API tools faq
paste
paladin316

Exes_84155499d2369c6500818114b083bdd1_1.json

paladin316
Jun 19th, 2019
2,193
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 148.02 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_84155499d2369c6500818114b083bdd1.1"
  7. [*] File Size: 1131696
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "fe16265680e080f79ae49f0aad84de61dbd3ec4c530484b5f21cb548cbe477d3"
  10. [*] MD5: "84155499d2369c6500818114b083bdd1"
  11. [*] SHA1: "aaf82775b1fdbf13c17f9360334f8bbaa91f1637"
  12. [*] SHA512: "490a8a67ae5a1c7b99ffbedc1032f73f05e94ed847cec8ea6e14e9b7e9ed20f4df3a8ea462feb484028695331492a1927e074dde8482fc966862798ece46561f"
  13. [*] CRC32: "54A73D14"
  14. [*] SSDEEP: "12288:ZN0ZJqjTmxzrFVXzpYJikgDx9+G1OkparCaF6p+hTimuulW6oqJuSRSMUC:D0Z0H4PXXzugDDGOyINqkrM9"
  15.  
  16. [*] Process Execution: [
  17. "Exes_84155499d2369c6500818114b083bdd1.1",
  18. "vssadmin.exe",
  19. "vssadmin.exe"
  20. ]
  21.  
  22. [*] Signatures Detected: [
  23. {
  24. "Description": "Creates RWX memory",
  25. "Details": []
  26. },
  27. {
  28. "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
  29. "Details": [
  30. {
  31. "IP": "51.75.143.145:9001"
  32. },
  33. {
  34. "IP": "136.243.131.29:9001"
  35. },
  36. {
  37. "IP": "89.163.224.143:9001"
  38. },
  39. {
  40. "IP": "127.0.0.1:48496"
  41. },
  42. {
  43. "IP": "128.31.0.39:9101"
  44. },
  45. {
  46. "IP": "54.36.165.170:8443"
  47. },
  48. {
  49. "IP": "154.35.32.5:443"
  50. },
  51. {
  52. "IP": "194.109.206.212:443"
  53. },
  54. {
  55. "IP": "104.16.155.36:80"
  56. },
  57. {
  58. "IP": "104.16.154.36:80"
  59. }
  60. ]
  61. },
  62. {
  63. "Description": "Starts servers listening on 127.0.0.1:48496",
  64. "Details": []
  65. },
  66. {
  67. "Description": "Reads data out of its own binary image",
  68. "Details": [
  69. {
  70. "self_read": "process: Exes_84155499d2369c6500818114b083bdd1.1, pid: 584, offset: 0x00000000, length: 0x0000005c"
  71. }
  72. ]
  73. },
  74. {
  75. "Description": "Performs some HTTP requests",
  76. "Details": [
  77. {
  78. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  79. },
  80. {
  81. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  82. },
  83. {
  84. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  85. },
  86. {
  87. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  88. },
  89. {
  90. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  91. },
  92. {
  93. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  94. },
  95. {
  96. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  97. },
  98. {
  99. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  100. },
  101. {
  102. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  103. },
  104. {
  105. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  106. },
  107. {
  108. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  109. },
  110. {
  111. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  112. },
  113. {
  114. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  115. },
  116. {
  117. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  118. },
  119. {
  120. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  121. },
  122. {
  123. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  124. },
  125. {
  126. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  127. },
  128. {
  129. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  130. },
  131. {
  132. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  133. },
  134. {
  135. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  136. },
  137. {
  138. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  139. },
  140. {
  141. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  142. },
  143. {
  144. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  145. },
  146. {
  147. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe"
  148. },
  149. {
  150. "url": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes"
  151. },
  152. {
  153. "url": "http://whatismyipaddress.com/"
  154. }
  155. ]
  156. },
  157. {
  158. "Description": "The binary likely contains encrypted or compressed data.",
  159. "Details": [
  160. {
  161. "section": "name: .rdata, entropy: 7.21, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00105400, virtual_size: 0x001053ae"
  162. }
  163. ]
  164. },
  165. {
  166. "Description": "Looks up the external IP address",
  167. "Details": [
  168. {
  169. "domain": "whatismyipaddress.com"
  170. }
  171. ]
  172. },
  173. {
  174. "Description": "Attempts to delete volume shadow copies",
  175. "Details": []
  176. },
  177. {
  178. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  179. "Details": [
  180. {
  181. "Spam": "Exes_84155499d2369c6500818114b083bdd1.1 (584) called API LdrLoadDll 114100 times"
  182. }
  183. ]
  184. },
  185. {
  186. "Description": "Installs Tor on the infected machine",
  187. "Details": []
  188. },
  189. {
  190. "Description": "Installs itself for autorun at Windows startup",
  191. "Details": [
  192. {
  193. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem"
  194. },
  195. {
  196. "data": "\"C:\\ProgramData\\Windows\\csrss.exe\""
  197. }
  198. ]
  199. },
  200. {
  201. "Description": "Collects information about installed applications",
  202. "Details": [
  203. {
  204. "Program": "Google Update Helper"
  205. },
  206. {
  207. "Program": "Python 3.7.2"
  208. },
  209. {
  210. "Program": "Microsoft Excel MUI 2013"
  211. },
  212. {
  213. "Program": "Microsoft Outlook MUI 2013"
  214. },
  215. {
  216. "Program": "Python 2.7.15"
  217. },
  218. {
  219. "Program": "Google Chrome"
  220. },
  221. {
  222. "Program": "Adobe Flash Player 29 NPAPI"
  223. },
  224. {
  225. "Program": "Adobe Flash Player 29 ActiveX"
  226. },
  227. {
  228. "Program": "Microsoft DCF MUI 2013"
  229. },
  230. {
  231. "Program": "Microsoft Access MUI 2013"
  232. },
  233. {
  234. "Program": "Microsoft Office Proofing Tools 2013 - English"
  235. },
  236. {
  237. "Program": "Adobe Acrobat Reader DC"
  238. },
  239. {
  240. "Program": "Microsoft Publisher MUI 2013"
  241. },
  242. {
  243. "Program": "Microsoft Office Shared MUI 2013"
  244. },
  245. {
  246. "Program": "Microsoft Office OSM MUI 2013"
  247. },
  248. {
  249. "Program": "Microsoft InfoPath MUI 2013"
  250. },
  251. {
  252. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  253. },
  254. {
  255. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  256. },
  257. {
  258. "Program": "Microsoft Word MUI 2013"
  259. },
  260. {
  261. "Program": "Microsoft OneDrive"
  262. },
  263. {
  264. "Program": "Microsoft Groove MUI 2013"
  265. },
  266. {
  267. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  268. },
  269. {
  270. "Program": "Python 2.7 PIL-1.1.7"
  271. },
  272. {
  273. "Program": "Microsoft Access Setup Metadata MUI 2013"
  274. },
  275. {
  276. "Program": "Microsoft Office OSM UX MUI 2013"
  277. },
  278. {
  279. "Program": "Java Auto Updater"
  280. },
  281. {
  282. "Program": "Microsoft PowerPoint MUI 2013"
  283. },
  284. {
  285. "Program": "Microsoft Office Professional Plus 2013"
  286. },
  287. {
  288. "Program": "Adobe Refresh Manager"
  289. },
  290. {
  291. "Program": "Microsoft Office Proofing 2013"
  292. },
  293. {
  294. "Program": "Microsoft Lync MUI 2013"
  295. },
  296. {
  297. "Program": "Python Launcher"
  298. },
  299. {
  300. "Program": "Microsoft OneNote MUI 2013"
  301. }
  302. ]
  303. },
  304. {
  305. "Description": "Creates a hidden or system file",
  306. "Details": [
  307. {
  308. "file": "C:\\ProgramData\\Windows\\"
  309. }
  310. ]
  311. },
  312. {
  313. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  314. "Details": [
  315. {
  316. "FireEye": "Generic.mg.84155499d2369c65"
  317. },
  318. {
  319. "McAfee": "Artemis!84155499D236"
  320. },
  321. {
  322. "Cylance": "Unsafe"
  323. },
  324. {
  325. "AegisLab": "Trojan.Win32.Generic.4!c"
  326. },
  327. {
  328. "K7GW": "Trojan ( 0053f76c1 )"
  329. },
  330. {
  331. "Invincea": "heuristic"
  332. },
  333. {
  334. "Cyren": "W32/Emotet.TZ.gen!Eldorado"
  335. },
  336. {
  337. "Symantec": "ML.Attribute.HighConfidence"
  338. },
  339. {
  340. "APEX": "Malicious"
  341. },
  342. {
  343. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  344. },
  345. {
  346. "Alibaba": "Trojan:Win32/Kryptik.c9fac379"
  347. },
  348. {
  349. "Rising": "Trojan.Kryptik!8.8 (CLOUD)"
  350. },
  351. {
  352. "McAfee-GW-Edition": "Artemis!Trojan"
  353. },
  354. {
  355. "Fortinet": "W32/Kryptik.GSVW!tr"
  356. },
  357. {
  358. "Trapmine": "malicious.moderate.ml.score"
  359. },
  360. {
  361. "F-Prot": "W32/Emotet.TZ.gen!Eldorado"
  362. },
  363. {
  364. "Endgame": "malicious (high confidence)"
  365. },
  366. {
  367. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  368. },
  369. {
  370. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  371. },
  372. {
  373. "Acronis": "suspicious"
  374. },
  375. {
  376. "VBA32": "Malware-Cryptor.Kirgudu"
  377. },
  378. {
  379. "ESET-NOD32": "a variant of Win32/Kryptik.GLWT"
  380. },
  381. {
  382. "SentinelOne": "DFI - Suspicious PE"
  383. },
  384. {
  385. "eGambit": "PE.Heur.InvalidSig"
  386. },
  387. {
  388. "AVG": "FileRepMalware"
  389. },
  390. {
  391. "Paloalto": "generic.ml"
  392. },
  393. {
  394. "CrowdStrike": "win/malicious_confidence_90% (W)"
  395. },
  396. {
  397. "Qihoo-360": "HEUR/QVM10.2.F545.Malware.Gen"
  398. }
  399. ]
  400. },
  401. {
  402. "Description": "Creates a copy of itself",
  403. "Details": [
  404. {
  405. "copy": "C:\\ProgramData\\Windows\\csrss.exe"
  406. }
  407. ]
  408. },
  409. {
  410. "Description": "Harvests information related to installed mail clients",
  411. "Details": [
  412. {
  413. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  414. }
  415. ]
  416. },
  417. {
  418. "Description": "Anomalous binary characteristics",
  419. "Details": [
  420. {
  421. "anomaly": "Actual checksum does not match that reported in PE header"
  422. }
  423. ]
  424. },
  425. {
  426. "Description": "Created network traffic indicative of malicious activity",
  427. "Details": [
  428. {
  429. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 658"
  430. },
  431. {
  432. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 279"
  433. },
  434. {
  435. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 128"
  436. },
  437. {
  438. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 515"
  439. },
  440. {
  441. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 528"
  442. }
  443. ]
  444. }
  445. ]
  446.  
  447. [*] Started Service: []
  448.  
  449. [*] Executed Commands: [
  450. "C:\\Windows\\system32\\vssadmin.exe List Shadows",
  451. "C:\\Windows\\system32\\vssadmin.exe Delete Shadows /All /Quiet"
  452. ]
  453.  
