Exes_3b3421c72a73687fb19f7198011c95a4_exe.json

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "Exes_3b3421c72a73687fb19f7198011c95a4.exe"
[*] File Size: 260096
[*] File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
[*] SHA256: "ec966d7f0471f58fb951c4a5bc80f56be48007377fc7f5d8d27b0370bb7ea92c"
[*] MD5: "3b3421c72a73687fb19f7198011c95a4"
[*] SHA1: "a4450a7fdac2ff02232f3aa263fc1d97d8d064c0"
[*] SHA512: "17ffb94f30c7e87b1589bd4a39c74bbf6e5da237e13b4fc0d325ea1d5749298a27f73f07fdf5156d14e00f13fc543595177a223814794ab8504b0eaa22ca7de7"
[*] CRC32: "8DCEAA1C"
[*] SSDEEP: "6144:vdzjGZN771/1fGRgKVRBOx1PiaxinRmeCSwewfXUZ:vdmZN771dzKVbOxNiciRONewf"

[*] Process Execution: [
    "Exes_3b3421c72a73687fb19f7198011c95a4.exe",
    "RegAsm.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Creates RWX memory",
        "Details": []
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
            },
            {
                "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
            },
            {
                "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
            },
            {
                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
            },
            {
                "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
            },
            {
                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
            },
            {
                "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
            },
            {
                "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
            },
            {
                "url": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes"
            }
        ]
    },
    {
        "Description": "The binary likely contains encrypted or compressed data.",
        "Details": [
            {
                "section": "name: .text, entropy: 7.97, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x0003ec00, virtual_size: 0x0003ebb4"
            }
        ]
    },
    {
        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details": [
            {
                "Injection": "Exes_3b3421c72a73687fb19f7198011c95a4.exe(2380) -> RegAsm.exe(2732)"
            }
        ]
    },
    {
        "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Gen:Variant.Ser.Ursu.4628"
            },
            {
                "FireEye": "Generic.mg.3b3421c72a73687f"
            },
            {
                "Cylance": "Unsafe"
            },
            {
                "Alibaba": "Trojan:MSIL/GenKryptik.49ca7dc8"
            },
            {
                "K7GW": "Trojan ( 005504541 )"
            },
            {
                "K7AntiVirus": "Trojan ( 005504541 )"
            },
            {
                "Symantec": "ML.Attribute.HighConfidence"
            },
            {
                "APEX": "Malicious"
            },
            {
                "Paloalto": "generic.ml"
            },
            {
                "Kaspersky": "HEUR:Trojan.MSIL.Injects.gen"
            },
            {
                "BitDefender": "Gen:Variant.Ser.Ursu.4628"
            },
            {
                "Avast": "Win32:CrypterX-gen [Trj]"
            },
            {
                "Emsisoft": "Gen:Variant.Ser.Ursu.4628 (B)"
            },
            {
                "F-Secure": "Trojan.TR/Kryptik.highl"
            },
            {
                "Invincea": "heuristic"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Win32.Generic.dc"
            },
            {
                "Fortinet": "MSIL/GenKryptik.DKEY!tr"
            },
            {
                "Trapmine": "malicious.high.ml.score"
            },
            {
                "ESET-NOD32": "a variant of MSIL/Kryptik.SAD"
            },
            {
                "Avira": "TR/Kryptik.highl"
            },
            {
                "MAX": "malware (ai score=99)"
            },
            {
                "Microsoft": "Trojan:Win32/Dynamer!rfn"
            },
            {
                "AegisLab": "Trojan.MSIL.Injects.4!c"
            },
            {
                "ZoneAlarm": "HEUR:Trojan.MSIL.Injects.gen"
            },
            {
                "GData": "Win32.Trojan-Stealer.FormBook.A2MI10"
            },
            {
                "AhnLab-V3": "Trojan/Win32.Agent.C3291189"
            },
            {
                "Acronis": "suspicious"
            },
            {
                "McAfee": "RDN/Generic.grp"
            },
            {
                "Rising": "Trojan.Kryptik!8.8 (CLOUD)"
            },
            {
                "SentinelOne": "DFI - Malicious PE"
            },
            {
                "Ad-Aware": "Gen:Variant.Ser.Ursu.4628"
            },
            {
                "AVG": "Win32:CrypterX-gen [Trj]"
            },
            {
                "Cybereason": "malicious.fdac2f"
            },
            {
                "Panda": "Trj/GdSda.A"
            },
            {
                "CrowdStrike": "win/malicious_confidence_100% (W)"
            },
            {
                "Qihoo-360": "Win32/Trojan.de5"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: [
    "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\""
]

