Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.CM.{...N....20161024130253Z....20161031130253Z0...*.H.............?.;
..E.W.........2~.:...L%Pw-m...m...k=."..orj......q,...........Jq....^G
6..l])P.f...e.\.n.z....o%..........TL..T%1V*......".=.T........O.....K
........L}x.f..v#...[..X.u.8..rNO.........w..A.^.2............m..b.NT.
V.O..Q .9....qD.....x..U.....!S.o......@2......


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCn5KPFJmjBe HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 23 Oct 2016 08:52:03 GMT
Expires: Thu, 27 Oct 2016 08:52:03 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 270869
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
3010029Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.).(.I.0^....20161023010029Z....20161030010029Z0...*.H............. A.
..b.;.."...4....M..S4.3(BO.S.z....L=p0..v]........^.....x.....3'..Q..R
.,8F.a^PNzr.*....>V....3.....m.G.\.|1....sU....=..dT.ZF\.Q.s.~..-.|
._K...w.U....{.P..M.e..S.bv...c.C...Ij..u.......eQ.RQ.....`e.IA.s.Y..1
.c.M.."]..V.6.>[.Zl_.c.*.`.d....M....e...%C.L HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Sun, 23 Oct 2016 08:52:03 G
MT..Expires: Thu, 27 Oct 2016 08:52:03 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 270869..Cache-Control: public, max-age=345600..0......
....0..... .....0......0...0......J......h.v....b..Z./..20161023010029
Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..).(.I.
0^....20161023010029Z....20161030010029Z0...*.H............. A...b.;..
"...4....M..S4.3(BO.S.z....L=p0..v]........^.....x.....3'..Q..R.,8F.a^
PNzr.*....>V....3.....m.G.\.|1....sU....=..dT.ZF\.Q.s.~..-.|._K...w
.U....{.P..M.e..S.bv...c.C...Ij..u.......eQ.RQ.....`e.IA.s.Y..1.c.M.."
]..V.6.>[.Zl_.c.*.`.d....M....e...%C.L ....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCEQDmMy02FbF HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 25 Oct 2016 08:59:59 GMT
Expires: Sat, 29 Oct 2016 08:59:59 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 97594
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
5010123Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.D.....V.....20161025010123Z....20161101010123Z0...*.H.............2..
X...../..m.w..=\B..n.....MH.........9=K.O.(...K. .........cxN....'Qd.c
.J..F.v.we...K.1..pQs...F./}.m..g...A..B./...W1f...FJyF.>g..%....&.
....;...eQ...1r.77.RT#BE....%d..N...fY.{.....xX`y.....HM.`..b4F=L...q.
Tx.[.*..Hz...c.D\..]..]k.r[.6..M.......C....E.....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCDysFK5r8h11 HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Wed, 26 Oct 2016 02:03:56 GMT
Expires: Sun, 30 Oct 2016 02:03:56 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 36157
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
5190202Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.<...k..u....20161025190202Z....20161101190202Z0...*.H.............
}.q:OiS3..s..E..T.5..\fy.q...~.".".!.My.[[email protected]..?.G
..~.!.!..p.....I.0W=NO0?.....G....g.-?......)..$...3G8t.J....M_..:x..~
W}...h..(.q..yr.,k.X.... ..:?~..tZ-.]`.7..a".L.F.W...X..!...0.*..\.U..
...nGe..P.h..g.@.........<1...tv.d....w.M.........


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCHiWTKIt8ymy HTTP/1.1

Cache-Control: max-age = 345600
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: clients1.google.com


HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 23 Oct 2016 18:50:03 GMT
Expires: Thu, 27 Oct 2016 18:50:03 GMT
Server: ocsp_responder
Content-Length: 463
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Age: 234990
Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2016102
3070215Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.x.L.-.).....20161023070215Z....20161030070215Z0...*.H..............b.
&%%....G....bS.`[ toa....I~.Zt...Y...).....V.[w..4.Y.;vy..............
u.....n.IJ..0..X9).v.......y..A.......p.4a...}.*..........V.ti...R%6..
..:#.W...U....;.]..a.(9....>.tM?Uq\..m..N......qtKX<..M...._.2.%
.-..r.....................PL.....GY.h1...K.......HTTP/1.1 200 OK..Cont
ent-Type: application/ocsp-response..Date: Sun, 23 Oct 2016 18:50:03 G
MT..Expires: Thu, 27 Oct 2016 18:50:03 GMT..Server: ocsp_responder..Co
ntent-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: S
AMEORIGIN..Age: 234990..Cache-Control: public, max-age=345600..0......
....0..... .....0......0...0......J......h.v....b..Z./..20161023070215
Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./..x.L.-.
).....20161023070215Z....20161030070215Z0...*.H..............b.&%%....
G....bS.`[ toa....I~.Zt...Y...).....V.[w..4.Y.;vy..............u.....n
.IJ..0..X9).v.......y..A.......p.4a...}.*..........V.ti...R%6....:#.W.
..U....;.]..a.(9....>.tM?Uq\..m..N......qtKX<..M...._.2.%.-..r..
...................PL.....GY.h1...K.........


GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w/sCEQCTkoVAAWVxX5R/KI/vyZso HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: subca.ocsp-certum.com


HTTP/1.1 200 OK
Date: Wed, 26 Oct 2016 12:06:35 GMT
Content-Type: application/ocsp-response
Content-Length: 1651
Connection: keep-alive
Content-transfer-encoding: binary
X-Cached: MISS
Server: NetDNA-cache/2.2
X-Cache: HIT
0..o......h0..d.. .....0.....U0..Q0..-........0~1.0...U....PL1"0 ..U..
..Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"
0 ..U....Certum Validation Service..20161026115718Z0r0p0H0... ......y.
..bOm..(y.Y6B...}n...C..m.....i..J.`.:[email protected]_..(....(....2016102
6115718Z....20161102115718Z..0.0... .....0....0... .....0..0...*.H....
.........aF..4..#.....*.......i..@?6..Mn......m..8 ......\gS.........q
f...K1X.....$.8............|..J...z..19w...n..Q.....(..}.T..-.........
f...6...-.9...l.W./o.ob..;.!...Bf<y,7.(..Q..U..xg...:qE.7....9Z....
B...hLE.2..M.es...iM{.(..2..$a."..y.a.....:Y.F..:....P......0...0...0.
...........Y\T..f..Y....HV0...*.H........0>1.0...U....PL1.0...U....
Unizeto Sp. z o.o.1.0...U....Certum CA0...160107125922Z..170206125922Z
0~1.0...U....PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum C
ertification Authority1"0 ..U....Certum Validation Service0.."0...*.H.
............0..........3..>......]{7..\...$vl.....V......T...-.:...
..y..'...X..}.fA\...._.Uxl6.ti %.SS..#. Z.5.G"..S.....)Q...!..P....~0.
.32...Bmd...%.2...D.....J.........6....O.u..vm.l..V.'.L.4.._....\.eK..
.MI.F.;H.;..%...KZ...H;e ..9.2..A.b......F.T..._........DY2...2Z#L.D0)
........0..0...U.......0.0...U.......L.oh.....2......|.=0R..U.#.K0I.B.
@0>1.0...U....PL1.0...U....Unizeto Sp. z o.o.1.0...U....Certum CA..
.. 0...U...........0...U.%..0... .......0... .....0......0...*.H......
.......0.r._(...,.QowB....:......p.....ju.:..-."...e.......Y.b....<
.[..m...qO.A.}....n^..w...=.f...]..mR....j..5...C.(....:a.f..vQ...
<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf/JPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I HTTP/1.1

Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: subca.ocsp-certum.com


HTTP/1.1 200 OK
Date: Wed, 26 Oct 2016 12:06:35 GMT
Content-Type: application/ocsp-response
Content-Length: 1663
Connection: keep-alive
Content-transfer-encoding: binary
X-Cached: HIT
Server: NetDNA-cache/2.2
X-Cache: HIT
0..{......t0..p.. .....0.....a0..]0..-........0~1.0...U....PL1"0 ..U..
..Unizeto Technologies S.A.1'0%..U....Certum Certification Authority1"
0 ..U....Certum Validation Service..20161026120016Z0r0p0H0... .......:
L..!..O'...Q.)..&....v....$.........7Fu......G...dR.oz5I..H....2016102
6120016Z....20161102120016Z..0.0... .....0....0... .....0..0...*.H....
........~...(=3H.a#..1.t.........S2l.i...r.P....9y.....y.....4.. G.~..
.S"...,h1...sKiw.3.{....W.bU_...nd}q.v....F...ga.FW.*=.5.M.N........8.
.....FR.L.ao.FA..N.#...'Iz.Vlp..X..W..?dD..rA..B....&...M.Io.4.C..2..\
.^.._.C...ll.Q../..Q.<.k.u..;~Q..wD...Ge!d....).7........0...0...0.
.........x....4P^[email protected]...*.H........0~1.0...U....PL1"0 ..U....Uniz
eto Technologies S.A.1'0%..U....Certum Certification Authority1"0 ..U.
...Certum Trusted Network CA0...160107130439Z..170206130439Z0~1.0...U.
...PL1"0 ..U....Unizeto Technologies S.A.1'0%..U....Certum Certificati
on Authority1"0 ..U....Certum Validation Service0.."0...*.H...........
..0..........AB...I....z..#U......oD.L.....UX....j.....S.K......".>
w.;.r8....C...Zc...U.}%.....@Ff..`.&.j.`.......ci.Io........pW........
...#[email protected].>su...OyH.E...v...r.]."m.
.7.... ....@.....>.X......M.P@......./[email protected]........
....0..0...U.......0.0...U..........Lw..l..n..n...~.0...U.#..0....v...
.$.........7Fu.0...U...........0...U.%..0... .......0... .....0......0
...*.H.................Rg.....O~y.G G...XJ..S.e.Z0y.h..Np8.=&.P.?....R
...t..>.2........P.......l}..;[email protected]..[..^.?:.yFSu.r.D.yw.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.data

.rsrc

@.reloc

ADVAPI32.dll

ntdll.DLL

KERNEL32.dll

USER32.dll

msvcrt.dll

wbemcomn.dll

OLEAUT32.dll

ole32.dll

loadperf.dll

`.bik

PSSSSSSh

WMIADAP.exe

?CloseSubKey@CRegistry@@AAEXXZ

?CreateOpen@CRegistry@@QAEJPAUHKEY__@@PBGPAGKKPAU_SECURITY_ATTRIBUTES@@PAK@Z

?DeleteCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBG@Z

?DeleteCurrentKeyValue@CRegistry@@QAEKPBG@Z

?DeleteKey@CRegistry@@QAEJPAVCHString@@@Z

?GetCurrentBinaryKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGPAEPAK@Z

?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z

?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGPAEPAK@Z

?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z

?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z

?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z

?GetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z

?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z

?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z

?GetCurrentRawKeyValue@CRegistry@@AAEKPAUHKEY__@@PBGPAXPAK3@Z

?GetCurrentRawSubKeyValue@CRegistry@@AAEKPBGPAXPAK2@Z

?GetCurrentSubKeyCount@CRegistry@@QAEKXZ

?GetCurrentSubKeyName@CRegistry@@QAEKAAVCHString@@@Z

?GetCurrentSubKeyPath@CRegistry@@QAEKAAVCHString@@@Z

?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAK@Z

?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z

?GetCurrentSubKeyValue@CRegistry@@QAEKPBGPAXPAK@Z

?GetLongestSubKeySize@CRegistry@@QAEKXZ

?GethKey@CRegistry@@QAEPAUHKEY__@@XZ

?LocateKeyByNameOrValueName@CRegistrySearch@@QAEHPAUHKEY__@@PBG1PAPBGKAAVCHString@@3@Z