  454. [*] Mutexes: []
  455.  
  456. [*] Modified Files: [
  457. "\\??\\PIPE\\wkssvc",
  458. "C:\\ProgramData\\Windows\\csrss.exe",
  459. "\\??\\PIPE\\srvsvc",
  460. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\lock",
  461. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  462. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  463. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  464. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  465. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  466. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs",
  467. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  468. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus",
  469. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdescs.new",
  470. "C:\\README1.txt",
  471. "C:\\README2.txt",
  472. "C:\\README3.txt",
  473. "C:\\README4.txt",
  474. "C:\\README5.txt",
  475. "C:\\README6.txt",
  476. "C:\\README7.txt",
  477. "C:\\README8.txt",
  478. "C:\\README9.txt",
  479. "C:\\README10.txt",
  480. "C:\\Users\\user\\Pictures\\Host.zip",
  481. "C:\\Users\\user\\Pictures\\76G86lPLTA4e7G3r85mDApAdXCHzaOL7fdosQ72SsRw=.C30C4DA81AE308962B9A.crypted000007",
  482. "C:\\Users\\user\\Pictures\\Host.xls",
  483. "C:\\Users\\user\\Pictures\\I+FOK0ktsyra4GIovS9s9YSXi+6vc2aDeZ1-ctZgNwY=.C30C4DA81AE308962B9A.crypted000007",
  484. "C:\\Users\\user\\Pictures\\Host.pptx",
  485. "C:\\Users\\user\\Pictures\\YrluSJcdI7FlTHRFh4h7kRudZbl-DSLO2uyBhAJ9XBE=.C30C4DA81AE308962B9A.crypted000007",
  486. "C:\\Users\\user\\Pictures\\Host.ppt",
  487. "C:\\Users\\user\\Pictures\\o0TjXqCCdaVredcixBpF4YMDQRY7uR93HhuY2kUU93Y=.C30C4DA81AE308962B9A.crypted000007",
  488. "C:\\Users\\user\\Pictures\\Host.pdf",
  489. "C:\\Users\\user\\Pictures\\eIfARwXCWOBaBDfIVTLxhszKvnAdAZY6rMKYG5MB7fI=.C30C4DA81AE308962B9A.crypted000007",
  490. "C:\\Users\\user\\Pictures\\Host.jpg",
  491. "C:\\Users\\user\\Pictures\\wLV-i7L7w7dhW2RgPdalFnnV+IRfVneBSmmSIgEpDYY=.C30C4DA81AE308962B9A.crypted000007",
  492. "C:\\Users\\user\\Pictures\\Host.html",
  493. "C:\\Users\\user\\Pictures\\qVKXXFaG2+72j5G+5Lc4g9PWtnNK0KV9c9U-z8Suw1A=.C30C4DA81AE308962B9A.crypted000007",
  494. "C:\\Users\\user\\Pictures\\Host.gif",
  495. "C:\\Users\\user\\Pictures\\1d3-6+9y3qESt1WzLzN-2pmw4uv3RZAJsMK9-9nmgXI=.C30C4DA81AE308962B9A.crypted000007",
  496. "C:\\Users\\user\\Pictures\\Host.doc"
  497. ]
  498.  
  499. [*] Deleted Files: [
  500. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state.tmp",
  501. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus.tmp",
  502. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-certs.tmp",
  503. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\unverified-microdesc-consensus",
  504. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\cached-microdesc-consensus.tmp",
  505. "C:\\Users\\user\\AppData\\Local\\Temp\\6893A5D897\\state",
  506. "C:\\Users\\user\\Pictures\\Host.zip",
  507. "C:\\Users\\user\\Pictures\\Host.xls",
  508. "C:\\Users\\user\\Pictures\\Host.pptx",
  509. "C:\\Users\\user\\Pictures\\Host.ppt",
  510. "C:\\Users\\user\\Pictures\\Host.pdf",
  511. "C:\\Users\\user\\Pictures\\Host.jpg",
  512. "C:\\Users\\user\\Pictures\\Host.html",
  513. "C:\\Users\\user\\Pictures\\Host.gif"
  514. ]
  515.  
  516. [*] Modified Registry Keys: [
  517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\System32\\Configuration\\",
  518. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xi",
  519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Client Server Runtime Subsystem",
  520. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xVersion",
  521. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmail",
  522. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xmode",
  523. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xpk",
  524. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xstate",
  525. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\System32\\Configuration\\xcnt"
  526. ]
  527.  
  528. [*] Deleted Registry Keys: []
  529.  
  530. [*] DNS Communications: [
  531. {
  532. "type": "A",
  533. "request": "whatismyipaddress.com",
  534. "answers": [
  535. {
  536. "data": "104.16.154.36",
  537. "type": "A"
  538. },
  539. {
  540. "data": "104.16.155.36",
  541. "type": "A"
  542. }
  543. ]
  544. }
  545. ]
  546.  
  547. [*] Domains: [
  548. {
  549. "ip": "104.16.154.36",
  550. "domain": "whatismyipaddress.com"
  551. }
  552. ]
  553.  
  554. [*] Network Communication - ICMP: []
  555.  
  556. [*] Network Communication - HTTP: [
  557. {
  558. "count": 1,
  559. "body": "",
  560. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  561. "user-agent": "Microsoft-CryptoAPI/6.1",
  562. "method": "GET",
  563. "host": "ocsp.digicert.com",
  564. "version": "1.1",
  565. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  566. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  567. "port": 80
  568. },
  569. {
  570. "count": 1,
  571. "body": "",
  572. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  573. "user-agent": "Microsoft-CryptoAPI/6.1",
  574. "method": "GET",
  575. "host": "ocsp.digicert.com",
  576. "version": "1.1",
  577. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  578. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  579. "port": 80
  580. },
  581. {
  582. "count": 1,
  583. "body": "",
  584. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  585. "user-agent": "Microsoft-CryptoAPI/6.1",
  586. "method": "GET",
  587. "host": "ocsp.digicert.com",
  588. "version": "1.1",
  589. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  590. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  591. "port": 80
  592. },
  593. {
  594. "count": 1,
  595. "body": "",
  596. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  597. "user-agent": "Microsoft-CryptoAPI/6.1",
  598. "method": "GET",
  599. "host": "ocsp.pki.goog",
  600. "version": "1.1",
  601. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  602. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  603. "port": 80
  604. },
  605. {
  606. "count": 1,
  607. "body": "",
  608. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  609. "user-agent": "Microsoft-CryptoAPI/6.1",
  610. "method": "GET",
  611. "host": "ocsp.digicert.com",
  612. "version": "1.1",
  613. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  614. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  615. "port": 80
  616. },
  617. {
  618. "count": 1,
  619. "body": "",
  620. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  621. "user-agent": "Microsoft-CryptoAPI/6.1",
  622. "method": "GET",
  623. "host": "crl.microsoft.com",
  624. "version": "1.1",
  625. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  626. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  627. "port": 80
  628. },
  629. {
  630. "count": 1,
  631. "body": "",
  632. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  633. "user-agent": "Microsoft-CryptoAPI/6.1",
  634. "method": "GET",
  635. "host": "ocsp.comodoca.com",
  636. "version": "1.1",
  637. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  638. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  639. "port": 80
  640. },
  641. {
  642. "count": 1,
  643. "body": "",
  644. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  645. "user-agent": "Microsoft-CryptoAPI/6.1",
  646. "method": "GET",
  647. "host": "ocsp.pki.goog",
  648. "version": "1.1",
  649. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  650. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  651. "port": 80
  652. },
  653. {
  654. "count": 1,
  655. "body": "",
  656. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  657. "user-agent": "Microsoft-CryptoAPI/6.1",
  658. "method": "GET",
  659. "host": "ocsp.digicert.com",
  660. "version": "1.1",
  661. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  662. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  663. "port": 80
  664. },
  665. {
  666. "count": 1,
  667. "body": "",
  668. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  669. "user-agent": "Microsoft-CryptoAPI/6.1",
  670. "method": "GET",
  671. "host": "www.download.windowsupdate.com",
  672. "version": "1.1",
  673. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  674. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  675. "port": 80
  676. },
  677. {
  678. "count": 1,
  679. "body": "",
  680. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  681. "user-agent": "Microsoft-CryptoAPI/6.1",
  682. "method": "GET",
  683. "host": "crl.microsoft.com",
  684. "version": "1.1",
  685. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  686. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  687. "port": 80
  688. },
  689. {
  690. "count": 1,
  691. "body": "",
  692. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  693. "user-agent": "Microsoft-CryptoAPI/6.1",
  694. "method": "GET",
  695. "host": "ocsp.digicert.com",
  696. "version": "1.1",
  697. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  698. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  699. "port": 80
  700. },
  701. {
  702. "count": 1,
  703. "body": "",
  704. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  705. "user-agent": "Microsoft-CryptoAPI/6.1",
  706. "method": "GET",
  707. "host": "ocsp.digicert.com",
  708. "version": "1.1",
  709. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  710. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  711. "port": 80
  712. },
  713. {
  714. "count": 1,
  715. "body": "",
  716. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  717. "user-agent": "Microsoft-CryptoAPI/6.1",
  718. "method": "GET",
  719. "host": "ocsp.digicert.com",
  720. "version": "1.1",
  721. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  722. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  723. "port": 80
  724. },
  725. {
  726. "count": 1,
  727. "body": "",
  728. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  729. "user-agent": "Microsoft-CryptoAPI/6.1",
  730. "method": "GET",
  731. "host": "ocsp.pki.goog",
  732. "version": "1.1",
  733. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  734. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  735. "port": 80
  736. },
  737. {
  738. "count": 1,
  739. "body": "",
  740. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  741. "user-agent": "Microsoft-CryptoAPI/6.1",
  742. "method": "GET",
  743. "host": "ocsp.pki.goog",
  744. "version": "1.1",
  745. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  746. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  747. "port": 80
  748. },
  749. {
  750. "count": 1,
  751. "body": "",
  752. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  753. "user-agent": "Microsoft-CryptoAPI/6.1",
  754. "method": "GET",
  755. "host": "ocsp.digicert.com",
  756. "version": "1.1",
  757. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  758. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  759. "port": 80
  760. },
  761. {
  762. "count": 1,
  763. "body": "",
  764. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  765. "user-agent": "Microsoft-CryptoAPI/6.1",
  766. "method": "GET",
  767. "host": "ocsp.pki.goog",
  768. "version": "1.1",
  769. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  770. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  771. "port": 80
  772. },
  773. {
  774. "count": 1,
  775. "body": "",
  776. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  777. "user-agent": "Microsoft-CryptoAPI/6.1",
  778. "method": "GET",
  779. "host": "ocsp.msocsp.com",
  780. "version": "1.1",
  781. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  782. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  783. "port": 80
  784. },
  785. {
  786. "count": 1,
  787. "body": "",
  788. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  789. "user-agent": "Microsoft-CryptoAPI/6.1",
  790. "method": "GET",
  791. "host": "ocsp.thawte.com",
  792. "version": "1.1",
  793. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  794. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  795. "port": 80
  796. },
  797. {
  798. "count": 1,
  799. "body": "",
  800. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  801. "user-agent": "Microsoft-CryptoAPI/6.1",
  802. "method": "GET",
  803. "host": "ocsp.usertrust.com",
  804. "version": "1.1",
  805. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  806. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  807. "port": 80
