API tools faq
paste
paladin316

ALJ-Project-827278242-3948394739583946739473363543_exe.json

paladin316
Jun 17th, 2019
2,374
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 91.60 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Razy"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "ALJ-Project-827278242-3948394739583946739473363543.exe"
  7. [*] File Size: 1238912
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "a5f130c987f1d1d69a0e83c837c0725c643e56e251ccbc2f04c3b4760ae9b447"
  10. [*] MD5: "1b8a4519b04850591e76785d967acd97"
  11. [*] SHA1: "fea28bf4a1bb962661c7bac583a32690cd3d971a"
  12. [*] SHA512: "d9cc3c2aaf6cad9916e3392c51c60dba6a604dadc1c2ad7a8d65e6126b8d0fd3cbcb6e8e519daa6e7f53d5fd6bc4354fd2a6cf32f60a5b24ee13d16d36965c78"
  13. [*] CRC32: "9F46E0E2"
  14. [*] SSDEEP: "3072:66xPwtf53BVoNA+ono3nmDhwfojWi2upN7TXODyuF94zl7lS763M6MKLfIZpivHh:zxPwx53BVoNAfc+yfOWZu7rsqN4pi06"
  15.  
  16. [*] Process Execution: [
  17. "ALJ-Project-827278242-3948394739583946739473363543.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Performs some HTTP requests",
  27. "Details": [
  28. {
  29. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  30. },
  31. {
  32. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  33. },
  34. {
  35. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  36. },
  37. {
  38. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  39. },
  40. {
  41. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  42. },
  43. {
  44. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  45. },
  46. {
  47. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  48. },
  49. {
  50. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  51. },
  52. {
  53. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  54. },
  55. {
  56. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  57. },
  58. {
  59. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  60. },
  61. {
  62. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  63. },
  64. {
  65. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  66. },
  67. {
  68. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  69. },
  70. {
  71. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  72. },
  73. {
  74. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  75. },
  76. {
  77. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  78. },
  79. {
  80. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  81. },
  82. {
  83. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  84. },
  85. {
  86. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  87. },
  88. {
  89. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  90. },
  91. {
  92. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  93. },
  94. {
  95. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  96. },
  97. {
  98. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  99. },
  100. {
  101. "url": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes"
  102. }
  103. ]
  104. },
  105. {
  106. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  107. "Details": [
  108. {
  109. "Spam": "ALJ-Project-827278242-3948394739583946739473363543.exe (2628) called API CreateProcessInternalW 39793 times"
  110. },
  111. {
  112. "Spam": "ALJ-Project-827278242-3948394739583946739473363543.exe (2628) called API GetLocalTime 87224 times"
  113. }
  114. ]
  115. },
  116. {
  117. "Description": "File has been identified by 45 Antiviruses on VirusTotal as malicious",
  118. "Details": [
  119. {
  120. "MicroWorld-eScan": "Gen:Variant.Razy.514134"
  121. },
  122. {
  123. "FireEye": "Gen:Variant.Razy.514134"
  124. },
  125. {
  126. "CAT-QuickHeal": "Backdoor.Androm"
  127. },
  128. {
  129. "ALYac": "Gen:Variant.Razy.514134"
  130. },
  131. {
  132. "Cylance": "Unsafe"
  133. },
  134. {
  135. "Alibaba": "Backdoor:Win32/Androm.1b4dfeca"
  136. },
  137. {
  138. "K7GW": "Trojan ( 0054f6711 )"
  139. },
  140. {
  141. "K7AntiVirus": "Trojan ( 0054f6711 )"
  142. },
  143. {
  144. "Arcabit": "Trojan.Razy.D7D856"
  145. },
  146. {
  147. "Symantec": "Trojan.Gen.MBT"
  148. },
  149. {
  150. "APEX": "Malicious"
  151. },
  152. {
  153. "Paloalto": "generic.ml"
  154. },
  155. {
  156. "ClamAV": "Win.Malware.Unsafe-6987584-0"
  157. },
  158. {
  159. "Kaspersky": "Backdoor.Win32.Androm.sktx"
  160. },
  161. {
  162. "BitDefender": "Gen:Variant.Razy.514134"
  163. },
  164. {
  165. "NANO-Antivirus": "Trojan.Win32.Androm.fraqbz"
  166. },
  167. {
  168. "ViRobot": "Trojan.Win32.Z.Razy.1238912"
  169. },
  170. {
  171. "Rising": "Backdoor.Androm!8.113 (CLOUD)"
  172. },
  173. {
  174. "Ad-Aware": "Gen:Variant.Razy.514134"
  175. },
  176. {
  177. "Emsisoft": "Gen:Variant.Razy.514134 (B)"
  178. },
  179. {
  180. "F-Secure": "Trojan.TR/Injector.jghha"
  181. },
  182. {
  183. "DrWeb": "Trojan.PWS.Stealer.23680"
  184. },
  185. {
  186. "TrendMicro": "Trojan.Win32.MALREP.THFOFAI"
  187. },
  188. {
  189. "McAfee-GW-Edition": "Fareit-FOX!1B8A4519B048"
  190. },
  191. {
  192. "Sophos": "Mal/FareitVB-N"
  193. },
  194. {
  195. "Ikarus": "Trojan.VB.Crypt"
  196. },
  197. {
  198. "ESET-NOD32": "a variant of Win32/Injector.EFUD"
  199. },
  200. {
  201. "Avira": "TR/Injector.jghha"
  202. },
  203. {
  204. "MAX": "malware (ai score=100)"
  205. },
  206. {
  207. "Antiy-AVL": "Trojan[Backdoor]/Win32.Androm"
  208. },
  209. {
  210. "Microsoft": "VirTool:Win32/VBInject.AJH!bit"
  211. },
  212. {
  213. "Endgame": "malicious (high confidence)"
  214. },
  215. {
  216. "AegisLab": "Trojan.Win32.Androm.4!c"
  217. },
  218. {
  219. "ZoneAlarm": "Backdoor.Win32.Androm.sktx"
  220. },
  221. {
  222. "GData": "Gen:Variant.Razy.514134"
  223. },
  224. {
  225. "AhnLab-V3": "Backdoor/Win32.Androm.R274831"
  226. },
  227. {
  228. "McAfee": "Fareit-FOX!1B8A4519B048"
  229. },
  230. {
  231. "Panda": "Trj/GdSda.A"
  232. },
  233. {
  234. "TrendMicro-HouseCall": "Trojan.Win32.MALREP.THFOFAI"
  235. },
  236. {
  237. "Tencent": "Win32.Backdoor.Lokibot.Auto"
  238. },
  239. {
  240. "Fortinet": "W32/Injector.EFWV!tr"
  241. },