?NextSubKey@CRegistry@@QAEKXZ

?Open@CRegistry@@QAEJPAUHKEY__@@PBGK@Z

?OpenAndEnumerateSubKeys@CRegistry@@QAEJPAUHKEY__@@PBGK@Z

?OpenLocalMachineKeyAndReadValue@CRegistry@@QAEJPBG0AAVCHString@@@Z

?OpenSubKey@CRegistry@@AAEKXZ

?RewindSubKeys@CRegistry@@QAEXXZ

?SearchAndBuildList@CRegistrySearch@@QAEHVCHString@@AAVCHPtrArray@@00HPAUHKEY__@@@Z

?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z

?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z

?SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z

?SetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z

?SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z

?SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z

?SetCurrentKeyValueExpand@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z

?myRegCreateKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKPAGKKQAU_SECURITY_ATTRIBUTES@@PAPAU2@PAK@Z

?myRegDeleteKey@CRegistry@@AAEJPAUHKEY__@@PBG@Z

?myRegDeleteValue@CRegistry@@AAEJPAUHKEY__@@PBG@Z

?myRegEnumKey@CRegistry@@AAEJPAUHKEY__@@KPAGK@Z

?myRegEnumValue@CRegistry@@AAEJPAUHKEY__@@KPAGPAK22PAE2@Z

?myRegOpenKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPAPAU2@@Z

?myRegQueryInfoKey@CRegistry@@AAEJPAUHKEY__@@PAGPAK22222222PAU_FILETIME@@@Z

?myRegQueryValueEx@CRegistry@@AAEJPAUHKEY__@@PBGPAK2PAE2@Z

?myRegSetValueEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPBEK@Z

QSSh0

Invalid parameter passed to C runtime function.

ntdll.dll

RegCloseKey

RegOpenKeyExW

RegCreateKeyExW

RegEnumKeyW

RegDeleteKeyW

RegQueryInfoKeyW

_amsg_exit

_acmdln

?Report@CEventLog@@QAEHGKVCInsertionString@@000000000@Z

WMIADAP.pdb

<assemblyIdentity version="1.0.0.0"

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

5m6z6

%s_x

%s_x_

Global\WMI_SysEvent_Semaphore_%d

WinMSGWMIADAP

\\.\root\cimv2

WMIADAP Msg window

\\.\root\wmi

PSAPI.DLL

x=%s

Describes all the counters supported via WMI Hi-Performance providers

_new.ini

xx %s%s.ini

xx %s

\\.\ROOT\cimv2:__ClassProviderRegistration.provider="\\\\.\\root\\cimv2:__Win32Provider.Name=\"WmiPerfClass\""

WmiApRes.dll

%s\%s

6.1.7600.16385 (win7_rtm.090713-1255)

wmicookr.dll

Windows

Operating System

6.1.7600.16385

%original file name%.exe_2464:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

v2.0.50727

CMemoryExecute.dll

CMemoryExecute

PAGE_EXECUTE_READWRITE

.ctor

System.Reflection

System.Runtime.InteropServices

System.Security.Permissions

System.Diagnostics

System.Runtime.CompilerServices

DllImportAttribute

kernel32.dll

ntdll.dll

System.Security

$8fcd4931-91a2-4e18-849b-70de34ab75df

1.0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb

mscoree.dll

`.rdata

@.data

.rsrc

D$.SPf

 2 34 567

com.apple.Safari

com.apple.WebKit2WebProcess

SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins

"Account","Login Name","Password","Web Site","Comments"

3.7.5

SQLite format 3

CREATE TABLE sqlite_master(

sql text

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins

PK11_GetInternalKeySlot

PK11_CheckUserPassword

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

%Y-%m-%d %H:%M:%S

%Y-%m-%d

%H:%M:%S

SQLITE_

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

oversized integer: %s%s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

automatic extension loading failed: %s

foreign_key_list

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

no such index: %s

sqlite_subquery_%p_

no such table: %s

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

sqlite3_open

sqlite3_prepare

sqlite3_step

sqlite3_column_text

sqlite3_column_int

sqlite3_column_int64

sqlite3_finalize

sqlite3_close

sqlite3_exec

f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

msvcrt.dll

_wcmdln

COMCTL32.dll

VERSION.dll

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumChildWindows

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

5JEw%Xg

<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

hXXp://VVV.usertrust.com1

3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05

hXXp://ocsp.usertrust.com0

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

hXXps://secure.comodo.net/CPS0A

0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

hXXp://ocsp.comodoca.com0

[email protected]

t{SSh

v%SSW

Mail PassView

Mozilla\Profiles

Software\Mozilla\Mozilla Thunderbird

%s\Main

sqlite3.dll

nss3.dll

%programfiles%\Mozilla Thunderbird

AddExportHeaderLine

%s %s %s

HTTPMail User Name

SMTP USer Name

HTTPMail Server

SMTP Server

POP3 Password2

IMAP Password2

HTTPMail Password2

SMTP Password2

POP3 Port

IMAP Port

HTTPMail Port

SMTP Port

HTTPMail Secure Connection

SMTP Secure Connection

SMTP Display Name

SMTP Email Address

POP3 Password

IMAP Password

HTTP Password

SMTP Password

HTTP User

SMTP User

HTTP Server URL

HTTP Port

HTTPMail Use SSL

SMTP Use SSL

%s\%s

PopPort

PopPassword

SMTPAccount

SMTPServer

SMTPPort

SMTPLogSecure

SMTPPassword

%s\Accounts

LoginName

SavePasswordText

ESMTPUsername

ESMTPPassword

POP3Password

fb.dat

%[email protected]