  808. },
  809. {
  810. "count": 1,
  811. "body": "",
  812. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  813. "user-agent": "Microsoft-CryptoAPI/6.1",
  814. "method": "GET",
  815. "host": "th.symcd.com",
  816. "version": "1.1",
  817. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  818. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  819. "port": 80
  820. },
  821. {
  822. "count": 1,
  823. "body": "",
  824. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  825. "user-agent": "Microsoft-CryptoAPI/6.1",
  826. "method": "GET",
  827. "host": "ocsp.digicert.com",
  828. "version": "1.1",
  829. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  830. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  831. "port": 80
  832. },
  833. {
  834. "count": 1,
  835. "body": "",
  836. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  837. "user-agent": "Microsoft-CryptoAPI/6.1",
  838. "method": "GET",
  839. "host": "ocsp.digicert.com",
  840. "version": "1.1",
  841. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  842. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  843. "port": 80
  844. },
  845. {
  846. "count": 1,
  847. "body": "",
  848. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  849. "user-agent": "Microsoft-CryptoAPI/6.1",
  850. "method": "GET",
  851. "host": "ocsp.pki.goog",
  852. "version": "1.1",
  853. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  854. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  855. "port": 80
  856. },
  857. {
  858. "count": 1,
  859. "body": "",
  860. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  861. "user-agent": "Microsoft-CryptoAPI/6.1",
  862. "method": "GET",
  863. "host": "crl.microsoft.com",
  864. "version": "1.1",
  865. "path": "/pki/crl/products/microsoftrootcert.crl",
  866. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  867. "port": 80
  868. },
  869. {
  870. "count": 1,
  871. "body": "",
  872. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe",
  873. "user-agent": "Microsoft BITS/7.5",
  874. "method": "HEAD",
  875. "host": "redirector.gvt1.com",
  876. "version": "1.1",
  877. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe",
  878. "data": "HEAD /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  879. "port": 80
  880. },
  881. {
  882. "count": 1,
  883. "body": "",
  884. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  885. "user-agent": "Microsoft BITS/7.5",
  886. "method": "HEAD",
  887. "host": "r5---sn-tt1e7n7k.gvt1.com",
  888. "version": "1.1",
  889. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  890. "data": "HEAD /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  891. "port": 80
  892. },
  893. {
  894. "count": 1,
  895. "body": "",
  896. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  897. "user-agent": "Microsoft BITS/7.5",
  898. "method": "GET",
  899. "host": "r5---sn-tt1e7n7k.gvt1.com",
  900. "version": "1.1",
  901. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  902. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=0-6595\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  903. "port": 80
  904. },
  905. {
  906. "count": 1,
  907. "body": "",
  908. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  909. "user-agent": "Microsoft BITS/7.5",
  910. "method": "GET",
  911. "host": "r5---sn-tt1e7n7k.gvt1.com",
  912. "version": "1.1",
  913. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  914. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=6596-17241\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  915. "port": 80
  916. },
  917. {
  918. "count": 1,
  919. "body": "",
  920. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  921. "user-agent": "Microsoft BITS/7.5",
  922. "method": "GET",
  923. "host": "r5---sn-tt1e7n7k.gvt1.com",
  924. "version": "1.1",
  925. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  926. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=17242-28196\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  927. "port": 80
  928. },
  929. {
  930. "count": 1,
  931. "body": "",
  932. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  933. "user-agent": "Microsoft BITS/7.5",
  934. "method": "GET",
  935. "host": "r5---sn-tt1e7n7k.gvt1.com",
  936. "version": "1.1",
  937. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  938. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=28197-37386\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  939. "port": 80
  940. },
  941. {
  942. "count": 1,
  943. "body": "",
  944. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  945. "user-agent": "Microsoft BITS/7.5",
  946. "method": "GET",
  947. "host": "r5---sn-tt1e7n7k.gvt1.com",
  948. "version": "1.1",
  949. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  950. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=37387-58135\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  951. "port": 80
  952. },
  953. {
  954. "count": 1,
  955. "body": "",
  956. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  957. "user-agent": "Microsoft BITS/7.5",
  958. "method": "GET",
  959. "host": "r5---sn-tt1e7n7k.gvt1.com",
  960. "version": "1.1",
  961. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  962. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=58136-97145\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  963. "port": 80
  964. },
  965. {
  966. "count": 1,
  967. "body": "",
  968. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  969. "user-agent": "Microsoft BITS/7.5",
  970. "method": "GET",
  971. "host": "r5---sn-tt1e7n7k.gvt1.com",
  972. "version": "1.1",
  973. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  974. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=97146-185214\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  975. "port": 80
  976. },
  977. {
  978. "count": 1,
  979. "body": "",
  980. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  981. "user-agent": "Microsoft BITS/7.5",
  982. "method": "GET",
  983. "host": "r5---sn-tt1e7n7k.gvt1.com",
  984. "version": "1.1",
  985. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  986. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=185215-330774\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  987. "port": 80
  988. },
  989. {
  990. "count": 1,
  991. "body": "",
  992. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  993. "user-agent": "Microsoft BITS/7.5",
  994. "method": "GET",
  995. "host": "r5---sn-tt1e7n7k.gvt1.com",
  996. "version": "1.1",
  997. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  998. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=330775-543043\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  999. "port": 80
  1000. },
  1001. {
  1002. "count": 1,
  1003. "body": "",
  1004. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1005. "user-agent": "Microsoft BITS/7.5",
  1006. "method": "GET",
  1007. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1008. "version": "1.1",
  1009. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1010. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=543044-726738\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1011. "port": 80
  1012. },
  1013. {
  1014. "count": 1,
  1015. "body": "",
  1016. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1017. "user-agent": "Microsoft BITS/7.5",
  1018. "method": "GET",
  1019. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1020. "version": "1.1",
  1021. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1022. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=726739-931887\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1023. "port": 80
  1024. },
  1025. {
  1026. "count": 1,
  1027. "body": "",
  1028. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1029. "user-agent": "Microsoft BITS/7.5",
  1030. "method": "GET",
  1031. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1032. "version": "1.1",
  1033. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1034. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=931888-1272911\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1035. "port": 80
  1036. },
  1037. {
  1038. "count": 1,
  1039. "body": "",
  1040. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1041. "user-agent": "Microsoft BITS/7.5",
  1042. "method": "GET",
  1043. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1044. "version": "1.1",
  1045. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1046. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1272912-1632814\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1047. "port": 80
  1048. },
  1049. {
  1050. "count": 1,
  1051. "body": "",
  1052. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1053. "user-agent": "Microsoft BITS/7.5",
  1054. "method": "GET",
  1055. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1056. "version": "1.1",
  1057. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1058. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1632815-1982454\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1059. "port": 80
  1060. },
  1061. {
  1062. "count": 1,
  1063. "body": "",
  1064. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1065. "user-agent": "Microsoft BITS/7.5",
  1066. "method": "GET",
  1067. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1068. "version": "1.1",
  1069. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1070. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1982455-2375404\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1071. "port": 80
  1072. },
  1073. {
  1074. "count": 1,
  1075. "body": "",
  1076. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1077. "user-agent": "Microsoft BITS/7.5",
  1078. "method": "GET",
  1079. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1080. "version": "1.1",
  1081. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1082. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=2375405-2581445\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1083. "port": 80
  1084. },
  1085. {
  1086. "count": 1,
  1087. "body": "",
  1088. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1089. "user-agent": "Microsoft BITS/7.5",
  1090. "method": "GET",
  1091. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1092. "version": "1.1",
  1093. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1094. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=2581446-2674981\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1095. "port": 80
  1096. },
  1097. {
  1098. "count": 1,
  1099. "body": "",
  1100. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1101. "user-agent": "Microsoft BITS/7.5",
  1102. "method": "GET",
  1103. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1104. "version": "1.1",
  1105. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1106. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=2674982-3003789\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1107. "port": 80
  1108. },
  1109. {
  1110. "count": 1,
  1111. "body": "",
  1112. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1113. "user-agent": "Microsoft BITS/7.5",
  1114. "method": "GET",
  1115. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1116. "version": "1.1",
  1117. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1118. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=3003790-3542971\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1119. "port": 80
  1120. },
  1121. {
  1122. "count": 1,
  1123. "body": "",
  1124. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1125. "user-agent": "Microsoft BITS/7.5",
  1126. "method": "GET",
  1127. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1128. "version": "1.1",
  1129. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1130. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=3542972-4054462\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1131. "port": 80
  1132. },
  1133. {
  1134. "count": 1,
  1135. "body": "",
  1136. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1137. "user-agent": "Microsoft BITS/7.5",
  1138. "method": "GET",
  1139. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1140. "version": "1.1",
  1141. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1142. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=4054463-4694659\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1143. "port": 80
  1144. },
  1145. {
  1146. "count": 1,
  1147. "body": "",
  1148. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1149. "user-agent": "Microsoft BITS/7.5",