  242. {
  243. "AVG": "Win32:DangerousSig [Trj]"
  244. },
  245. {
  246. "Cybereason": "malicious.9b0485"
  247. },
  248. {
  249. "Avast": "Win32:DangerousSig [Trj]"
  250. },
  251. {
  252. "Qihoo-360": "Win32/Backdoor.bb6"
  253. }
  254. ]
  255. }
  256. ]
  257.  
  258. [*] Started Service: []
  259.  
  260. [*] Executed Commands: [
  261. "\\x01C:\\Users\\user\\AppData\\Local\\Temp\\ALJ-Project-827278242-3948394739583946739473363543.exe\""
  262. ]
  263.  
  264. [*] Mutexes: []
  265.  
  266. [*] Modified Files: [
  267. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2B2EAA82AE666CBB.TMP"
  268. ]
  269.  
  270. [*] Deleted Files: []
  271.  
  272. [*] Modified Registry Keys: []
  273.  
  274. [*] Deleted Registry Keys: []
  275.  
  276. [*] DNS Communications: []
  277.  
  278. [*] Domains: []
  279.  
  280. [*] Network Communication - ICMP: []
  281.  
  282. [*] Network Communication - HTTP: [
  283. {
  284. "count": 1,
  285. "body": "",
  286. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  287. "user-agent": "Microsoft-CryptoAPI/6.1",
  288. "method": "GET",
  289. "host": "ocsp.digicert.com",
  290. "version": "1.1",
  291. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  292. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  293. "port": 80
  294. },
  295. {
  296. "count": 1,
  297. "body": "",
  298. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  299. "user-agent": "Microsoft-CryptoAPI/6.1",
  300. "method": "GET",
  301. "host": "ocsp.digicert.com",
  302. "version": "1.1",
  303. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  304. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  305. "port": 80
  306. },
  307. {
  308. "count": 1,
  309. "body": "",
  310. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  311. "user-agent": "Microsoft-CryptoAPI/6.1",
  312. "method": "GET",
  313. "host": "ocsp.digicert.com",
  314. "version": "1.1",
  315. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  316. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  317. "port": 80
  318. },
  319. {
  320. "count": 1,
  321. "body": "",
  322. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  323. "user-agent": "Microsoft-CryptoAPI/6.1",
  324. "method": "GET",
  325. "host": "ocsp.pki.goog",
  326. "version": "1.1",
  327. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  328. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  329. "port": 80
  330. },
  331. {
  332. "count": 1,
  333. "body": "",
  334. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  335. "user-agent": "Microsoft-CryptoAPI/6.1",
  336. "method": "GET",
  337. "host": "ocsp.digicert.com",
  338. "version": "1.1",
  339. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  340. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  341. "port": 80
  342. },
  343. {
  344. "count": 1,
  345. "body": "",
  346. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  347. "user-agent": "Microsoft-CryptoAPI/6.1",
  348. "method": "GET",
  349. "host": "crl.microsoft.com",
  350. "version": "1.1",
  351. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  352. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  353. "port": 80
  354. },
  355. {
  356. "count": 1,
  357. "body": "",
  358. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  359. "user-agent": "Microsoft-CryptoAPI/6.1",
  360. "method": "GET",
  361. "host": "ocsp.comodoca.com",
  362. "version": "1.1",
  363. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  364. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  365. "port": 80
  366. },
  367. {
  368. "count": 1,
  369. "body": "",
  370. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  371. "user-agent": "Microsoft-CryptoAPI/6.1",
  372. "method": "GET",
  373. "host": "ocsp.pki.goog",
  374. "version": "1.1",
  375. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  376. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  377. "port": 80
  378. },
  379. {
  380. "count": 1,
  381. "body": "",
  382. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  383. "user-agent": "Microsoft-CryptoAPI/6.1",
  384. "method": "GET",
  385. "host": "ocsp.digicert.com",
  386. "version": "1.1",
  387. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  388. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  389. "port": 80
  390. },
  391. {
  392. "count": 1,
  393. "body": "",
  394. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  395. "user-agent": "Microsoft-CryptoAPI/6.1",
  396. "method": "GET",
  397. "host": "www.download.windowsupdate.com",
  398. "version": "1.1",
  399. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  400. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  401. "port": 80
  402. },
  403. {
  404. "count": 1,
  405. "body": "",
  406. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  407. "user-agent": "Microsoft-CryptoAPI/6.1",
  408. "method": "GET",
  409. "host": "crl.microsoft.com",
  410. "version": "1.1",
  411. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  412. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  413. "port": 80
  414. },
  415. {
  416. "count": 1,
  417. "body": "",
  418. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  419. "user-agent": "Microsoft-CryptoAPI/6.1",
  420. "method": "GET",
  421. "host": "ocsp.digicert.com",
  422. "version": "1.1",
  423. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  424. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  425. "port": 80
  426. },
  427. {
  428. "count": 1,
  429. "body": "",
  430. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  431. "user-agent": "Microsoft-CryptoAPI/6.1",
  432. "method": "GET",
  433. "host": "ocsp.digicert.com",
  434. "version": "1.1",
  435. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  436. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  437. "port": 80
  438. },
  439. {
  440. "count": 1,
  441. "body": "",
  442. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  443. "user-agent": "Microsoft-CryptoAPI/6.1",
  444. "method": "GET",