%[email protected]

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

<meta http-equiv='content-type' content='text/html;charset=%s'>

<br><h4>%s <a href="hXXp://VVV.nirsoft.net/" target="newwin">%s</a></h4><p>

smtp

advapi32.dll

comctl32.dll

*.ini

netmsg.dll

Error %d: %s

%s (%s)

menu_%d

dialog_%d

TranslatorURL

_lng.ini

%-18s: %s

%%-%d.%ds

<td bgcolor=#%s nowrap>%s

<td bgcolor=#%s>%s

<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s

bgcolor="%s"

<font color="%s">%s</font>

<%s>%s</%s>

</%s>

report.html

*.txt

*.htm;*.html

*.xml

*.csv

Software\NirSoft\MailPassView

MailPassView

/skeepass

/deleteregkey

Failed to load the executable file !

mail.account.account

mail.server

port

mail.identity

signon.signonfilename

mailbox://%s@%s

imap://%s@%s

mailbox://%s

imap://%s

signons.txt

signons.sqlite

prefs.js

Password.NET Messenger Service

User.NET Messenger Service

Passport.Net\*

ps:password

windowslive:name=

Exception %8.8X at address %8.8X in module %s

Stack Data: %s

Code Data: %s

mozsqlite3.dll

psapi.dll

pstorec.dll

5e7e8100-9138-11d1-945a-00c04fc308ff

00000000-0000-0000-0000-000000000000

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417E2D75-84BD-11D0-84BB-00C04FD43F8F

shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

<html><head>%s<title>%s</title></head>

%s <h3>%s</h3>

size="%d"

color="#%s"

<font color="%s">

<table border="1" cellpadding="5"><tr%s>

width="%s"

<th%s>%s%s%s

SOFTWARE\Mozilla

mozilla

%s\bin

PathToExe

\sqlite3.dll

\mozsqlite3.dll

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SMTP_Server

SMTP_User_Name

POP3_Password2

IMAP_Password2

NNTP_Password2

SMTP_Password2

SMTP_Email_Address

SMTP_Port

NNTP_Port

IMAP_Port

POP3_Port

SMTP_Secure_Connection

*.oeaccount

\Microsoft\Windows Mail

\Microsoft\Windows Live Mail

f:\Projects\VS2005\mailpv\Release\mailpv.pdb

_acmdln

RPCRT4.dll

GetWindowsDirectoryA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyA

RegEnumKeyExA

ShellExecuteA

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Phulli.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

tapi32.dll

rtm.dll

user32.dll

Phulli.Resources.resources

Phulli.Form1.resources

Phulli.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

.cctor

System.Threading

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

ContainsKey

InvalidOperationException

MyWebServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

Phulli.My.Resources

System.Resources

get_CMemoryExecute

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

11.0.0.0

My.Settings

$1f128a07-8438-4dc0-8205-570da0ccce8d

_CorExeMain

<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

%%0.ß

Apple Computer\Preferences\keychain.plist

LoadPasswordsIE

LoadPasswordsFirefox

LoadPasswordsChrome

LoadPasswordsOpera

LoadPasswordsSafari

LoadPasswordsSeaMonkey

UseFirefoxProfileFolder

UseFirefoxInstallFolder

UseChromeProfileFolder

UseOperaPasswordFile

FirefoxProfileFolder

FirefoxInstallFolder

ChromeProfileFolder

OperaPasswordFile

Aadvapi32.dll

crypt32.dll

777705555443332

5555443332

5555443332

wand.dat

@nss3.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe

%programfiles%\Sea Monkey

%programfiles%\Mozilla Firefox

-signons.txt

signons2.txt

signons3.txt

@dllhost.exe

taskhost.exe

taskhostex.exe

Microsoft\Windows\WebCache\WebCacheV01.dat

Microsoft\Windows\WebCache\WebCacheV24.dat

index.dat

hXXps://VVV.google.com/accounts/servicelogin

hXXp://VVV.facebook.com/

hXXps://login.yahoo.com/config/login

hXXp://

hXXps://

PTF://

@history.dat

places.sqlite

Mozilla\Firefox\Profiles

Mozilla\SeaMonkey\Profiles

Mozilla\SeaMonkey

Mozilla\Firefox

profiles.ini

Profile%d

tntdll.dll

sWeb Data

Login Data

Google\Chrome\User Data

Google\Chrome SxS\User Data

Opera\Opera\wand.dat

Opera\Opera7\profile\wand.dat

Opera

@"%s"

Ashell32.dll

\nss3.dll

.save

vaultcli.dll

abe2869f-9b47-4cd9-a358-c22904dba7f7

Copy &Password

&HTML Report - All Items

HTML R&eport - Selected Items

HTML Report - All Items

HTML Report - Selected Items

Load Passwords From...

Google Chrome

Mozilla Firefox

SeaMonkey

Firefox Options

Master password:

Firefox Profile:

Firefox Installation:

Chrome Options

Opera Options

wand.dat file:

%d Passwords

, %d Selected

Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)

Loading... %d

KeePass csv file

Opera Password File

Firefox 1.x

Firefox 2.x

Firefox 3.0

Firefox

Chrome

Web Browser

Password

Password Strength

Password Field

WebBrowserPassView.exe

VVV.google.com/Please log in to your Gmail account

VVV.google.com:443/Please log in to your Gmail account

VVV.google.com/Please log in to your Google Account

VVV.google.com:443/Please log in to your Google Account

VVV.google.com

dWindowsLive:name=*

82BD0E67-9FEA-4748-8672-D5EFE5B779B0

Copy Password

%d items

Select Eudora.ini filename/Select the location of Thunderbird installation

Eudora.ini file

SMTP

Windows Mail

Windows Live Mail

Server Port

SMTP Server Port

Mail Password Recovery

mailpv.exe

noftp

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

Dear HawkEye Customers!