  1150. "method": "GET",
  1151. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1152. "version": "1.1",
  1153. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1154. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=4694660-5408464\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1155. "port": 80
  1156. },
  1157. {
  1158. "count": 1,
  1159. "body": "",
  1160. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1161. "user-agent": "Microsoft BITS/7.5",
  1162. "method": "GET",
  1163. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1164. "version": "1.1",
  1165. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1166. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=5408465-6261544\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1167. "port": 80
  1168. },
  1169. {
  1170. "count": 1,
  1171. "body": "",
  1172. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1173. "user-agent": "Microsoft BITS/7.5",
  1174. "method": "GET",
  1175. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1176. "version": "1.1",
  1177. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1178. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=6261545-7213509\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1179. "port": 80
  1180. },
  1181. {
  1182. "count": 1,
  1183. "body": "",
  1184. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1185. "user-agent": "Microsoft BITS/7.5",
  1186. "method": "GET",
  1187. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1188. "version": "1.1",
  1189. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1190. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=7213510-8331184\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1191. "port": 80
  1192. },
  1193. {
  1194. "count": 2,
  1195. "body": "",
  1196. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1197. "user-agent": "Microsoft BITS/7.5",
  1198. "method": "GET",
  1199. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1200. "version": "1.1",
  1201. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1202. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=8331185-9200834\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1203. "port": 80
  1204. },
  1205. {
  1206. "count": 1,
  1207. "body": "",
  1208. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1209. "user-agent": "Microsoft BITS/7.5",
  1210. "method": "GET",
  1211. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1212. "version": "1.1",
  1213. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1214. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=9200835-10154843\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1215. "port": 80
  1216. },
  1217. {
  1218. "count": 1,
  1219. "body": "",
  1220. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1221. "user-agent": "Microsoft BITS/7.5",
  1222. "method": "GET",
  1223. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1224. "version": "1.1",
  1225. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1226. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=10154844-11768268\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1227. "port": 80
  1228. },
  1229. {
  1230. "count": 1,
  1231. "body": "",
  1232. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1233. "user-agent": "Microsoft BITS/7.5",
  1234. "method": "GET",
  1235. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1236. "version": "1.1",
  1237. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1238. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=11768269-13026238\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1239. "port": 80
  1240. },
  1241. {
  1242. "count": 1,
  1243. "body": "",
  1244. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1245. "user-agent": "Microsoft BITS/7.5",
  1246. "method": "GET",
  1247. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1248. "version": "1.1",
  1249. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1250. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=13026239-13901112\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1251. "port": 80
  1252. },
  1253. {
  1254. "count": 1,
  1255. "body": "",
  1256. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1257. "user-agent": "Microsoft BITS/7.5",
  1258. "method": "GET",
  1259. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1260. "version": "1.1",
  1261. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1262. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=13901113-14968632\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1263. "port": 80
  1264. },
  1265. {
  1266. "count": 1,
  1267. "body": "",
  1268. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1269. "user-agent": "Microsoft BITS/7.5",
  1270. "method": "GET",
  1271. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1272. "version": "1.1",
  1273. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1274. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=14968633-16296745\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1275. "port": 80
  1276. },
  1277. {
  1278. "count": 1,
  1279. "body": "",
  1280. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1281. "user-agent": "Microsoft BITS/7.5",
  1282. "method": "GET",
  1283. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1284. "version": "1.1",
  1285. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1286. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=16296746-17221767\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1287. "port": 80
  1288. },
  1289. {
  1290. "count": 1,
  1291. "body": "",
  1292. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1293. "user-agent": "Microsoft BITS/7.5",
  1294. "method": "GET",
  1295. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1296. "version": "1.1",
  1297. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1298. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=17221768-18859887\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1299. "port": 80
  1300. },
  1301. {
  1302. "count": 1,
  1303. "body": "",
  1304. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1305. "user-agent": "Microsoft BITS/7.5",
  1306. "method": "GET",
  1307. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1308. "version": "1.1",
  1309. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1310. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=18859888-20463071\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1311. "port": 80
  1312. },
  1313. {
  1314. "count": 1,
  1315. "body": "",
  1316. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1317. "user-agent": "Microsoft BITS/7.5",
  1318. "method": "GET",
  1319. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1320. "version": "1.1",
  1321. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1322. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=20463072-21405226\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1323. "port": 80
  1324. },
  1325. {
  1326. "count": 1,
  1327. "body": "",
  1328. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1329. "user-agent": "Microsoft BITS/7.5",
  1330. "method": "GET",
  1331. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1332. "version": "1.1",
  1333. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1334. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=21405227-22945107\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1335. "port": 80
  1336. },
  1337. {
  1338. "count": 1,
  1339. "body": "",
  1340. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1341. "user-agent": "Microsoft BITS/7.5",
  1342. "method": "GET",
  1343. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1344. "version": "1.1",
  1345. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1346. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=22945108-24232828\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1347. "port": 80
  1348. },
  1349. {
  1350. "count": 1,
  1351. "body": "",
  1352. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1353. "user-agent": "Microsoft BITS/7.5",
  1354. "method": "GET",
  1355. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1356. "version": "1.1",
  1357. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1358. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=24232829-25738689\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1359. "port": 80
  1360. },
  1361. {
  1362. "count": 1,
  1363. "body": "",
  1364. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1365. "user-agent": "Microsoft BITS/7.5",
  1366. "method": "GET",
  1367. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1368. "version": "1.1",
  1369. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1370. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=25738690-27253127\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1371. "port": 80
  1372. },
  1373. {
  1374. "count": 1,
  1375. "body": "",
  1376. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1377. "user-agent": "Microsoft BITS/7.5",
  1378. "method": "GET",
  1379. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1380. "version": "1.1",
  1381. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1382. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=27253128-28945148\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1383. "port": 80
  1384. },
  1385. {
  1386. "count": 1,
  1387. "body": "",
  1388. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1389. "user-agent": "Microsoft BITS/7.5",
  1390. "method": "GET",
  1391. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1392. "version": "1.1",
  1393. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1394. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=28945149-30802214\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1395. "port": 80
  1396. },
  1397. {
  1398. "count": 1,
  1399. "body": "",
  1400. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1401. "user-agent": "Microsoft BITS/7.5",
  1402. "method": "GET",
  1403. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1404. "version": "1.1",
  1405. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1406. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=30802215-32514153\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1407. "port": 80
  1408. },
  1409. {
  1410. "count": 1,
  1411. "body": "",
  1412. "uri": "http://r5---sn-tt1e7n7k.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1413. "user-agent": "Microsoft BITS/7.5",
  1414. "method": "GET",
  1415. "host": "r5---sn-tt1e7n7k.gvt1.com",
  1416. "version": "1.1",
  1417. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes",
  1418. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1e7n7k&ms=nvh&mt=1560934653&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=32514154-33549055\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1e7n7k.gvt1.com\r\n\r\n",
  1419. "port": 80
  1420. },
  1421. {
  1422. "count": 9,
  1423. "body": "",
  1424. "uri": "http://whatismyipaddress.com/",
  1425. "user-agent": "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0",
  1426. "method": "GET",
  1427. "host": "whatismyipaddress.com",
  1428. "version": "1.1",
  1429. "path": "/",
  1430. "data": "GET / HTTP/1.1\r\nHost: whatismyipaddress.com\r\nAccept: */*\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0\r\n\r\n",
  1431. "port": 80
  1432. }
  1433. ]
  1434.  
  1435. [*] Network Communication - SMTP: []
  1436.  
  1437. [*] Network Communication - Hosts: []
  1438.  
  1439. [*] Network Communication - IRC: []
  1440.  
  1441. [*] Static Analysis: {
  1442. "pe": {
  1443. "peid_signatures": null,
  1444. "imports": [
  1445. {
  1446. "imports": [
  1447. {
  1448. "name": "ExitProcess",
  1449. "address": "0x40d014"
  1450. },
  1451. {
  1452. "name": "FormatMessageW",
  1453. "address": "0x40d018"
  1454. },
  1455. {
  1456. "name": "FreeEnvironmentStringsA",
  1457. "address": "0x40d01c"
  1458. },
  1459. {
  1460. "name": "FreeEnvironmentStringsW",
  1461. "address": "0x40d020"
  1462. },
  1463. {
  1464. "name": "GetACP",
  1465. "address": "0x40d024"
  1466. },
  1467. {
  1468. "name": "GetCPInfo",
  1469. "address": "0x40d028"
  1470. },
  1471. {
  1472. "name": "GetCommandLineA",
  1473. "address": "0x40d02c"
  1474. },
  1475. {
  1476. "name": "GetCommandLineW",
  1477. "address": "0x40d030"
  1478. },
  1479. {
  1480. "name": "GetCurrentProcess",
  1481. "address": "0x40d034"
  1482. },
  1483. {
  1484. "name": "GetCurrentProcessId",