[*] Mutexes: [
    "Global\\CLR_CASOFF_MUTEX"
]

[*] Modified Files: []

[*] Deleted Files: [
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2380.11524718",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2380.11524718",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2380.11524734"
]

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: []

[*] Domains: []

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "www.download.windowsupdate.com",
        "version": "1.1",
        "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.thawte.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "th.symcd.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
        "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
        "user-agent": "Microsoft BITS/7.5",
        "method": "HEAD",
        "host": "redirector.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
        "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "HEAD",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-6868\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6869-17161\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=17162-29600\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=29601-44418\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=44419-65683\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=65684-83121\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=83122-175173\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=175174-309884\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=309885-493346\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=493347-652456\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=652457-916269\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=916270-1471483\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1471484-2477476\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2477477-3701900\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3701901-4797066\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=4797067-5751498\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5751499-6766851\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6766852-8482504\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=8482505-10313101\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=10313102-11536390\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r4---sn-tt1eln7l.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902242&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=11536391-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "5.8.14.9",
            "name": "GoKuEikbf6Q8LPctLslC6Apn3pN"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Windows.Forms"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.CallType",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Interaction",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.IContainer",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.ApplicationSettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.SettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Color",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Font",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.FontStyle",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.GraphicsUnit",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Point",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Size",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.SizeF",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.SystemColors",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Windows.Forms.Application",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.AutoScaleMode",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Button",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.ButtonBase",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.ContainerControl",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control/ControlCollection",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.DialogResult",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Form",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.FormBorderStyle",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.FormStartPosition",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.GroupBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Label",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxButtons",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxIcon",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.RadioButton",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "Microsoft.Win32.Registry",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryKey",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AppDomain",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Buffer",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.IEnumerable`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Convert",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventHandler",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Globalization.CultureInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IDisposable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.NullReferenceException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyConfigurationAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GuidAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeFieldHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00049cb9",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x00440bae",
        "timestamp": "2019-06-17 09:17:10",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x0003ec00",
                "entropy": "7.97",
                "raw_address": "0x00000200",
                "virtual_size": "0x0003ebb4",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00042000",
                "size_of_data": "0x00000800",
                "entropy": "3.50",
                "raw_address": "0x0003ee00",
                "virtual_size": "0x00000800",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00044000",
                "size_of_data": "0x00000200",
                "entropy": "0.08",
                "raw_address": "0x0003f600",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00040b54",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000057"
            },
            {
                "virtual_address": "0x00042000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000800"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00044000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}