HawkEye Logger Details:

Keylogger Enabled:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

WEB Browser Password Stealer

Mail Messenger Password Stealer

JDownloader Password Stealer

HawkEye_Keylogger_Stealer_Records_

HawkEye Keylogger | Stealer Records |

holderwb.txt"

holderwb.txt

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Stealer |

HawkEye Keylogger | BitCoin Stealer |

Steals the Wallet.DAT file that holds the users bitcoin currency.

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Stealer |

As you can see, this email has the attached file, containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keylog Records |

Keylog Records

.jpeg

HawkEye_Keylogger_Keylog_Records_

hXXp://whatismyipaddress.com/

Phulli.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

taskhost.exe_3296:

.text

`.data

.rsrc

@.reloc

msvcrt.dll

ole32.dll

OLEAUT32.dll

KERNEL32.dll

NTDLL.DLL

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

USER32.dll

RPCRT4.dll

d:\w7rtm\admin\wmi\jobs\ubpmlibs\comtaskhost\comtaskapi.cpp

The likely culprit task is stuck on the same stack with %S.

d:\w7rtm\admin\wmi\jobs\ubpmlibs\closewinapp\closewinapp.cpp

Invalid parameter passed to C runtime function.

taskhost.pdb

_wcmdln

_amsg_exit

InitOnceExecuteOnce

SetProcessShutdownParameters

MsgWaitForMultipleObjects

EnumThreadWindows

EnumWindows

ntdll.dll

GetProcessHeap

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

bStartComTask() --> h=0x%x ret=%d

StopComTask(0x%x) --> ret=%d

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

ComTaskMgrWnd(0x%x)::ShutdownTasksWorker()

ComTaskMgrWnd(0x%x)::Shutdown(%ws)

gCleanupSet()::Remove(0x%x)

ComTaskHost(0x%x)::WaitForTaskStartCompletion() --> 0x%x

ComTaskHost(0x%x)::WaitForTaskStartCompletion()

ComTaskHost(0x%x)::%ws() --> ReleaseLifetimeRef(this)

ComTaskHost(0x%x)::StopTaskWorker() --> 0x%x

ComTaskHost(0x%x)::StopTaskWorker()

ComTaskHost(0x%x)::Shutdown()

ComTaskHost(0x%x)::HandleReportingState(0x%x) --> 0x%x

ComTaskHost(0x%x): UbpmReportTaskStatus(0x%x) --> 0x%x

ComTaskHost(0x%x)::StartTaskWorker() --> 0x%x

ITaskHandler::Start(0x%x,"%ws") --> 0x%x

ComTaskHost(0x%x)::StartTaskWorker() --> ITaskHandler(0x%x)::Start(0x%x,"%ws")

ComTaskHost(0x%x)::StartTaskWorker()

ComTaskHost(0x%x)::Stop --> 0x%x

ComTaskHost(0x%x)::Stop - CreateThread failed with 0x%x

StartTaskThread(0x%x) bailed out because of shutdown

ComTaskHost(0x%x)::~ComTaskHost()

ComTaskHost(0x%x)::Start --> 0x%x

ComTaskHost(0x%x)::TaskCompleted() skipped because of shutdown

ComTaskHost(0x%x)::TaskCompleted(0x%x)

ComTaskHost(0x%x)::AddRef -> m_cRef = %d

ComTaskHost(0x%x)::Release -> m_cRef = %d

WinAppTerminator: found wnd 0x%x for pid %d.

WinAppTerminator: forced WM_CLOSE sent to top wnd 0x%x.

WinAppTerminator: EnumThreadWindows failed err=%d.

Host Process for Windows Tasks

6.1.7601.17514 (win7sp1_rtm.101119-1850)

taskhost.exe

Windows

Operating System

6.1.7601.17514

%original file name%.exe_2464_rwx_00400000_00088000:

.text

`.rsrc

@.reloc

lSystem.Resources.ResourceReader, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet

v2.0.50727

CMemoryExecute.dll

CMemoryExecute

PAGE_EXECUTE_READWRITE

.ctor

System.Reflection

System.Runtime.InteropServices

System.Security.Permissions

System.Diagnostics

System.Runtime.CompilerServices

DllImportAttribute

kernel32.dll

ntdll.dll

System.Security

$8fcd4931-91a2-4e18-849b-70de34ab75df

1.0.0.0

System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089

C:\Users\Jovan\Documents\Visual Studio 2010\Projects\Stealer\CMemoryExecute\CMemoryExecute\obj\Release\CMemoryExecute.pdb

mscoree.dll

`.rdata

@.data

.rsrc

D$.SPf

 2 34 567

com.apple.Safari

com.apple.WebKit2WebProcess

SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins

"Account","Login Name","Password","Web Site","Comments"

3.7.5

SQLite format 3

CREATE TABLE sqlite_master(

sql text

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins

PK11_GetInternalKeySlot

PK11_CheckUserPassword

large file support is disabled

unknown operation

SQL logic error or missing database

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_source_id

sqlite_version

sqlite_attach

sqlite_detach

sqlite_stat1

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_table

%Y-%m-%d %H:%M:%S

%Y-%m-%d

%H:%M:%S

SQLITE_

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

922337203685477580

API call with %s database connection pointer

%s-shm

%s\etilqs_

OsError 0x%x (%u)

Recovered %d frames from WAL file %s

%s-mjX

foreign key constraint failed

unable to use function %s in the requested context

abort at %d in [%s]: %s

constraint failed at %d in [%s]

cannot open savepoint - SQL statements in progress

no such savepoint: %s

cannot %s savepoint - SQL statements in progress

cannot rollback transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

sqlite_master

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot change %s wal mode from within a transaction

statement aborts at %d: [%s] %s

misuse of aliased aggregate %s

%s: %s.%s.%s

%s: %s.%s

%s: %s

%r %s BY term out of range - should be between 1 and %d

too many terms in %s BY clause

Expression tree is too large (maximum depth %d)

variable number must be between ?1 and ?%d

too many SQL variables

too many columns in %s

oversized integer: %s%s

misuse of aggregate: %s()