  1485. "address": "0x40d038"
  1486. },
  1487. {
  1488. "name": "GetCurrentThreadId",
  1489. "address": "0x40d03c"
  1490. },
  1491. {
  1492. "name": "GetEnvironmentStrings",
  1493. "address": "0x40d040"
  1494. },
  1495. {
  1496. "name": "GetEnvironmentStringsW",
  1497. "address": "0x40d044"
  1498. },
  1499. {
  1500. "name": "GetFileType",
  1501. "address": "0x40d048"
  1502. },
  1503. {
  1504. "name": "GetLastError",
  1505. "address": "0x40d04c"
  1506. },
  1507. {
  1508. "name": "GetLocaleInfoA",
  1509. "address": "0x40d050"
  1510. },
  1511. {
  1512. "name": "GetModuleFileNameA",
  1513. "address": "0x40d054"
  1514. },
  1515. {
  1516. "name": "GetModuleFileNameW",
  1517. "address": "0x40d058"
  1518. },
  1519. {
  1520. "name": "GetModuleHandleA",
  1521. "address": "0x40d05c"
  1522. },
  1523. {
  1524. "name": "GetOEMCP",
  1525. "address": "0x40d060"
  1526. },
  1527. {
  1528. "name": "GetProcAddress",
  1529. "address": "0x40d064"
  1530. },
  1531. {
  1532. "name": "GetStartupInfoA",
  1533. "address": "0x40d068"
  1534. },
  1535. {
  1536. "name": "GetStartupInfoW",
  1537. "address": "0x40d06c"
  1538. },
  1539. {
  1540. "name": "GetStdHandle",
  1541. "address": "0x40d070"
  1542. },
  1543. {
  1544. "name": "GetStringTypeA",
  1545. "address": "0x40d074"
  1546. },
  1547. {
  1548. "name": "GetStringTypeW",
  1549. "address": "0x40d078"
  1550. },
  1551. {
  1552. "name": "GetSystemInfo",
  1553. "address": "0x40d07c"
  1554. },
  1555. {
  1556. "name": "GetSystemTimeAsFileTime",
  1557. "address": "0x40d080"
  1558. },
  1559. {
  1560. "name": "GetTickCount",
  1561. "address": "0x40d084"
  1562. },
  1563. {
  1564. "name": "GetVersionExA",
  1565. "address": "0x40d088"
  1566. },
  1567. {
  1568. "name": "HeapAlloc",
  1569. "address": "0x40d08c"
  1570. },
  1571. {
  1572. "name": "HeapCreate",
  1573. "address": "0x40d090"
  1574. },
  1575. {
  1576. "name": "HeapDestroy",
  1577. "address": "0x40d094"
  1578. },
  1579. {
  1580. "name": "HeapFree",
  1581. "address": "0x40d098"
  1582. },
  1583. {
  1584. "name": "HeapReAlloc",
  1585. "address": "0x40d09c"
  1586. },
  1587. {
  1588. "name": "InitializeCriticalSection",
  1589. "address": "0x40d0a0"
  1590. },
  1591. {
  1592. "name": "InterlockedCompareExchange",
  1593. "address": "0x40d0a4"
  1594. },
  1595. {
  1596. "name": "InterlockedExchange",
  1597. "address": "0x40d0a8"
  1598. },
  1599. {
  1600. "name": "IsDebuggerPresent",
  1601. "address": "0x40d0ac"
  1602. },
  1603. {
  1604. "name": "LCMapStringA",
  1605. "address": "0x40d0b0"
  1606. },
  1607. {
  1608. "name": "LCMapStringW",
  1609. "address": "0x40d0b4"
  1610. },
  1611. {
  1612. "name": "LeaveCriticalSection",
  1613. "address": "0x40d0b8"
  1614. },
  1615. {
  1616. "name": "EnterCriticalSection",
  1617. "address": "0x40d0bc"
  1618. },
  1619. {
  1620. "name": "LocalFree",
  1621. "address": "0x40d0c0"
  1622. },
  1623. {
  1624. "name": "MultiByteToWideChar",
  1625. "address": "0x40d0c4"
  1626. },
  1627. {
  1628. "name": "QueryPerformanceCounter",
  1629. "address": "0x40d0c8"
  1630. },
  1631. {
  1632. "name": "RtlUnwind",
  1633. "address": "0x40d0cc"
  1634. },
  1635. {
  1636. "name": "SetHandleCount",
  1637. "address": "0x40d0d0"
  1638. },
  1639. {
  1640. "name": "SetLastError",
  1641. "address": "0x40d0d4"
  1642. },
  1643. {
  1644. "name": "SetUnhandledExceptionFilter",
  1645. "address": "0x40d0d8"
  1646. },
  1647. {
  1648. "name": "Sleep",
  1649. "address": "0x40d0dc"
  1650. },
  1651. {
  1652. "name": "TerminateProcess",
  1653. "address": "0x40d0e0"
  1654. },
  1655. {
  1656. "name": "TlsAlloc",
  1657. "address": "0x40d0e4"
  1658. },
  1659. {
  1660. "name": "TlsFree",
  1661. "address": "0x40d0e8"
  1662. },
  1663. {
  1664. "name": "TlsGetValue",
  1665. "address": "0x40d0ec"
  1666. },
  1667. {
  1668. "name": "TlsSetValue",
  1669. "address": "0x40d0f0"
  1670. },
  1671. {
  1672. "name": "UnhandledExceptionFilter",
  1673. "address": "0x40d0f4"
  1674. },
  1675. {
  1676. "name": "VirtualAlloc",
  1677. "address": "0x40d0f8"
  1678. },
  1679. {
  1680. "name": "VirtualFree",
  1681. "address": "0x40d0fc"
  1682. },
  1683. {
  1684. "name": "VirtualProtect",
  1685. "address": "0x40d100"
  1686. },
  1687. {
  1688. "name": "VirtualQuery",
  1689. "address": "0x40d104"
  1690. },
  1691. {
  1692. "name": "WideCharToMultiByte",
  1693. "address": "0x40d108"
  1694. },
  1695. {
  1696. "name": "WriteFile",
  1697. "address": "0x40d10c"
  1698. },
  1699. {
  1700. "name": "SetErrorMode",
  1701. "address": "0x40d110"
  1702. },
  1703. {
  1704. "name": "LoadLibraryW",
  1705. "address": "0x40d114"
  1706. },
  1707. {
  1708. "name": "HeapSize",
  1709. "address": "0x40d118"
  1710. },
  1711. {
  1712. "name": "IsValidCodePage",
  1713. "address": "0x40d11c"
  1714. },
  1715. {
  1716. "name": "InitializeCriticalSectionAndSpinCount",
  1717. "address": "0x40d120"
  1718. },
  1719. {
  1720. "name": "InterlockedDecrement",
  1721. "address": "0x40d124"
  1722. },
  1723. {
  1724. "name": "DeleteCriticalSection",
  1725. "address": "0x40d128"
  1726. },
  1727. {
  1728. "name": "CreateThread",
  1729. "address": "0x40d12c"
  1730. },
  1731. {
  1732. "name": "CreateDirectoryW",
  1733. "address": "0x40d130"
  1734. },
  1735. {
  1736. "name": "InterlockedIncrement",
  1737. "address": "0x40d134"
  1738. },
  1739. {
  1740. "name": "GetModuleHandleW",
  1741. "address": "0x40d138"
  1742. },
  1743. {
  1744. "name": "LoadLibraryA",
  1745. "address": "0x40d13c"
  1746. },
  1747. {
  1748. "name": "CloseHandle",
  1749. "address": "0x40d140"
  1750. }
  1751. ],
  1752. "dll": "KERNEL32.dll"
  1753. },
  1754. {
  1755. "imports": [
  1756. {
  1757. "name": "LoadCursorW",
  1758. "address": "0x40d164"
  1759. },
  1760. {
  1761. "name": "LoadIconA",
  1762. "address": "0x40d168"
  1763. },
  1764. {
  1765. "name": "SetTimer",
  1766. "address": "0x40d16c"
  1767. },
  1768. {
  1769. "name": "CharLowerW",
  1770. "address": "0x40d170"
  1771. },
  1772. {
  1773. "name": "PtInRect",
  1774. "address": "0x40d174"
  1775. },
  1776. {
  1777. "name": "MessageBoxW",
  1778. "address": "0x40d178"
  1779. },
  1780. {
  1781. "name": "LoadIconW",
  1782. "address": "0x40d17c"
  1783. },
  1784. {
  1785. "name": "KillTimer",
  1786. "address": "0x40d180"
  1787. },
  1788. {
  1789. "name": "IsIconic",
  1790. "address": "0x40d184"
  1791. },
  1792. {
  1793. "name": "GetWindowRect",
  1794. "address": "0x40d188"
  1795. },
  1796. {
  1797. "name": "GetSystemMetrics",
  1798. "address": "0x40d18c"
  1799. },
  1800. {
  1801. "name": "GetCursorPos",
  1802. "address": "0x40d190"
  1803. },
  1804. {
  1805. "name": "GetClientRect",
  1806. "address": "0x40d194"
  1807. },
  1808. {
  1809. "name": "EnableWindow",
  1810. "address": "0x40d198"
  1811. },
  1812. {
  1813. "name": "DrawIcon",
  1814. "address": "0x40d19c"
  1815. },
  1816. {
  1817. "name": "SendMessageW",
  1818. "address": "0x40d1a0"
  1819. }
  1820. ],
  1821. "dll": "USER32.dll"
  1822. },
  1823. {
  1824. "imports": [
  1825. {
  1826. "name": "RegOpenKeyA",
  1827. "address": "0x40d000"
  1828. },
  1829. {
  1830. "name": "RegQueryValueExW",
  1831. "address": "0x40d004"
  1832. }
  1833. ],
  1834. "dll": "ADVAPI32.dll"
  1835. },
  1836. {
  1837. "imports": [
  1838. {
  1839. "name": "ShellExecuteW",
  1840. "address": "0x40d148"
  1841. },
  1842. {
  1843. "name": "SHBrowseForFolderW",
  1844. "address": "0x40d14c"
  1845. },
  1846. {
  1847. "name": "SHGetMalloc",
  1848. "address": "0x40d150"
  1849. },
  1850. {
  1851. "name": "SHGetPathFromIDListW",
  1852. "address": "0x40d154"
  1853. }
  1854. ],
  1855. "dll": "SHELL32.dll"
  1856. },
  1857. {
  1858. "imports": [
  1859. {
  1860. "name": "PathFileExistsW",
  1861. "address": "0x40d15c"
  1862. }
  1863. ],
  1864. "dll": "SHLWAPI.dll"
  1865. },
  1866. {
  1867. "imports": [
  1868. {
  1869. "name": "InitCommonControlsEx",
  1870. "address": "0x40d00c"
  1871. }
  1872. ],
  1873. "dll": "COMCTL32.dll"
  1874. }
  1875. ],
  1876. "digital_signers": null,
  1877. "exported_dll_name": null,
  1878. "actual_checksum": "0x001229bc",
  1879. "overlay": {
  1880. "size": "0x000014b0",
  1881. "offset": "0x00113000"
  1882. },
  1883. "imagebase": "0x00400000",
  1884. "reported_checksum": "0x0011e99e",
  1885. "icon_hash": null,
  1886. "entrypoint": "0x00406cf9",
  1887. "timestamp": "2019-06-18 22:02:11",
  1888. "osversion": "5.0",
  1889. "sections": [
  1890. {
  1891. "name": ".text",
  1892. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1893. "virtual_address": "0x00001000",
  1894. "size_of_data": "0x0000be00",
  1895. "entropy": "4.83",
  1896. "raw_address": "0x00000400",
  1897. "virtual_size": "0x0000bd6e",
  1898. "characteristics_raw": "0x60000020"
  1899. },
  1900. {
  1901. "name": ".rdata",
  1902. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1903. "virtual_address": "0x0000d000",
  1904. "size_of_data": "0x00105400",
  1905. "entropy": "7.21",
  1906. "raw_address": "0x0000c200",
  1907. "virtual_size": "0x001053ae",
  1908. "characteristics_raw": "0x40000040"
  1909. },
  1910. {
  1911. "name": ".data",
  1912. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1913. "virtual_address": "0x00113000",
  1914. "size_of_data": "0x00001000",
  1915. "entropy": "3.01",
  1916. "raw_address": "0x00111600",
  1917. "virtual_size": "0x00001b9c",
  1918. "characteristics_raw": "0xc0000040"
  1919. },
  1920. {
  1921. "name": ".rsrc",
  1922. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1923. "virtual_address": "0x00115000",
  1924. "size_of_data": "0x00000a00",
  1925. "entropy": "3.68",
  1926. "raw_address": "0x00112600",
  1927. "virtual_size": "0x000f28e8",
  1928. "characteristics_raw": "0x40000040"
  1929. }
  1930. ],
  1931. "resources": [],
  1932. "dirents": [
  1933. {
  1934. "virtual_address": "0x00000000",
  1935. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1936. "size": "0x00000000"
  1937. },
  1938. {
  1939. "virtual_address": "0x00111a34",
  1940. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1941. "size": "0x0000008c"
  1942. },
  1943. {
  1944. "virtual_address": "0x00115000",
  1945. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1946. "size": "0x000008e8"
  1947. },
  1948. {
  1949. "virtual_address": "0x00000000",
  1950. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1951. "size": "0x00000000"
  1952. },
  1953. {
  1954. "virtual_address": "0x00113000",
  1955. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1956. "size": "0x000014b0"
  1957. },
  1958. {
  1959. "virtual_address": "0x00000000",
  1960. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1961. "size": "0x00000000"
  1962. },
  1963. {
  1964. "virtual_address": "0x00000000",
  1965. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1966. "size": "0x00000000"
  1967. },
  1968. {
  1969. "virtual_address": "0x00000000",
  1970. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1971. "size": "0x00000000"
  1972. },
  1973. {
  1974. "virtual_address": "0x00000000",
  1975. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1976. "size": "0x00000000"
  1977. },
  1978. {
  1979. "virtual_address": "0x00000000",
  1980. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1981. "size": "0x00000000"
  1982. },
  1983. {
  1984. "virtual_address": "0x00000000",
  1985. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1986. "size": "0x00000000"
  1987. },
  1988. {
  1989. "virtual_address": "0x00000000",
  1990. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1991. "size": "0x00000000"
  1992. },
  1993. {
  1994. "virtual_address": "0x0000d000",
  1995. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1996. "size": "0x000001a8"
  1997. },
  1998. {
  1999. "virtual_address": "0x00000000",
  2000. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2001. "size": "0x00000000"
  2002. },
  2003. {
  2004. "virtual_address": "0x00000000",
  2005. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2006. "size": "0x00000000"
  2007. },
  2008. {
  2009. "virtual_address": "0x00000000",
  2010. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2011. "size": "0x00000000"
  2012. }
  2013. ],
  2014. "exports": [],
  2015. "guest_signers": {},
  2016. "imphash": "a58f8955fbf36d24d6a4f04b9287829e",
  2017. "icon_fuzzy": null,
  2018. "icon": null,
  2019. "pdbpath": null,
  2020. "imported_dll_count": 6,
  2021. "versioninfo": []
  2022. }
  2023. }
  2024.  