[*] Resolved APIs: [
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "kernel32.dll.QueryActCtxW",
    "shlwapi.dll.UrlIsW",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "kernel32.dll.IsProcessorFeaturePresent",
    "msvcrt.dll._set_error_mode",
    "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "mscoree.dll.GetProcessExecutableHeap",
    "mscorwks.dll._CorExeMain",
    "mscorwks.dll.GetCLRFunction",
    "advapi32.dll.RegisterTraceGuidsW",
    "advapi32.dll.UnregisterTraceGuids",
    "advapi32.dll.GetTraceLoggerHandle",
    "advapi32.dll.GetTraceEnableLevel",
    "advapi32.dll.GetTraceEnableFlags",
    "advapi32.dll.TraceEvent",
    "mscoree.dll.IEE",
    "mscorwks.dll.IEE",
    "mscoree.dll.GetStartupFlags",
    "mscoree.dll.GetHostConfigurationFile",
    "mscoree.dll.GetCORSystemDirectory",
    "ntdll.dll.RtlUnwind",
    "kernel32.dll.IsWow64Process",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAce",
    "advapi32.dll.FreeSid",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.AddVectoredContinueHandler",
    "kernel32.dll.RemoveVectoredContinueHandler",
    "advapi32.dll.ConvertSidToStringSidW",
    "shell32.dll.SHGetFolderPathW",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.GetWriteWatch",
    "kernel32.dll.ResetWriteWatch",
    "kernel32.dll.CreateMemoryResourceNotification",
    "kernel32.dll.QueryMemoryResourceNotification",
    "ole32.dll.CoInitializeEx",
    "cryptbase.dll.SystemFunction036",
    "ole32.dll.CoGetContextToken",
    "kernel32.dll.GetFullPathNameW",
    "kernel32.dll.GetVersionExW",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptDestroyHash",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "advapi32.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "advapi32.dll.CryptGenKey",
    "advapi32.dll.CryptGetKeyParam",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptVerifySignatureA",
    "advapi32.dll.CryptSignHashA",
    "advapi32.dll.CryptGetProvParam",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptEnumProvidersA",
    "mscoree.dll.GetMetaDataInternalInterface",
    "mscorwks.dll.GetMetaDataInternalInterface",
    "mscorjit.dll.getJit",
    "kernel32.dll.GetACP",
    "kernel32.dll.GetUserDefaultUILanguage",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GetFileAttributesExW",
    "culture.dll.ConvertLangIdToCultureName",
    "kernel32.dll.GetCurrentProcessId",
    "kernel32.dll.FindAtomW",
    "kernel32.dll.AddAtomW",
    "mscoree.dll.LoadLibraryShim",
    "gdiplus.dll.GdiplusStartup",
    "user32.dll.GetWindowInfo",
    "user32.dll.GetAncestor",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.EnumDisplayDevicesA",
    "gdi32.dll.ExtTextOutW",
    "gdi32.dll.GdiIsMetaPrintDC",
    "gdiplus.dll.GdipLoadImageFromStream",
    "windowscodecs.dll.DllGetClassObject",
    "kernel32.dll.WerRegisterMemoryBlock",
    "gdiplus.dll.GdipImageForceValidation",
    "gdiplus.dll.GdipGetImageType",
    "gdiplus.dll.GdipGetImageRawFormat",
    "gdiplus.dll.GdipGetImageWidth",
    "gdiplus.dll.GdipGetImageHeight",
    "gdiplus.dll.GdipBitmapGetPixel",
    "gdiplus.dll.GdipDisposeImage",
    "kernel32.dll.SwitchToThread",
    "kernel32.dll.GlobalMemoryStatusEx",
    "advapi32.dll.LookupPrivilegeValueW",
    "kernel32.dll.GetCurrentProcess",
    "advapi32.dll.AdjustTokenPrivileges",
    "kernel32.dll.OpenProcess",
    "kernel32.dll.GetExitCodeProcess",
    "advapi32.dll.GetKernelObjectSecurity",
    "advapi32.dll.CreateWellKnownSid",
    "advapi32.dll.SetKernelObjectSecurity",
    "kernel32.dll.IsDebuggerPresent",
    "kernel32.dll.CreateProcessW",
    "kernel32.dll.GetThreadContext",
    "kernel32.dll.ReadProcessMemory",
    "kernel32.dll.VirtualAllocEx",
    "kernel32.dll.WriteProcessMemory",
    "kernel32.dll.SetThreadContext",
    "kernel32.dll.ResumeThread",
    "psapi.dll.EnumProcesses",
    "kernel32.dll.DeleteAtom",
    "ole32.dll.CoUninitialize",
    "kernel32.dll.CreateActCtxW",
    "kernel32.dll.AddRefActCtx",
    "kernel32.dll.ReleaseActCtx",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.DeactivateActCtx",
    "kernel32.dll.GetCurrentActCtx"
]