%.*s"%w"%s

%s%.*s"%w"

%s OR name=%Q

type='trigger' AND (%s)

there is already another table or index with this name: %s

sqlite_

table %s may not be altered

view %s may not be altered

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

Cannot add a PRIMARY KEY column

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

sqlite_altertab_%s

CREATE TABLE %Q.%s(%s)

DELETE FROM %Q.%s WHERE tbl=%Q

SELECT tbl, idx, stat FROM %Q.sqlite_stat1

invalid name: "%s"

too many attached databases - max %d

database %s is already in use

unable to open database: %s

no such database: %s

cannot detach database %s

database %s is locked

%s %T cannot reference objects in database %s

object name reserved for internal use: %s

there is already an index named %s

too many columns on %s

duplicate column name: %s

default value of column [%s] is not constant

table "%s" has more than one primary key

no such collation sequence: %s

CREATE %s %.*s

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

view %s is circularly defined

table %s may not be dropped

use DROP TABLE to delete table %s

use DROP VIEW to delete view %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q

foreign key on %s should reference only one column of table %T

number of columns in foreign key does not match the number of columns in the referenced table

unknown column "%s" in foreign key definition

indexed columns are not unique

table %s may not be indexed

views may not be indexed

virtual tables may not be indexed

there is already a table named %s

index %s already exists

sqlite_autoindex_%s_%d

table %s has no column named %s

CREATE%s INDEX %.*s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

no such index: %S

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q

a JOIN clause is required before %s

unable to identify the object to be reindexed

table %s may not be modified

cannot modify %s because it is a view

foreign key mismatch

table %S has %d columns but %d values were supplied

%d values for %d columns

table %S has no column named %s

%s.%s may not be NULL

PRIMARY KEY must be unique

automatic extension loading failed: %s

foreign_key_list

malformed database schema (%s)

%s - %s

unsupported file format

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

a NATURAL join may not have an ON or USING clause

cannot have both ON and USING clauses in the same join

cannot join using column %s - column not present in both tables

%s.%s

%s:%d

no such index: %s

sqlite_subquery_%p_

no such table: %s

cannot create %s trigger on view: %S

cannot create INSTEAD OF trigger on table: %S

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

no such trigger: %S

no such column: %s

cannot VACUUM - SQL statements in progress

PRAGMA vacuum_db.synchronous=OFF

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

vtable constructor failed: %s

vtable constructor did not declare schema: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

at most %d tables in a join

cannot use index: %s

the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

unable to close due to unfinished backup operation

unknown database: %s

no such vfs: %s

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

sqlite3_open

sqlite3_prepare

sqlite3_step

sqlite3_column_text

sqlite3_column_int

sqlite3_column_int64

sqlite3_finalize

sqlite3_close

sqlite3_exec

f:\Projects\VS2005\WebBrowserPassView\Release\WebBrowserPassView.pdb

msvcrt.dll

_wcmdln

COMCTL32.dll

VERSION.dll

FindCloseUrlCache

FindNextUrlCacheEntryW

FindFirstUrlCacheEntryW

WININET.dll

GetWindowsDirectoryW

KERNEL32.dll

EnumChildWindows

USER32.dll

GDI32.dll

comdlg32.dll

RegCloseKey

RegOpenKeyExW

RegEnumKeyExW

ADVAPI32.dll

ShellExecuteW

SHELL32.dll

ole32.dll

5JEw%Xg

<assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity>

hXXp://VVV.usertrust.com1

3hXXp://crl.usertrust.com/AddTrustExternalCARoot.crl05

hXXp://ocsp.usertrust.com0

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl05

1hXXp://crl.usertrust.com/UTN-USERFirst-Object.crl0t

1hXXp://crt.usertrust.com/UTNAddTrustObject_CA.crt0%

hXXps://secure.comodo.net/CPS0A

0hXXp://crl.comodoca.com/COMODOCodeSigningCA2.crl0r

0hXXp://crt.comodoca.com/COMODOCodeSigningCA2.crt0$

hXXp://ocsp.comodoca.com0

[email protected]

t{SSh

v%SSW

Mail PassView

Mozilla\Profiles

Software\Mozilla\Mozilla Thunderbird

%s\Main

sqlite3.dll

nss3.dll

%programfiles%\Mozilla Thunderbird

AddExportHeaderLine

%s %s %s

HTTPMail User Name

SMTP USer Name

HTTPMail Server

SMTP Server

POP3 Password2

IMAP Password2

HTTPMail Password2

SMTP Password2

POP3 Port

IMAP Port

HTTPMail Port

SMTP Port

HTTPMail Secure Connection

SMTP Secure Connection

SMTP Display Name

SMTP Email Address

POP3 Password

IMAP Password

HTTP Password

SMTP Password

HTTP User

SMTP User

HTTP Server URL

HTTP Port

HTTPMail Use SSL

SMTP Use SSL

%s\%s

PopPort

PopPassword

SMTPAccount

SMTPServer

SMTPPort

SMTPLogSecure

SMTPPassword

%s\Accounts

LoginName

SavePasswordText

ESMTPUsername

ESMTPPassword

POP3Password

fb.dat

%[email protected]

%[email protected]

Software\Microsoft\Windows Messaging Subsystem\Profiles

Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

<meta http-equiv='content-type' content='text/html;charset=%s'>

<br><h4>%s <a href="hXXp://VVV.nirsoft.net/" target="newwin">%s</a></h4><p>

smtp

advapi32.dll

comctl32.dll

*.ini

netmsg.dll

Error %d: %s

%s (%s)

menu_%d

dialog_%d

TranslatorURL

_lng.ini

%-18s: %s

%%-%d.%ds

<td bgcolor=#%s nowrap>%s

<td bgcolor=#%s>%s

<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s

bgcolor="%s"