  445. "host": "ocsp.digicert.com",
  446. "version": "1.1",
  447. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  448. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  449. "port": 80
  450. },
  451. {
  452. "count": 1,
  453. "body": "",
  454. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  455. "user-agent": "Microsoft-CryptoAPI/6.1",
  456. "method": "GET",
  457. "host": "ocsp.pki.goog",
  458. "version": "1.1",
  459. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  460. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  461. "port": 80
  462. },
  463. {
  464. "count": 1,
  465. "body": "",
  466. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  467. "user-agent": "Microsoft-CryptoAPI/6.1",
  468. "method": "GET",
  469. "host": "ocsp.pki.goog",
  470. "version": "1.1",
  471. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  472. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  473. "port": 80
  474. },
  475. {
  476. "count": 1,
  477. "body": "",
  478. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  479. "user-agent": "Microsoft-CryptoAPI/6.1",
  480. "method": "GET",
  481. "host": "ocsp.digicert.com",
  482. "version": "1.1",
  483. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  484. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  485. "port": 80
  486. },
  487. {
  488. "count": 1,
  489. "body": "",
  490. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  491. "user-agent": "Microsoft-CryptoAPI/6.1",
  492. "method": "GET",
  493. "host": "ocsp.pki.goog",
  494. "version": "1.1",
  495. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  496. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  497. "port": 80
  498. },
  499. {
  500. "count": 1,
  501. "body": "",
  502. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  503. "user-agent": "Microsoft-CryptoAPI/6.1",
  504. "method": "GET",
  505. "host": "ocsp.msocsp.com",
  506. "version": "1.1",
  507. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  508. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  509. "port": 80
  510. },
  511. {
  512. "count": 1,
  513. "body": "",
  514. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  515. "user-agent": "Microsoft-CryptoAPI/6.1",
  516. "method": "GET",
  517. "host": "ocsp.thawte.com",
  518. "version": "1.1",
  519. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  520. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  521. "port": 80
  522. },
  523. {
  524. "count": 1,
  525. "body": "",
  526. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  527. "user-agent": "Microsoft-CryptoAPI/6.1",
  528. "method": "GET",
  529. "host": "ocsp.usertrust.com",
  530. "version": "1.1",
  531. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  532. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  533. "port": 80
  534. },
  535. {
  536. "count": 1,
  537. "body": "",
  538. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  539. "user-agent": "Microsoft-CryptoAPI/6.1",
  540. "method": "GET",
  541. "host": "th.symcd.com",
  542. "version": "1.1",
  543. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  544. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  545. "port": 80
  546. },
  547. {
  548. "count": 1,
  549. "body": "",
  550. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  551. "user-agent": "Microsoft-CryptoAPI/6.1",
  552. "method": "GET",
  553. "host": "ocsp.digicert.com",
  554. "version": "1.1",
  555. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  556. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  557. "port": 80
  558. },
  559. {
  560. "count": 1,
  561. "body": "",
  562. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  563. "user-agent": "Microsoft-CryptoAPI/6.1",
  564. "method": "GET",
  565. "host": "ocsp.digicert.com",
  566. "version": "1.1",
  567. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  568. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  569. "port": 80
  570. },
  571. {
  572. "count": 1,
  573. "body": "",
  574. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  575. "user-agent": "Microsoft-CryptoAPI/6.1",
  576. "method": "GET",
  577. "host": "ocsp.pki.goog",
  578. "version": "1.1",
  579. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  580. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  581. "port": 80
  582. },
  583. {
  584. "count": 1,
  585. "body": "",
  586. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  587. "user-agent": "Microsoft-CryptoAPI/6.1",
  588. "method": "GET",
  589. "host": "crl.microsoft.com",
  590. "version": "1.1",
  591. "path": "/pki/crl/products/microsoftrootcert.crl",
  592. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  593. "port": 80
  594. },
  595. {
  596. "count": 1,
  597. "body": "",
  598. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  599. "user-agent": "Microsoft BITS/7.5",
  600. "method": "HEAD",
  601. "host": "redirector.gvt1.com",
  602. "version": "1.1",
  603. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  604. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  605. "port": 80
  606. },
  607. {
  608. "count": 1,
  609. "body": "",
  610. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  611. "user-agent": "Microsoft BITS/7.5",
  612. "method": "HEAD",
  613. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  614. "version": "1.1",
  615. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  616. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  617. "port": 80
  618. },
  619. {
  620. "count": 1,
  621. "body": "",
  622. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  623. "user-agent": "Microsoft BITS/7.5",
  624. "method": "GET",
  625. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  626. "version": "1.1",
  627. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  628. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-7581\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  629. "port": 80
  630. },
  631. {
  632. "count": 1,
  633. "body": "",