  2025. [*] Resolved APIs: [
  2026. "kernel32.dll.FlsAlloc",
  2027. "kernel32.dll.FlsGetValue",
  2028. "kernel32.dll.FlsSetValue",
  2029. "kernel32.dll.FlsFree",
  2030. "kernel32.dll.LoadLibraryExA",
  2031. "kernel32.dll.GetProcAddress",
  2032. "kernel32.dll.VirtualAlloc",
  2033. "kernel32.dll.SetFilePointer",
  2034. "kernel32.dll.lstrlenA",
  2035. "kernel32.dll.lstrcatA",
  2036. "kernel32.dll.VirtualProtect",
  2037. "kernel32.dll.UnmapViewOfFile",
  2038. "kernel32.dll.GetModuleHandleA",
  2039. "kernel32.dll.WriteFile",
  2040. "kernel32.dll.CloseHandle",
  2041. "kernel32.dll.VirtualFree",
  2042. "kernel32.dll.GetTempPathA",
  2043. "kernel32.dll.CreateFileA",
  2044. "kernel32.dll.LoadLibraryA",
  2045. "kernel32.dll.ExitProcess",
  2046. "advapi32.dll.RegCloseKey",
  2047. "oleaut32.dll.#6",
  2048. "shell32.dll.SHGetMalloc",
  2049. "user32.dll.CharUpperA",
  2050. "ws2_32.dll.#1",
  2051. "kernel32.dll.Sleep",
  2052. "kernel32.dll.GetSystemTimeAsFileTime",
  2053. "kernel32.dll.HeapFree",
  2054. "kernel32.dll.HeapAlloc",
  2055. "kernel32.dll.GetProcessHeap",
  2056. "kernel32.dll.OpenProcess",
  2057. "kernel32.dll.CreatePipe",
  2058. "kernel32.dll.CreateProcessA",
  2059. "kernel32.dll.GetExitCodeProcess",
  2060. "kernel32.dll.SetHandleInformation",
  2061. "kernel32.dll.PeekNamedPipe",
  2062. "kernel32.dll.LocalFree",
  2063. "kernel32.dll.GlobalMemoryStatusEx",
  2064. "kernel32.dll.CreateFileMappingA",
  2065. "kernel32.dll.InitializeCriticalSection",
  2066. "kernel32.dll.InterlockedDecrement",
  2067. "kernel32.dll.ReadFile",
  2068. "kernel32.dll.CreateFileW",
  2069. "kernel32.dll.GetLastError",
  2070. "kernel32.dll.TerminateProcess",
  2071. "kernel32.dll.GetCurrentProcess",
  2072. "kernel32.dll.UnhandledExceptionFilter",
  2073. "kernel32.dll.SetUnhandledExceptionFilter",
  2074. "kernel32.dll.IsDebuggerPresent",
  2075. "kernel32.dll.GetCommandLineA",
  2076. "kernel32.dll.GetStartupInfoA",
  2077. "kernel32.dll.RaiseException",
  2078. "kernel32.dll.RtlUnwind",
  2079. "kernel32.dll.GetModuleHandleW",
  2080. "kernel32.dll.TlsGetValue",
  2081. "kernel32.dll.TlsAlloc",
  2082. "kernel32.dll.TlsSetValue",
  2083. "kernel32.dll.TlsFree",
  2084. "kernel32.dll.InterlockedIncrement",
  2085. "kernel32.dll.SetLastError",
  2086. "kernel32.dll.GetCurrentThreadId",
  2087. "kernel32.dll.HeapSize",
  2088. "kernel32.dll.GetStdHandle",
  2089. "kernel32.dll.GetModuleFileNameA",
  2090. "kernel32.dll.FreeEnvironmentStringsA",
  2091. "kernel32.dll.GetEnvironmentStrings",
  2092. "kernel32.dll.FreeEnvironmentStringsW",
  2093. "kernel32.dll.WideCharToMultiByte",
  2094. "kernel32.dll.GetEnvironmentStringsW",
  2095. "kernel32.dll.SetHandleCount",
  2096. "kernel32.dll.GetFileType",
  2097. "kernel32.dll.DeleteCriticalSection",
  2098. "kernel32.dll.HeapCreate",
  2099. "kernel32.dll.QueryPerformanceCounter",
  2100. "kernel32.dll.GetTickCount",
  2101. "kernel32.dll.GetCurrentProcessId",
  2102. "kernel32.dll.SetEvent",
  2103. "kernel32.dll.GetACP",
  2104. "kernel32.dll.DeleteFileA",
  2105. "kernel32.dll.IsValidCodePage",
  2106. "kernel32.dll.EnterCriticalSection",
  2107. "kernel32.dll.LeaveCriticalSection",
  2108. "kernel32.dll.GetConsoleCP",
  2109. "kernel32.dll.GetConsoleMode",
  2110. "kernel32.dll.FlushFileBuffers",
  2111. "kernel32.dll.MultiByteToWideChar",
  2112. "kernel32.dll.LCMapStringA",
  2113. "kernel32.dll.LCMapStringW",
  2114. "kernel32.dll.HeapReAlloc",
  2115. "kernel32.dll.SetConsoleCtrlHandler",
  2116. "kernel32.dll.FreeLibrary",
  2117. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  2118. "kernel32.dll.GetLocaleInfoA",
  2119. "kernel32.dll.GetStringTypeA",
  2120. "kernel32.dll.GetStringTypeW",
  2121. "kernel32.dll.GetTimeFormatA",
  2122. "kernel32.dll.GetDateFormatA",
  2123. "kernel32.dll.SetStdHandle",
  2124. "kernel32.dll.WriteConsoleA",
  2125. "kernel32.dll.GetConsoleOutputCP",
  2126. "kernel32.dll.WriteConsoleW",
  2127. "kernel32.dll.GetTimeZoneInformation",
  2128. "kernel32.dll.SetEndOfFile",
  2129. "kernel32.dll.CompareStringA",
  2130. "kernel32.dll.CompareStringW",
  2131. "kernel32.dll.SetEnvironmentVariableA",
  2132. "kernel32.dll.GetSystemInfo",
  2133. "kernel32.dll.OpenEventA",
  2134. "kernel32.dll.ResetEvent",
  2135. "kernel32.dll.ResumeThread",
  2136. "kernel32.dll.SystemTimeToFileTime",
  2137. "kernel32.dll.WaitForMultipleObjects",
  2138. "kernel32.dll.SetWaitableTimer",
  2139. "kernel32.dll.CreateWaitableTimerA",
  2140. "kernel32.dll.GetVersion",
  2141. "kernel32.dll.GlobalMemoryStatus",
  2142. "kernel32.dll.GetVersionExA",
  2143. "kernel32.dll.FlushConsoleInputBuffer",
  2144. "kernel32.dll.VerSetConditionMask",
  2145. "kernel32.dll.SleepEx",
  2146. "kernel32.dll.VerifyVersionInfoA",
  2147. "kernel32.dll.ExpandEnvironmentStringsA",
  2148. "kernel32.dll.FormatMessageA",
  2149. "kernel32.dll.MapViewOfFile",
  2150. "kernel32.dll.GetFileSize",
  2151. "kernel32.dll.CreateIoCompletionPort",
  2152. "kernel32.dll.PostQueuedCompletionStatus",
  2153. "kernel32.dll.ReleaseSemaphore",
  2154. "kernel32.dll.CreateSemaphoreA",
  2155. "kernel32.dll.GetQueuedCompletionStatus",
  2156. "kernel32.dll.GetFileInformationByHandle",
  2157. "kernel32.dll.MoveFileA",
  2158. "kernel32.dll.LockFile",
  2159. "kernel32.dll.UnlockFile",
  2160. "kernel32.dll.GetModuleFileNameW",
  2161. "kernel32.dll.LoadLibraryW",
  2162. "kernel32.dll.CreateDirectoryA",
  2163. "kernel32.dll.GetOEMCP",
  2164. "kernel32.dll.WaitForSingleObject",
  2165. "kernel32.dll.GetCPInfo",
  2166. "kernel32.dll.CreateEventA",
  2167. "kernel32.dll.GetSystemDirectoryA",
  2168. "kernel32.dll.GetCurrentDirectoryA",
  2169. "kernel32.dll.GetFullPathNameA",
  2170. "kernel32.dll.FindFirstFileA",
  2171. "kernel32.dll.GetDriveTypeA",
  2172. "kernel32.dll.FileTimeToLocalFileTime",
  2173. "kernel32.dll.FileTimeToSystemTime",
  2174. "kernel32.dll.FindClose",
  2175. "kernel32.dll.SetConsoleMode",
  2176. "kernel32.dll.ReadConsoleInputA",
  2177. "kernel32.dll.CreateThread",
  2178. "kernel32.dll.ExitThread",
  2179. "kernel32.dll.VirtualQuery",
  2180. "advapi32.dll.DeregisterEventSource",
  2181. "advapi32.dll.RegisterEventSourceA",
  2182. "advapi32.dll.ReportEventA",
  2183. "advapi32.dll.RegQueryValueExA",
  2184. "advapi32.dll.RegOpenKeyExA",
  2185. "advapi32.dll.CryptAcquireContextA",
  2186. "advapi32.dll.CryptGenRandom",
  2187. "oleaut32.dll.#9",
  2188. "oleaut32.dll.#2",
  2189. "shell32.dll.SHGetSpecialFolderLocation",
  2190. "shell32.dll.SHGetSpecialFolderPathA",
  2191. "shell32.dll.SHGetPathFromIDListA",
  2192. "user32.dll.MessageBoxA",
  2193. "user32.dll.CharLowerW",
  2194. "user32.dll.GetUserObjectInformationW",
  2195. "user32.dll.GetDesktopWindow",
  2196. "user32.dll.GetProcessWindowStation",
  2197. "user32.dll.CharUpperW",
  2198. "ws2_32.dll.freeaddrinfo",
  2199. "ws2_32.dll.getaddrinfo",
  2200. "ws2_32.dll.#17",
  2201. "ws2_32.dll.#55",
  2202. "ws2_32.dll.#54",
  2203. "ws2_32.dll.#13",
  2204. "ws2_32.dll.#8",
  2205. "ws2_32.dll.#14",
  2206. "ws2_32.dll.#57",
  2207. "ws2_32.dll.#52",
  2208. "ws2_32.dll.#10",
  2209. "ws2_32.dll.#19",
  2210. "ws2_32.dll.#18",
  2211. "ws2_32.dll.#151",
  2212. "ws2_32.dll.#5",
  2213. "ws2_32.dll.WSAIoctl",
  2214. "ws2_32.dll.#4",
  2215. "ws2_32.dll.#111",
  2216. "ws2_32.dll.#9",
  2217. "ws2_32.dll.#15",
  2218. "ws2_32.dll.#20",
  2219. "ws2_32.dll.#22",
  2220. "ws2_32.dll.#6",
  2221. "ws2_32.dll.#21",
  2222. "ws2_32.dll.#16",
  2223. "ws2_32.dll.#2",
  2224. "ws2_32.dll.#23",
  2225. "ws2_32.dll.#112",
  2226. "ws2_32.dll.#3",
  2227. "ws2_32.dll.#7",
  2228. "ws2_32.dll.#115",
  2229. "ws2_32.dll.#116",
  2230. "kernel32.dll.IsProcessorFeaturePresent",
  2231. "kernel32.dll.GetComputerNameW",
  2232. "kernel32.dll.GetLogicalDriveStringsW",
  2233. "kernel32.dll.GetVolumeInformationW",
  2234. "kernel32.dll.GetDriveTypeW",
  2235. "kernel32.dll.GetSystemDirectoryW",
  2236. "kernel32.dll.GetWindowsDirectoryA",
  2237. "kernel32.dll.GetWindowsDirectoryW",
  2238. "kernel32.dll.GetTempPathW",
  2239. "kernel32.dll.FindFirstFileW",
  2240. "kernel32.dll.FindNextFileW",
  2241. "kernel32.dll.SetFileAttributesW",
  2242. "kernel32.dll.GetFileAttributesW",
  2243. "kernel32.dll.MoveFileW",
  2244. "kernel32.dll.CreateDirectoryW",
  2245. "kernel32.dll.DeleteFileW",
  2246. "kernel32.dll.CopyFileW",
  2247. "kernel32.dll.DeviceIoControl",
  2248. "kernel32.dll.GetShortPathNameW",
  2249. "kernel32.dll.GetVersionExW",
  2250. "kernel32.dll.SetErrorMode",
  2251. "kernel32.dll.CreateProcessW",
  2252. "kernel32.dll.Wow64DisableWow64FsRedirection",
  2253. "kernel32.dll.Wow64RevertWow64FsRedirection",
  2254. "advapi32.dll.RegOpenKeyExW",
  2255. "advapi32.dll.RegQueryValueExW",