<font color="%s">%s</font>

<%s>%s</%s>

</%s>

report.html

*.txt

*.htm;*.html

*.xml

*.csv

Software\NirSoft\MailPassView

MailPassView

/skeepass

/deleteregkey

Failed to load the executable file !

mail.account.account

mail.server

port

mail.identity

signon.signonfilename

mailbox://%s@%s

imap://%s@%s

mailbox://%s

imap://%s

signons.txt

signons.sqlite

prefs.js

Password.NET Messenger Service

User.NET Messenger Service

Passport.Net\*

ps:password

windowslive:name=

Exception %8.8X at address %8.8X in module %s

Stack Data: %s

Code Data: %s

mozsqlite3.dll

psapi.dll

pstorec.dll

5e7e8100-9138-11d1-945a-00c04fc308ff

00000000-0000-0000-0000-000000000000

220D5CD0-853A-11D0-84BC-00C04FD43F8F

220D5CD1-853A-11D0-84BC-00C04FD43F8F

220D5CC1-853A-11D0-84BC-00C04FD43F8F

417E2D75-84BD-11D0-84BB-00C04FD43F8F

shell32.dll

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

shlwapi.dll

<html><head>%s<title>%s</title></head>

%s <h3>%s</h3>

size="%d"

color="#%s"

<font color="%s">

<table border="1" cellpadding="5"><tr%s>

width="%s"

<th%s>%s%s%s

SOFTWARE\Mozilla

mozilla

%s\bin

PathToExe

\sqlite3.dll

\mozsqlite3.dll

Software\Microsoft\Windows Mail

Software\Microsoft\Windows Live Mail

SMTP_Server

SMTP_User_Name

POP3_Password2

IMAP_Password2

NNTP_Password2

SMTP_Password2

SMTP_Email_Address

SMTP_Port

NNTP_Port

IMAP_Port

POP3_Port

SMTP_Secure_Connection

*.oeaccount

\Microsoft\Windows Mail

\Microsoft\Windows Live Mail

f:\Projects\VS2005\mailpv\Release\mailpv.pdb

_acmdln

RPCRT4.dll

GetWindowsDirectoryA

RegDeleteKeyA

RegOpenKeyExA

RegEnumKeyA

RegEnumKeyExA

ShellExecuteA

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="NirSoft" type="win32"></assemblyIdentity><description>NirSoft</description><dependency><dependentAssembly><assemblyIdentity type="Win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency></assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD

Phulli.exe

Microsoft.VisualBasic

System.Windows.Forms

System.Drawing

System.Management

tapi32.dll

rtm.dll

user32.dll

Phulli.Resources.resources

Phulli.Form1.resources

Phulli.My

WindowsFormsApplicationBase

Microsoft.VisualBasic.ApplicationServices

System.Collections.Generic

.cctor

System.Threading

System.ComponentModel

System.CodeDom.Compiler

Microsoft.VisualBasic.Devices

m_MyWebServicesObjectProvider

get_WebServices

HelpKeywordAttribute

System.ComponentModel.Design

WebServices

Microsoft.VisualBasic.CompilerServices

System.Collections

ContainsKey

InvalidOperationException

MyWebServices

encryptedpassstring

encryptedsmtpstring

portstring

encryptedftphost

encryptedftpuser

encryptedftppass

useftp

websitevisitor

websiteblocker

passstring

smtpstring

ftphost

ftpuser

ftppass

WM_KEYUP

WM_KEYDOWN

WM_SYSKEYDOWN

WM_SYSKEYUP

KeyboardHandle

KeyLog

CleanedPasswordsMAIL

CleanedPasswordsWB

System.IO

get_ExecutablePath

WindowsIdentity

System.Security.Principal

set_WindowState

FormWindowState

UnhookWindowsHookEx

SetWindowsHookEx

SetWindowsHookExA

GetAsyncKeyState

vKey

HookKeyboard

UnhookKeyboard

Operators

get_Keyboard

Keyboard

get_CtrlKeyDown

get_AltKeyDown

KeyboardCallback

set_UseShellExecute

Microsoft.VisualBasic.MyServices

System.Collections.ObjectModel

MsgBox

MsgBoxResult

MsgBoxStyle

ForceSteamLogin

System.Net.NetworkInformation

get_OperationalStatus

OperationalStatus

FakemsgInstall

System.Net.Mail

SmtpClient

System.Globalization

set_Port

System.Net

Microsoft.Win32

RegistryKey

OpenSubKey

System.Security.Cryptography

System.Text

set_Key

stealWebroswers

WebClient

readweb

System.IO.Compression

SendLogsFTP

FtpWebRequest

WebRequest

UploadFTP

secretKey

set_KeySize

get_KeySize

System.Net.Sockets

virtualKey

KeyboardHookDelegate

get_Msg

Phulli.My.Resources

System.Resources

get_CMemoryExecute

get_WebBrowserPassView

WebBrowserPassView

System.Configuration

8.0.0.0

My.Computer

My.Application

My.User

My.Forms

My.WebServices

System.Windows.Forms.Form

My.MyProject.Forms

4System.Web.Services.Protocols.SoapHttpClientProtocol

3System.Resources.Tools.StronglyTypedResourceBuilder

4.0.0.0

KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator

11.0.0.0

My.Settings

$1f128a07-8438-4dc0-8205-570da0ccce8d

_CorExeMain

<assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>

<requestedExecutionLevel level="asInvoker" uiAccess="false"/>

%%0.ß

Apple Computer\Preferences\keychain.plist

LoadPasswordsIE

LoadPasswordsFirefox

LoadPasswordsChrome

LoadPasswordsOpera

LoadPasswordsSafari

LoadPasswordsSeaMonkey

UseFirefoxProfileFolder

UseFirefoxInstallFolder

UseChromeProfileFolder

UseOperaPasswordFile

FirefoxProfileFolder

FirefoxInstallFolder

ChromeProfileFolder

OperaPasswordFile

Aadvapi32.dll

crypt32.dll

777705555443332

5555443332

5555443332

wand.dat

@nss3.dll

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe

%programfiles%\Sea Monkey

%programfiles%\Mozilla Firefox

-signons.txt

signons2.txt

signons3.txt

@dllhost.exe

taskhost.exe

taskhostex.exe

Microsoft\Windows\WebCache\WebCacheV01.dat

Microsoft\Windows\WebCache\WebCacheV24.dat

index.dat

hXXps://VVV.google.com/accounts/servicelogin

hXXp://VVV.facebook.com/

hXXps://login.yahoo.com/config/login

hXXp://

hXXps://

PTF://

@history.dat

places.sqlite

Mozilla\Firefox\Profiles

Mozilla\SeaMonkey\Profiles

Mozilla\SeaMonkey

Mozilla\Firefox

profiles.ini

Profile%d

tntdll.dll

sWeb Data

Login Data

Google\Chrome\User Data

Google\Chrome SxS\User Data

Opera\Opera\wand.dat

Opera\Opera7\profile\wand.dat

Opera

@"%s"

Ashell32.dll

\nss3.dll

.save

vaultcli.dll

abe2869f-9b47-4cd9-a358-c22904dba7f7

Copy &Password

&HTML Report - All Items

HTML R&eport - Selected Items

HTML Report - All Items

HTML Report - Selected Items

Load Passwords From...

Google Chrome

Mozilla Firefox

SeaMonkey

Firefox Options

Master password:

Firefox Profile:

Firefox Installation:

Chrome Options

Opera Options

wand.dat file:

%d Passwords

, %d Selected

Web Browser Passwords%Choose another Firefox profile folder)Choose the installation folder of Firefox,Choose another profile of Chrome Web browser,Choose the password file of Opera (wand.dat)

Loading... %d

KeePass csv file

Opera Password File

Firefox 1.x

Firefox 2.x

Firefox 3.0

Firefox

Chrome

Web Browser

Password

Password Strength

Password Field

WebBrowserPassView.exe

VVV.google.com/Please log in to your Gmail account

VVV.google.com:443/Please log in to your Gmail account

VVV.google.com/Please log in to your Google Account

VVV.google.com:443/Please log in to your Google Account

VVV.google.com

dWindowsLive:name=*

82BD0E67-9FEA-4748-8672-D5EFE5B779B0

Copy Password

%d items

Select Eudora.ini filename/Select the location of Thunderbird installation

Eudora.ini file

SMTP

Windows Mail

Windows Live Mail

Server Port

SMTP Server Port

Mail Password Recovery

mailpv.exe

noftp

Disablecmd

\Windows Update.exe

\WindowsUpdate.exe

SysInfo.txt

\pid.txt

\pidloc.txt

HawkEyeKeylogger

\Mozilla\Firefox\Profiles

127.0.0.1

\SteamAppData.vdf

\ClientRegistry.blob

Dear HawkEye Customers!

HawkEye Logger Details:

Keylogger Enabled:

Operating System:

HawkEye_Keylogger_Execution_Confirmed_

HawkEye Keylogger | Execution Confirmed |

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

autorun.inf

open=Sys.exe

Sys.exe

Software\Microsoft\Windows\CurrentVersion\Run

Windows Update

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

\bitcoin\wallet.dat

_wallet.dat

wallet.dat

Microsoft.NET\Framework\v2.0.50727\vbc.exe

holdermail.txt"

holdermail.txt

Operating System Intel Recovery

Operating System Platform:

Operating System Version:

WEB Browser Password Stealer

Mail Messenger Password Stealer

JDownloader Password Stealer

HawkEye_Keylogger_Stealer_Records_

HawkEye Keylogger | Stealer Records |

holderwb.txt"

holderwb.txt

C:\Users\

_Pin0.jpeg

_Pin1.jpeg

_Pin2.jpeg

_Pin3.jpeg

_Pin4.jpeg

HawkEye Keylogger | RuneScape Stealer |

HawkEye Keylogger | BitCoin Stealer |

Steals the Wallet.DAT file that holds the users bitcoin currency.

\.minecraft\lastlogin

HawkEye Keylogger | MineCraft Stealer |

As you can see, this email has the attached file, containing MineCraft Username and Password. Please download it then decrypt the login credential / information with MineCraft Decryptor.

HawkEye Keylogger | Keylog Records |

Keylog Records

.jpeg

HawkEye_Keylogger_Keylog_Records_

hXXp://whatismyipaddress.com/

Phulli.Resources

:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

%original file name%.exe_2464_rwx_6A752000_00002000:

.uj3J

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   vbc.exe:3204
   %original file name%.exe:2800
   %original file name%.exe:1172

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\holderwb.txt (2 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\pid.txt (4 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\pidloc.txt (39 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsUpdate.exe (8281 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Cab7C.tmp (51 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Tar7D.tmp (2712 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\TarD6DF.tmp (2712 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\Local\Temp\CabD6DE.tmp (51 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6 (1212 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9A19ADAD9D098E039450ABBEDD5616EB_C0EF0ACA283949F41711EFB55E3F0ABC (1 bytes)
   C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9A19ADAD9D098E039450ABBEDD5616EB_C0EF0ACA283949F41711EFB55E3F0ABC (1480 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "Windows Update" = "C:\Users\"%CurrentUserName%"\AppData\Roaming\WindowsUpdate.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
7. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.