  634. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  635. "user-agent": "Microsoft BITS/7.5",
  636. "method": "GET",
  637. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  638. "version": "1.1",
  639. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  640. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7582-17648\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  641. "port": 80
  642. },
  643. {
  644. "count": 1,
  645. "body": "",
  646. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  647. "user-agent": "Microsoft BITS/7.5",
  648. "method": "GET",
  649. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  650. "version": "1.1",
  651. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  652. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=17649-27308\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  653. "port": 80
  654. },
  655. {
  656. "count": 1,
  657. "body": "",
  658. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  659. "user-agent": "Microsoft BITS/7.5",
  660. "method": "GET",
  661. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  662. "version": "1.1",
  663. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  664. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=27309-36743\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  665. "port": 80
  666. },
  667. {
  668. "count": 1,
  669. "body": "",
  670. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  671. "user-agent": "Microsoft BITS/7.5",
  672. "method": "GET",
  673. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  674. "version": "1.1",
  675. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  676. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=36744-57292\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  677. "port": 80
  678. },
  679. {
  680. "count": 1,
  681. "body": "",
  682. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  683. "user-agent": "Microsoft BITS/7.5",
  684. "method": "GET",
  685. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  686. "version": "1.1",
  687. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  688. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=57293-98318\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  689. "port": 80
  690. },
  691. {
  692. "count": 1,
  693. "body": "",
  694. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  695. "user-agent": "Microsoft BITS/7.5",
  696. "method": "GET",
  697. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  698. "version": "1.1",
  699. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  700. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=98319-185068\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  701. "port": 80
  702. },
  703. {
  704. "count": 1,
  705. "body": "",
  706. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  707. "user-agent": "Microsoft BITS/7.5",
  708. "method": "GET",
  709. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  710. "version": "1.1",
  711. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  712. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=185069-364598\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  713. "port": 80
  714. },
  715. {
  716. "count": 1,
  717. "body": "",
  718. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  719. "user-agent": "Microsoft BITS/7.5",
  720. "method": "GET",
  721. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  722. "version": "1.1",
  723. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  724. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=364599-596878\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  725. "port": 80
  726. },
  727. {
  728. "count": 1,
  729. "body": "",
  730. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  731. "user-agent": "Microsoft BITS/7.5",
  732. "method": "GET",
  733. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  734. "version": "1.1",
  735. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  736. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=596879-1323997\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  737. "port": 80
  738. },
  739. {
  740. "count": 1,
  741. "body": "",
  742. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  743. "user-agent": "Microsoft BITS/7.5",
  744. "method": "GET",
  745. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  746. "version": "1.1",
  747. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  748. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1323998-2763432\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  749. "port": 80
  750. },
  751. {
  752. "count": 1,
  753. "body": "",
  754. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  755. "user-agent": "Microsoft BITS/7.5",
  756. "method": "GET",
  757. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  758. "version": "1.1",
  759. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  760. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2763433-5648504\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  761. "port": 80
  762. },
  763. {
  764. "count": 1,
  765. "body": "",
  766. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  767. "user-agent": "Microsoft BITS/7.5",
  768. "method": "GET",
  769. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  770. "version": "1.1",
  771. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  772. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5648505-11392391\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  773. "port": 80
  774. },
  775. {
  776. "count": 1,
  777. "body": "",
  778. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  779. "user-agent": "Microsoft BITS/7.5",
  780. "method": "GET",
  781. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  782. "version": "1.1",
  783. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes",
  784. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391526&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=11392392-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  785. "port": 80
  786. }
  787. ]
  788.  