  2256. "advapi32.dll.RegSetValueExW",
  2257. "advapi32.dll.RegCreateKeyExW",
  2258. "advapi32.dll.RegDeleteValueW",
  2259. "advapi32.dll.RegEnumKeyW",
  2260. "advapi32.dll.RegQueryInfoKeyW",
  2261. "advapi32.dll.GetUserNameW",
  2262. "shell32.dll.SHGetFolderPathW",
  2263. "shell32.dll.ShellExecuteW",
  2264. "shell32.dll.SHGetKnownFolderPath",
  2265. "ole32.dll.CoInitializeEx",
  2266. "ole32.dll.CoUninitialize",
  2267. "ole32.dll.CoCreateInstance",
  2268. "ole32.dll.CoInitializeSecurity",
  2269. "ole32.dll.CoSetProxyBlanket",
  2270. "ole32.dll.CoTaskMemFree",
  2271. "oleaut32.dll.VariantClear",
  2272. "user32.dll.GetWindowRect",
  2273. "user32.dll.GetDC",
  2274. "user32.dll.DrawTextW",
  2275. "user32.dll.SystemParametersInfoW",
  2276. "user32.dll.GetForegroundWindow",
  2277. "gdi32.dll.CreateCompatibleDC",
  2278. "gdi32.dll.CreateCompatibleBitmap",
  2279. "gdi32.dll.SelectObject",
  2280. "gdi32.dll.DeleteObject",
  2281. "gdi32.dll.DeleteDC",
  2282. "gdi32.dll.CreateBrushIndirect",
  2283. "gdi32.dll.SetTextColor",
  2284. "gdi32.dll.SetBkColor",
  2285. "gdi32.dll.GetCurrentObject",
  2286. "gdi32.dll.GetObjectA",
  2287. "gdi32.dll.CreateFontIndirectA",
  2288. "gdi32.dll.CreateDIBSection",
  2289. "gdi32.dll.BitBlt",
  2290. "gdi32.dll.ExtFloodFill",
  2291. "netapi32.dll.NetServerGetInfo",
  2292. "netapi32.dll.NetApiBufferFree",
  2293. "netapi32.dll.NetWkstaGetInfo",
  2294. "kernel32.dll.SetProcessDEPPolicy",
  2295. "netapi32.dll.NetStatisticsGet",
  2296. "advapi32.dll.CryptAcquireContextW",
  2297. "advapi32.dll.CryptReleaseContext",
  2298. "cryptsp.dll.CryptAcquireContextW",
  2299. "cryptsp.dll.CryptGenRandom",
  2300. "cryptsp.dll.CryptReleaseContext",
  2301. "user32.dll.GetCursorInfo",
  2302. "user32.dll.GetQueueStatus",
  2303. "kernel32.dll.CreateToolhelp32Snapshot",
  2304. "kernel32.dll.Heap32First",
  2305. "kernel32.dll.Heap32Next",
  2306. "kernel32.dll.Heap32ListFirst",
  2307. "kernel32.dll.Heap32ListNext",
  2308. "kernel32.dll.Process32First",
  2309. "kernel32.dll.Process32Next",
  2310. "kernel32.dll.Thread32First",
  2311. "kernel32.dll.Thread32Next",
  2312. "kernel32.dll.Module32First",
  2313. "kernel32.dll.Module32Next",
  2314. "cryptsp.dll.CryptAcquireContextA",
  2315. "cryptbase.dll.SystemFunction036",
  2316. "uxtheme.dll.ThemeInitApiHook",
  2317. "user32.dll.IsProcessDPIAware",
  2318. "ole32.dll.CreateBindCtx",
  2319. "ole32.dll.CoTaskMemAlloc",
  2320. "ole32.dll.CoGetApartmentType",
  2321. "ole32.dll.CoRegisterInitializeSpy",
  2322. "comctl32.dll.#236",
  2323. "ole32.dll.CoGetMalloc",
  2324. "comctl32.dll.#320",
  2325. "comctl32.dll.#324",
  2326. "comctl32.dll.#323",
  2327. "comctl32.dll.#328",
  2328. "comctl32.dll.#334",
  2329. "advapi32.dll.InitializeSecurityDescriptor",
  2330. "advapi32.dll.SetEntriesInAclW",
  2331. "ntmarta.dll.GetMartaExtensionInterface",
  2332. "advapi32.dll.SetSecurityDescriptorDacl",
  2333. "advapi32.dll.IsTextUnicode",
  2334. "comctl32.dll.#332",
  2335. "comctl32.dll.#338",
  2336. "comctl32.dll.#339",
  2337. "shell32.dll.#102",
  2338. "ole32.dll.CoRevokeInitializeSpy",
  2339. "comctl32.dll.#388",
  2340. "ole32.dll.NdrOleInitializeExtension",
  2341. "ole32.dll.CoGetClassObject",
  2342. "ole32.dll.CoGetMarshalSizeMax",
  2343. "ole32.dll.CoMarshalInterface",
  2344. "ole32.dll.CoUnmarshalInterface",
  2345. "ole32.dll.StringFromIID",
  2346. "ole32.dll.CoGetPSClsid",
  2347. "ole32.dll.CoReleaseMarshalData",
  2348. "ole32.dll.DcomChannelSetHResult",
  2349. "oleaut32.dll.#500",
  2350. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  2351. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  2352. "comctl32.dll.#386",
  2353. "iphlpapi.dll.GetAdaptersAddresses",
  2354. "sechost.dll.LookupAccountNameLocalW",
  2355. "advapi32.dll.LookupAccountSidW",
  2356. "sechost.dll.LookupAccountSidLocalW"
  2357. ]
  2358.  
  2359. [*] Static Analysis: {
  2360. "pe": {
  2361. "peid_signatures": null,
  2362. "imports": [
  2363. {
  2364. "imports": [
  2365. {
  2366. "name": "ExitProcess",
  2367. "address": "0x40d014"
  2368. },
  2369. {
  2370. "name": "FormatMessageW",
  2371. "address": "0x40d018"
  2372. },
  2373. {
  2374. "name": "FreeEnvironmentStringsA",
  2375. "address": "0x40d01c"
  2376. },
  2377. {
  2378. "name": "FreeEnvironmentStringsW",
  2379. "address": "0x40d020"
  2380. },
  2381. {
  2382. "name": "GetACP",
  2383. "address": "0x40d024"
  2384. },
  2385. {
  2386. "name": "GetCPInfo",
  2387. "address": "0x40d028"
  2388. },
  2389. {
  2390. "name": "GetCommandLineA",
  2391. "address": "0x40d02c"
  2392. },
  2393. {
  2394. "name": "GetCommandLineW",
  2395. "address": "0x40d030"
  2396. },
  2397. {
  2398. "name": "GetCurrentProcess",
  2399. "address": "0x40d034"
  2400. },
  2401. {
  2402. "name": "GetCurrentProcessId",
  2403. "address": "0x40d038"
  2404. },
  2405. {
  2406. "name": "GetCurrentThreadId",
  2407. "address": "0x40d03c"
  2408. },
  2409. {
  2410. "name": "GetEnvironmentStrings",
  2411. "address": "0x40d040"
  2412. },
  2413. {
  2414. "name": "GetEnvironmentStringsW",
  2415. "address": "0x40d044"
  2416. },
  2417. {
  2418. "name": "GetFileType",
  2419. "address": "0x40d048"
  2420. },
  2421. {
  2422. "name": "GetLastError",
  2423. "address": "0x40d04c"
  2424. },
  2425. {
  2426. "name": "GetLocaleInfoA",
  2427. "address": "0x40d050"
  2428. },
  2429. {
  2430. "name": "GetModuleFileNameA",
  2431. "address": "0x40d054"
  2432. },
  2433. {
  2434. "name": "GetModuleFileNameW",
  2435. "address": "0x40d058"
  2436. },
  2437. {
  2438. "name": "GetModuleHandleA",
  2439. "address": "0x40d05c"
  2440. },
  2441. {
  2442. "name": "GetOEMCP",
  2443. "address": "0x40d060"
  2444. },
  2445. {
  2446. "name": "GetProcAddress",
  2447. "address": "0x40d064"
  2448. },
  2449. {
  2450. "name": "GetStartupInfoA",
  2451. "address": "0x40d068"
  2452. },
  2453. {
  2454. "name": "GetStartupInfoW",
  2455. "address": "0x40d06c"
  2456. },
  2457. {
  2458. "name": "GetStdHandle",
  2459. "address": "0x40d070"
  2460. },
  2461. {
  2462. "name": "GetStringTypeA",
  2463. "address": "0x40d074"
  2464. },
  2465. {
  2466. "name": "GetStringTypeW",
  2467. "address": "0x40d078"
  2468. },
  2469. {
  2470. "name": "GetSystemInfo",
  2471. "address": "0x40d07c"
  2472. },
  2473. {
  2474. "name": "GetSystemTimeAsFileTime",
  2475. "address": "0x40d080"
  2476. },
  2477. {
  2478. "name": "GetTickCount",
  2479. "address": "0x40d084"
  2480. },
  2481. {
  2482. "name": "GetVersionExA",
  2483. "address": "0x40d088"
  2484. },
  2485. {
  2486. "name": "HeapAlloc",
  2487. "address": "0x40d08c"
  2488. },
  2489. {
  2490. "name": "HeapCreate",
  2491. "address": "0x40d090"
  2492. },
  2493. {
  2494. "name": "HeapDestroy",
  2495. "address": "0x40d094"
  2496. },
  2497. {
  2498. "name": "HeapFree",
  2499. "address": "0x40d098"
  2500. },
  2501. {
  2502. "name": "HeapReAlloc",
  2503. "address": "0x40d09c"
  2504. },
  2505. {
  2506. "name": "InitializeCriticalSection",
  2507. "address": "0x40d0a0"
  2508. },
  2509. {
  2510. "name": "InterlockedCompareExchange",
  2511. "address": "0x40d0a4"
  2512. },
  2513. {
  2514. "name": "InterlockedExchange",
  2515. "address": "0x40d0a8"
  2516. },
  2517. {
  2518. "name": "IsDebuggerPresent",
  2519. "address": "0x40d0ac"
  2520. },
  2521. {
  2522. "name": "LCMapStringA",
  2523. "address": "0x40d0b0"
  2524. },
  2525. {
  2526. "name": "LCMapStringW",
  2527. "address": "0x40d0b4"
  2528. },
  2529. {
  2530. "name": "LeaveCriticalSection",
  2531. "address": "0x40d0b8"
  2532. },
  2533. {
  2534. "name": "EnterCriticalSection",
  2535. "address": "0x40d0bc"
  2536. },
  2537. {
  2538. "name": "LocalFree",
  2539. "address": "0x40d0c0"
  2540. },
  2541. {
  2542. "name": "MultiByteToWideChar",
  2543. "address": "0x40d0c4"
  2544. },
  2545. {
  2546. "name": "QueryPerformanceCounter",
  2547. "address": "0x40d0c8"
  2548. },
  2549. {
  2550. "name": "RtlUnwind",
  2551. "address": "0x40d0cc"
  2552. },
  2553. {
  2554. "name": "SetHandleCount",
  2555. "address": "0x40d0d0"
  2556. },
  2557. {
  2558. "name": "SetLastError",
  2559. "address": "0x40d0d4"
  2560. },
  2561. {
  2562. "name": "SetUnhandledExceptionFilter",
  2563. "address": "0x40d0d8"
  2564. },
  2565. {
  2566. "name": "Sleep",
  2567. "address": "0x40d0dc"
  2568. },
  2569. {
  2570. "name": "TerminateProcess",
  2571. "address": "0x40d0e0"
  2572. },
  2573. {
  2574. "name": "TlsAlloc",
  2575. "address": "0x40d0e4"
  2576. },
  2577. {
  2578. "name": "TlsFree",
  2579. "address": "0x40d0e8"
  2580. },
  2581. {
  2582. "name": "TlsGetValue",
  2583. "address": "0x40d0ec"
  2584. },
  2585. {