[*] Static Analysis: {
    "dotnet": {
        "customattrs": null,
        "assemblyinfo": {
            "version": "5.8.14.9",
            "name": "GoKuEikbf6Q8LPctLslC6Apn3pN"
        },
        "assemblyrefs": [
            {
                "version": "2.0.0.0",
                "name": "mscorlib"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Drawing"
            },
            {
                "version": "2.0.0.0",
                "name": "System.Windows.Forms"
            },
            {
                "version": "2.0.0.0",
                "name": "System"
            },
            {
                "version": "8.0.0.0",
                "name": "Microsoft.VisualBasic"
            }
        ],
        "typerefs": [
            {
                "typename": "Microsoft.VisualBasic.CallType",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "Microsoft.VisualBasic.Interaction",
                "assembly": "Microsoft.VisualBasic"
            },
            {
                "typename": "System.CodeDom.Compiler.GeneratedCodeAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableAttribute",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.EditorBrowsableState",
                "assembly": "System"
            },
            {
                "typename": "System.ComponentModel.IContainer",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.ApplicationSettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Configuration.SettingsBase",
                "assembly": "System"
            },
            {
                "typename": "System.Drawing.Bitmap",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Color",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Font",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.FontStyle",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.GraphicsUnit",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Image",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Point",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.Size",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.SizeF",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Drawing.SystemColors",
                "assembly": "System.Drawing"
            },
            {
                "typename": "System.Windows.Forms.Application",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.AutoScaleMode",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Button",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.ButtonBase",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.ContainerControl",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Control/ControlCollection",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.DialogResult",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Form",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.FormBorderStyle",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.FormStartPosition",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.GroupBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.Label",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBox",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxButtons",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.MessageBoxIcon",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "System.Windows.Forms.RadioButton",
                "assembly": "System.Windows.Forms"
            },
            {
                "typename": "Microsoft.Win32.Registry",
                "assembly": "mscorlib"
            },
            {
                "typename": "Microsoft.Win32.RegistryKey",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.AppDomain",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Array",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Buffer",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Byte",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.IEnumerable`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Collections.Generic.List`1",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Convert",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggableAttribute/DebuggingModes",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Diagnostics.DebuggerNonUserCodeAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventArgs",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.EventHandler",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Globalization.CultureInfo",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.IDisposable",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Int32",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.NullReferenceException",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Object",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.Assembly",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCompanyAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyConfigurationAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyCopyrightAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyDescriptionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyFileVersionAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyProductAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTitleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Reflection.AssemblyTrademarkAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Resources.ResourceManager",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilationRelaxationsAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.CompilerGeneratedAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeCompatibilityAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.CompilerServices.RuntimeHelpers",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.ComVisibleAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Runtime.InteropServices.GuidAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeFieldHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.RuntimeTypeHandle",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.STAThreadAttribute",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.String",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Text.Encoding",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.Type",
                "assembly": "mscorlib"
            },
            {
                "typename": "System.ValueType",
                "assembly": "mscorlib"
            }
        ]
    },
    "pe": {
        "peid_signatures": null,
        "imports": [
            {
                "imports": [
                    {
                        "name": "_CorExeMain",
                        "address": "0x402000"
                    }
                ],
                "dll": "mscoree.dll"
            }
        ],
        "digital_signers": null,
        "exported_dll_name": null,
        "actual_checksum": "0x00049cb9",
        "overlay": null,
        "imagebase": "0x00400000",
        "reported_checksum": "0x00000000",
        "icon_hash": null,
        "entrypoint": "0x00440bae",
        "timestamp": "2019-06-17 09:17:10",
        "osversion": "4.0",
        "sections": [
            {
                "name": ".text",
                "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00002000",
                "size_of_data": "0x0003ec00",
                "entropy": "7.97",
                "raw_address": "0x00000200",
                "virtual_size": "0x0003ebb4",
                "characteristics_raw": "0x60000020"
            },
            {
                "name": ".rsrc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00042000",
                "size_of_data": "0x00000800",
                "entropy": "3.50",
                "raw_address": "0x0003ee00",
                "virtual_size": "0x00000800",
                "characteristics_raw": "0x40000040"
            },
            {
                "name": ".reloc",
                "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
                "virtual_address": "0x00044000",
                "size_of_data": "0x00000200",
                "entropy": "0.08",
                "raw_address": "0x0003f600",
                "virtual_size": "0x0000000c",
                "characteristics_raw": "0x42000040"
            }
        ],
        "resources": [],
        "dirents": [
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00040b54",
                "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
                "size": "0x00000057"
            },
            {
                "virtual_address": "0x00042000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
                "size": "0x00000800"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00044000",
                "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
                "size": "0x0000000c"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_TLS",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002000",
                "name": "IMAGE_DIRECTORY_ENTRY_IAT",
                "size": "0x00000008"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
                "size": "0x00000000"
            },
            {
                "virtual_address": "0x00002008",
                "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
                "size": "0x00000048"
            },
            {
                "virtual_address": "0x00000000",
                "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
                "size": "0x00000000"
            }
        ],
        "exports": [],
        "guest_signers": {},
        "imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
        "icon_fuzzy": null,
        "icon": null,
        "pdbpath": null,
        "imported_dll_count": 1,
        "versioninfo": []
    }
}