  789. [*] Network Communication - SMTP: []
  790.  
  791. [*] Network Communication - Hosts: []
  792.  
  793. [*] Network Communication - IRC: []
  794.  
  795. [*] Static Analysis: {
  796. "pe": {
  797. "peid_signatures": null,
  798. "imports": [
  799. {
  800. "imports": [
  801. {
  802. "name": null,
  803. "address": "0x401000"
  804. },
  805. {
  806. "name": null,
  807. "address": "0x401004"
  808. },
  809. {
  810. "name": "_CIcos",
  811. "address": "0x401008"
  812. },
  813. {
  814. "name": "_adj_fptan",
  815. "address": "0x40100c"
  816. },
  817. {
  818. "name": "__vbaVarMove",
  819. "address": "0x401010"
  820. },
  821. {
  822. "name": null,
  823. "address": "0x401014"
  824. },
  825. {
  826. "name": null,
  827. "address": "0x401018"
  828. },
  829. {
  830. "name": "__vbaFreeVar",
  831. "address": "0x40101c"
  832. },
  833. {
  834. "name": "__vbaStrVarMove",
  835. "address": "0x401020"
  836. },
  837. {
  838. "name": null,
  839. "address": "0x401024"
  840. },
  841. {
  842. "name": null,
  843. "address": "0x401028"
  844. },
  845. {
  846. "name": null,
  847. "address": "0x40102c"
  848. },
  849. {
  850. "name": "__vbaFreeVarList",
  851. "address": "0x401030"
  852. },
  853. {
  854. "name": "_adj_fdiv_m64",
  855. "address": "0x401034"
  856. },
  857. {
  858. "name": "__vbaFpCDblR8",
  859. "address": "0x401038"
  860. },
  861. {
  862. "name": null,
  863. "address": "0x40103c"
  864. },
  865. {
  866. "name": "__vbaStrErrVarCopy",
  867. "address": "0x401040"
  868. },
  869. {
  870. "name": "_adj_fprem1",
  871. "address": "0x401044"
  872. },
  873. {
  874. "name": "__vbaStrCat",
  875. "address": "0x401048"
  876. },
  877. {
  878. "name": null,
  879. "address": "0x40104c"
  880. },
  881. {
  882. "name": null,
  883. "address": "0x401050"
  884. },
  885. {
  886. "name": "__vbaSetSystemError",
  887. "address": "0x401054"
  888. },
  889. {
  890. "name": "__vbaHresultCheckObj",
  891. "address": "0x401058"
  892. },
  893. {
  894. "name": "_adj_fdiv_m32",
  895. "address": "0x40105c"
  896. },
  897. {
  898. "name": null,
  899. "address": "0x401060"
  900. },
  901. {
  902. "name": "__vbaAryDestruct",
  903. "address": "0x401064"
  904. },
  905. {
  906. "name": null,
  907. "address": "0x401068"
  908. },
  909. {
  910. "name": "__vbaObjSet",
  911. "address": "0x40106c"
  912. },
  913. {
  914. "name": "__vbaOnError",
  915. "address": "0x401070"
  916. },
  917. {
  918. "name": "_adj_fdiv_m16i",
  919. "address": "0x401074"
  920. },
  921. {
  922. "name": "__vbaObjSetAddref",
  923. "address": "0x401078"
  924. },
  925. {
  926. "name": "_adj_fdivr_m16i",
  927. "address": "0x40107c"
  928. },
  929. {
  930. "name": null,
  931. "address": "0x401080"
  932. },
  933. {
  934. "name": null,
  935. "address": "0x401084"
  936. },
  937. {
  938. "name": "_CIsin",
  939. "address": "0x401088"
  940. },
  941. {
  942. "name": "__vbaChkstk",
  943. "address": "0x40108c"
  944. },
  945. {
  946. "name": null,
  947. "address": "0x401090"
  948. },
  949. {
  950. "name": "__vbaFileClose",
  951. "address": "0x401094"
  952. },
  953. {
  954. "name": "EVENT_SINK_AddRef",
  955. "address": "0x401098"
  956. },
  957. {
  958. "name": "__vbaGet3",
  959. "address": "0x40109c"
  960. },
  961. {
  962. "name": "__vbaVarTstEq",
  963. "address": "0x4010a0"
  964. },
  965. {
  966. "name": null,
  967. "address": "0x4010a4"
  968. },
  969. {
  970. "name": "DllFunctionCall",
  971. "address": "0x4010a8"
  972. },
  973. {
  974. "name": "_adj_fpatan",
  975. "address": "0x4010ac"
  976. },
  977. {
  978. "name": "__vbaLateIdCallLd",
  979. "address": "0x4010b0"
  980. },
  981. {
  982. "name": "__vbaRedim",
  983. "address": "0x4010b4"
  984. },
  985. {
  986. "name": "EVENT_SINK_Release",
  987. "address": "0x4010b8"
  988. },
  989. {
  990. "name": "__vbaUI1I2",
  991. "address": "0x4010bc"
  992. },
  993. {
  994. "name": "_CIsqrt",
  995. "address": "0x4010c0"
  996. },
  997. {
  998. "name": "EVENT_SINK_QueryInterface",
  999. "address": "0x4010c4"