  2586. "name": "TlsSetValue",
  2587. "address": "0x40d0f0"
  2588. },
  2589. {
  2590. "name": "UnhandledExceptionFilter",
  2591. "address": "0x40d0f4"
  2592. },
  2593. {
  2594. "name": "VirtualAlloc",
  2595. "address": "0x40d0f8"
  2596. },
  2597. {
  2598. "name": "VirtualFree",
  2599. "address": "0x40d0fc"
  2600. },
  2601. {
  2602. "name": "VirtualProtect",
  2603. "address": "0x40d100"
  2604. },
  2605. {
  2606. "name": "VirtualQuery",
  2607. "address": "0x40d104"
  2608. },
  2609. {
  2610. "name": "WideCharToMultiByte",
  2611. "address": "0x40d108"
  2612. },
  2613. {
  2614. "name": "WriteFile",
  2615. "address": "0x40d10c"
  2616. },
  2617. {
  2618. "name": "SetErrorMode",
  2619. "address": "0x40d110"
  2620. },
  2621. {
  2622. "name": "LoadLibraryW",
  2623. "address": "0x40d114"
  2624. },
  2625. {
  2626. "name": "HeapSize",
  2627. "address": "0x40d118"
  2628. },
  2629. {
  2630. "name": "IsValidCodePage",
  2631. "address": "0x40d11c"
  2632. },
  2633. {
  2634. "name": "InitializeCriticalSectionAndSpinCount",
  2635. "address": "0x40d120"
  2636. },
  2637. {
  2638. "name": "InterlockedDecrement",
  2639. "address": "0x40d124"
  2640. },
  2641. {
  2642. "name": "DeleteCriticalSection",
  2643. "address": "0x40d128"
  2644. },
  2645. {
  2646. "name": "CreateThread",
  2647. "address": "0x40d12c"
  2648. },
  2649. {
  2650. "name": "CreateDirectoryW",
  2651. "address": "0x40d130"
  2652. },
  2653. {
  2654. "name": "InterlockedIncrement",
  2655. "address": "0x40d134"
  2656. },
  2657. {
  2658. "name": "GetModuleHandleW",
  2659. "address": "0x40d138"
  2660. },
  2661. {
  2662. "name": "LoadLibraryA",
  2663. "address": "0x40d13c"
  2664. },
  2665. {
  2666. "name": "CloseHandle",
  2667. "address": "0x40d140"
  2668. }
  2669. ],
  2670. "dll": "KERNEL32.dll"
  2671. },
  2672. {
  2673. "imports": [
  2674. {
  2675. "name": "LoadCursorW",
  2676. "address": "0x40d164"
  2677. },
  2678. {
  2679. "name": "LoadIconA",
  2680. "address": "0x40d168"
  2681. },
  2682. {
  2683. "name": "SetTimer",
  2684. "address": "0x40d16c"
  2685. },
  2686. {
  2687. "name": "CharLowerW",
  2688. "address": "0x40d170"
  2689. },
  2690. {
  2691. "name": "PtInRect",
  2692. "address": "0x40d174"
  2693. },
  2694. {
  2695. "name": "MessageBoxW",
  2696. "address": "0x40d178"
  2697. },
  2698. {
  2699. "name": "LoadIconW",
  2700. "address": "0x40d17c"
  2701. },
  2702. {
  2703. "name": "KillTimer",
  2704. "address": "0x40d180"
  2705. },
  2706. {
  2707. "name": "IsIconic",
  2708. "address": "0x40d184"
  2709. },
  2710. {
  2711. "name": "GetWindowRect",
  2712. "address": "0x40d188"
  2713. },
  2714. {
  2715. "name": "GetSystemMetrics",
  2716. "address": "0x40d18c"
  2717. },
  2718. {
  2719. "name": "GetCursorPos",
  2720. "address": "0x40d190"
  2721. },
  2722. {
  2723. "name": "GetClientRect",
  2724. "address": "0x40d194"
  2725. },
  2726. {
  2727. "name": "EnableWindow",
  2728. "address": "0x40d198"
  2729. },
  2730. {
  2731. "name": "DrawIcon",
  2732. "address": "0x40d19c"
  2733. },
  2734. {
  2735. "name": "SendMessageW",
  2736. "address": "0x40d1a0"
  2737. }
  2738. ],
  2739. "dll": "USER32.dll"
  2740. },
  2741. {
  2742. "imports": [
  2743. {
  2744. "name": "RegOpenKeyA",
  2745. "address": "0x40d000"
  2746. },
  2747. {
  2748. "name": "RegQueryValueExW",
  2749. "address": "0x40d004"
  2750. }
  2751. ],
  2752. "dll": "ADVAPI32.dll"
  2753. },
  2754. {
  2755. "imports": [
  2756. {
  2757. "name": "ShellExecuteW",
  2758. "address": "0x40d148"
  2759. },
  2760. {
  2761. "name": "SHBrowseForFolderW",
  2762. "address": "0x40d14c"
  2763. },
  2764. {
  2765. "name": "SHGetMalloc",
  2766. "address": "0x40d150"
  2767. },
  2768. {
  2769. "name": "SHGetPathFromIDListW",
  2770. "address": "0x40d154"
  2771. }
  2772. ],
  2773. "dll": "SHELL32.dll"
  2774. },
  2775. {
  2776. "imports": [
  2777. {
  2778. "name": "PathFileExistsW",
  2779. "address": "0x40d15c"
  2780. }
  2781. ],
  2782. "dll": "SHLWAPI.dll"
  2783. },
  2784. {
  2785. "imports": [
  2786. {
  2787. "name": "InitCommonControlsEx",
  2788. "address": "0x40d00c"
  2789. }
  2790. ],
  2791. "dll": "COMCTL32.dll"
  2792. }
  2793. ],
  2794. "digital_signers": null,
  2795. "exported_dll_name": null,
  2796. "actual_checksum": "0x001229bc",
  2797. "overlay": {
  2798. "size": "0x000014b0",
  2799. "offset": "0x00113000"
  2800. },
  2801. "imagebase": "0x00400000",
  2802. "reported_checksum": "0x0011e99e",
  2803. "icon_hash": null,
  2804. "entrypoint": "0x00406cf9",
  2805. "timestamp": "2019-06-18 22:02:11",
  2806. "osversion": "5.0",
  2807. "sections": [
  2808. {
  2809. "name": ".text",
  2810. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  2811. "virtual_address": "0x00001000",
  2812. "size_of_data": "0x0000be00",
  2813. "entropy": "4.83",
  2814. "raw_address": "0x00000400",
  2815. "virtual_size": "0x0000bd6e",
  2816. "characteristics_raw": "0x60000020"
  2817. },
  2818. {
  2819. "name": ".rdata",
  2820. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2821. "virtual_address": "0x0000d000",
  2822. "size_of_data": "0x00105400",
  2823. "entropy": "7.21",
  2824. "raw_address": "0x0000c200",
  2825. "virtual_size": "0x001053ae",
  2826. "characteristics_raw": "0x40000040"
  2827. },
  2828. {
  2829. "name": ".data",
  2830. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2831. "virtual_address": "0x00113000",
  2832. "size_of_data": "0x00001000",
  2833. "entropy": "3.01",
  2834. "raw_address": "0x00111600",
  2835. "virtual_size": "0x00001b9c",
  2836. "characteristics_raw": "0xc0000040"
  2837. },
  2838. {
  2839. "name": ".rsrc",
  2840. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  2841. "virtual_address": "0x00115000",
  2842. "size_of_data": "0x00000a00",
  2843. "entropy": "3.68",
  2844. "raw_address": "0x00112600",
  2845. "virtual_size": "0x000f28e8",
  2846. "characteristics_raw": "0x40000040"
  2847. }
  2848. ],
  2849. "resources": [],
  2850. "dirents": [
  2851. {
  2852. "virtual_address": "0x00000000",
  2853. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  2854. "size": "0x00000000"
  2855. },
  2856. {
  2857. "virtual_address": "0x00111a34",
  2858. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  2859. "size": "0x0000008c"
  2860. },
  2861. {
  2862. "virtual_address": "0x00115000",
  2863. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  2864. "size": "0x000008e8"
  2865. },
  2866. {
  2867. "virtual_address": "0x00000000",
  2868. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2869. "size": "0x00000000"
  2870. },
  2871. {
  2872. "virtual_address": "0x00113000",
  2873. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2874. "size": "0x000014b0"
  2875. },
  2876. {
  2877. "virtual_address": "0x00000000",
  2878. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2879. "size": "0x00000000"
  2880. },
  2881. {
  2882. "virtual_address": "0x00000000",
  2883. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2884. "size": "0x00000000"
  2885. },
  2886. {
  2887. "virtual_address": "0x00000000",
  2888. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2889. "size": "0x00000000"
  2890. },
  2891. {
  2892. "virtual_address": "0x00000000",
  2893. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2894. "size": "0x00000000"
  2895. },
  2896. {
  2897. "virtual_address": "0x00000000",
  2898. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2899. "size": "0x00000000"
  2900. },
  2901. {
  2902. "virtual_address": "0x00000000",
  2903. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2904. "size": "0x00000000"
  2905. },
  2906. {
  2907. "virtual_address": "0x00000000",
  2908. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2909. "size": "0x00000000"
  2910. },
  2911. {
  2912. "virtual_address": "0x0000d000",
  2913. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2914. "size": "0x000001a8"
  2915. },
  2916. {
  2917. "virtual_address": "0x00000000",
  2918. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2919. "size": "0x00000000"
  2920. },
  2921. {
  2922. "virtual_address": "0x00000000",
  2923. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2924. "size": "0x00000000"
  2925. },
  2926. {
  2927. "virtual_address": "0x00000000",
  2928. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2929. "size": "0x00000000"
  2930. }
  2931. ],
  2932. "exports": [],
  2933. "guest_signers": {},
  2934. "imphash": "a58f8955fbf36d24d6a4f04b9287829e",
  2935. "icon_fuzzy": null,
  2936. "icon": null,
  2937. "pdbpath": null,
  2938. "imported_dll_count": 6,
  2939. "versioninfo": []
  2940. }
  2941. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!