  1000. },
  1001. {
  1002. "name": "__vbaExceptHandler",
  1003. "address": "0x4010c8"
  1004. },
  1005. {
  1006. "name": "__vbaStrToUnicode",
  1007. "address": "0x4010cc"
  1008. },
  1009. {
  1010. "name": "_adj_fprem",
  1011. "address": "0x4010d0"
  1012. },
  1013. {
  1014. "name": "_adj_fdivr_m64",
  1015. "address": "0x4010d4"
  1016. },
  1017. {
  1018. "name": null,
  1019. "address": "0x4010d8"
  1020. },
  1021. {
  1022. "name": null,
  1023. "address": "0x4010dc"
  1024. },
  1025. {
  1026. "name": "__vbaFPException",
  1027. "address": "0x4010e0"
  1028. },
  1029. {
  1030. "name": "__vbaInStrVar",
  1031. "address": "0x4010e4"
  1032. },
  1033. {
  1034. "name": "__vbaDateVar",
  1035. "address": "0x4010e8"
  1036. },
  1037. {
  1038. "name": "__vbaI2Var",
  1039. "address": "0x4010ec"
  1040. },
  1041. {
  1042. "name": "__vbaFileSeek",
  1043. "address": "0x4010f0"
  1044. },
  1045. {
  1046. "name": null,
  1047. "address": "0x4010f4"
  1048. },
  1049. {
  1050. "name": "_CIlog",
  1051. "address": "0x4010f8"
  1052. },
  1053. {
  1054. "name": null,
  1055. "address": "0x4010fc"
  1056. },
  1057. {
  1058. "name": "__vbaErrorOverflow",
  1059. "address": "0x401100"
  1060. },
  1061. {
  1062. "name": "__vbaFileOpen",
  1063. "address": "0x401104"
  1064. },
  1065. {
  1066. "name": "__vbaNew2",
  1067. "address": "0x401108"
  1068. },
  1069. {
  1070. "name": "__vbaInStr",
  1071. "address": "0x40110c"
  1072. },
  1073. {
  1074. "name": "_adj_fdiv_m32i",
  1075. "address": "0x401110"
  1076. },
  1077. {
  1078. "name": "_adj_fdivr_m32i",
  1079. "address": "0x401114"
  1080. },
  1081. {
  1082. "name": "__vbaStrCopy",
  1083. "address": "0x401118"
  1084. },
  1085. {
  1086. "name": "__vbaFreeStrList",
  1087. "address": "0x40111c"
  1088. },
  1089. {
  1090. "name": "__vbaDerefAry1",
  1091. "address": "0x401120"
  1092. },
  1093. {
  1094. "name": "_adj_fdivr_m32",
  1095. "address": "0x401124"
  1096. },
  1097. {
  1098. "name": "_adj_fdiv_r",
  1099. "address": "0x401128"
  1100. },
  1101. {
  1102. "name": null,
  1103. "address": "0x40112c"
  1104. },
  1105. {
  1106. "name": null,
  1107. "address": "0x401130"
  1108. },
  1109. {
  1110. "name": "__vbaI4Var",
  1111. "address": "0x401134"
  1112. },
  1113. {
  1114. "name": "__vbaFpCy",
  1115. "address": "0x401138"
  1116. },
  1117. {
  1118. "name": null,
  1119. "address": "0x40113c"
  1120. },
  1121. {
  1122. "name": "__vbaInStrB",
  1123. "address": "0x401140"
  1124. },
  1125. {
  1126. "name": "__vbaVarDup",
  1127. "address": "0x401144"
  1128. },
  1129. {
  1130. "name": "__vbaStrComp",
  1131. "address": "0x401148"
  1132. },
  1133. {
  1134. "name": "__vbaStrToAnsi",
  1135. "address": "0x40114c"
  1136. },
  1137. {
  1138. "name": "__vbaR4Sgn",
  1139. "address": "0x401150"
  1140. },
  1141. {
  1142. "name": null,
  1143. "address": "0x401154"
  1144. },
  1145. {
  1146. "name": "__vbaFpI4",
  1147. "address": "0x401158"
  1148. },
  1149. {
  1150. "name": null,
  1151. "address": "0x40115c"
  1152. },
  1153. {
  1154. "name": "_CIatan",
  1155. "address": "0x401160"
  1156. },
  1157. {
  1158. "name": "__vbaStrMove",
  1159. "address": "0x401164"
  1160. },
  1161. {
  1162. "name": "__vbaCastObj",
  1163. "address": "0x401168"
  1164. },
  1165. {
  1166. "name": null,
  1167. "address": "0x40116c"
  1168. },
  1169. {
  1170. "name": "__vbaR8IntI4",
  1171. "address": "0x401170"
  1172. },
  1173. {
  1174. "name": "_allmul",
  1175. "address": "0x401174"
  1176. },
  1177. {
  1178. "name": "_CItan",
  1179. "address": "0x401178"
  1180. },
  1181. {
  1182. "name": null,
  1183. "address": "0x40117c"
  1184. },
  1185. {
  1186. "name": "_CIexp",
  1187. "address": "0x401180"
  1188. },
  1189. {
  1190. "name": "__vbaFreeStr",
  1191. "address": "0x401184"
  1192. },
  1193. {
  1194. "name": "__vbaFreeObj",
  1195. "address": "0x401188"
  1196. },
  1197. {
  1198. "name": null,
  1199. "address": "0x40118c"
  1200. }
  1201. ],
  1202. "dll": "MSVBVM60.DLL"
  1203. }
  1204. ],
  1205. "digital_signers": null,
  1206. "exported_dll_name": null,
  1207. "actual_checksum": "0x0013b229",
  1208. "overlay": {
  1209. "size": "0x00001780",
  1210. "offset": "0x0012d000"
  1211. },
  1212. "imagebase": "0x00400000",
  1213. "reported_checksum": "0x0013b229",
  1214. "icon_hash": null,
  1215. "entrypoint": "0x00401fd8",
  1216. "timestamp": "2013-02-07 19:38:27",
  1217. "osversion": "4.0",
  1218. "sections": [
  1219. {
  1220. "name": ".text",
  1221. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1222. "virtual_address": "0x00001000",
  1223. "size_of_data": "0x00128000",
  1224. "entropy": "2.40",
  1225. "raw_address": "0x00001000",
  1226. "virtual_size": "0x00127498",
  1227. "characteristics_raw": "0x60000020"
  1228. },
  1229. {
  1230. "name": ".data",
  1231. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1232. "virtual_address": "0x00129000",
  1233. "size_of_data": "0x00001000",
  1234. "entropy": "0.00",
  1235. "raw_address": "0x00129000",
  1236. "virtual_size": "0x00000b44",
  1237. "characteristics_raw": "0xc0000040"
  1238. },
  1239. {
  1240. "name": ".rsrc",
  1241. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1242. "virtual_address": "0x0012a000",
  1243. "size_of_data": "0x00003000",
  1244. "entropy": "3.71",
  1245. "raw_address": "0x0012a000",
  1246. "virtual_size": "0x0000259c",
  1247. "characteristics_raw": "0x40000040"
  1248. }
  1249. ],
  1250. "resources": [],
  1251. "dirents": [
  1252. {
  1253. "virtual_address": "0x00000000",
  1254. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1255. "size": "0x00000000"
  1256. },
  1257. {
  1258. "virtual_address": "0x00127e44",
  1259. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1260. "size": "0x00000028"
  1261. },
  1262. {
  1263. "virtual_address": "0x0012a000",
  1264. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1265. "size": "0x0000259c"
  1266. },
  1267. {
  1268. "virtual_address": "0x00000000",
  1269. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1270. "size": "0x00000000"
  1271. },
  1272. {
  1273. "virtual_address": "0x0012d000",
  1274. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1275. "size": "0x00001780"
  1276. },
  1277. {
  1278. "virtual_address": "0x00000000",
  1279. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1280. "size": "0x00000000"
  1281. },
  1282. {
  1283. "virtual_address": "0x00000000",
  1284. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1285. "size": "0x00000000"
  1286. },
  1287. {
  1288. "virtual_address": "0x00000000",
  1289. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1290. "size": "0x00000000"
  1291. },
  1292. {
  1293. "virtual_address": "0x00000000",
  1294. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1295. "size": "0x00000000"
  1296. },
  1297. {
  1298. "virtual_address": "0x00000000",
  1299. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1300. "size": "0x00000000"
  1301. },
  1302. {
  1303. "virtual_address": "0x00000000",
  1304. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1305. "size": "0x00000000"
  1306. },
  1307. {
  1308. "virtual_address": "0x00000228",
  1309. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1310. "size": "0x00000020"
  1311. },
  1312. {
  1313. "virtual_address": "0x00001000",
  1314. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1315. "size": "0x00000194"
  1316. },
  1317. {
  1318. "virtual_address": "0x00000000",
  1319. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1320. "size": "0x00000000"
  1321. },
  1322. {
  1323. "virtual_address": "0x00000000",
  1324. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1325. "size": "0x00000000"
  1326. },
  1327. {
  1328. "virtual_address": "0x00000000",
  1329. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1330. "size": "0x00000000"
  1331. }
  1332. ],
  1333. "exports": [],
  1334. "guest_signers": {},
  1335. "imphash": "d9b314182ad9bd44de010beb276056f8",
  1336. "icon_fuzzy": null,
  1337. "icon": null,
  1338. "pdbpath": null,
  1339. "imported_dll_count": 1,
  1340. "versioninfo": []
  1341. }
  1342. }
  1343.  
  1344. [*] Resolved APIs: [
  1345. "cryptbase.dll.SystemFunction036",
  1346. "uxtheme.dll.ThemeInitApiHook",
  1347. "user32.dll.IsProcessDPIAware",
  1348. "oleaut32.dll.OleLoadPictureEx",
  1349. "oleaut32.dll.DispCallFunc",
  1350. "oleaut32.dll.LoadTypeLibEx",
  1351. "oleaut32.dll.UnRegisterTypeLib",
  1352. "oleaut32.dll.CreateTypeLib2",
  1353. "oleaut32.dll.VarDateFromUdate",
  1354. "oleaut32.dll.VarUdateFromDate",
  1355. "oleaut32.dll.GetAltMonthNames",
  1356. "oleaut32.dll.VarNumFromParseNum",
  1357. "oleaut32.dll.VarParseNumFromStr",
  1358. "oleaut32.dll.VarDecFromR4",
  1359. "oleaut32.dll.VarDecFromR8",
  1360. "oleaut32.dll.VarDecFromDate",
  1361. "oleaut32.dll.VarDecFromI4",
  1362. "oleaut32.dll.VarDecFromCy",
  1363. "oleaut32.dll.VarR4FromDec",
  1364. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  1365. "oleaut32.dll.GetRecordInfoFromGuids",
  1366. "oleaut32.dll.SafeArrayGetRecordInfo",
  1367. "oleaut32.dll.SafeArraySetRecordInfo",
  1368. "oleaut32.dll.SafeArrayGetIID",
  1369. "oleaut32.dll.SafeArraySetIID",
  1370. "oleaut32.dll.SafeArrayCopyData",
  1371. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  1372. "oleaut32.dll.SafeArrayCreateEx",
  1373. "oleaut32.dll.VarFormat",
  1374. "oleaut32.dll.VarFormatDateTime",
  1375. "oleaut32.dll.VarFormatNumber",
  1376. "oleaut32.dll.VarFormatPercent",
  1377. "oleaut32.dll.VarFormatCurrency",
  1378. "oleaut32.dll.VarWeekdayName",
  1379. "oleaut32.dll.VarMonthName",
  1380. "oleaut32.dll.VarAdd",
  1381. "oleaut32.dll.VarAnd",
  1382. "oleaut32.dll.VarCat",
  1383. "oleaut32.dll.VarDiv",
  1384. "oleaut32.dll.VarEqv",
  1385. "oleaut32.dll.VarIdiv",
  1386. "oleaut32.dll.VarImp",
  1387. "oleaut32.dll.VarMod",
  1388. "oleaut32.dll.VarMul",
  1389. "oleaut32.dll.VarOr",
  1390. "oleaut32.dll.VarPow",
  1391. "oleaut32.dll.VarSub",
  1392. "oleaut32.dll.VarXor",
  1393. "oleaut32.dll.VarAbs",
  1394. "oleaut32.dll.VarFix",
  1395. "oleaut32.dll.VarInt",
  1396. "oleaut32.dll.VarNeg",
  1397. "oleaut32.dll.VarNot",
  1398. "oleaut32.dll.VarRound",
  1399. "oleaut32.dll.VarCmp",
  1400. "oleaut32.dll.VarDecAdd",
  1401. "oleaut32.dll.VarDecCmp",
  1402. "oleaut32.dll.VarBstrCat",
  1403. "oleaut32.dll.VarCyMulI4",
  1404. "oleaut32.dll.VarBstrCmp",
  1405. "ole32.dll.CoCreateInstanceEx",
  1406. "ole32.dll.CLSIDFromProgIDEx",
  1407. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  1408. "user32.dll.GetSystemMetrics",
  1409. "user32.dll.MonitorFromWindow",
  1410. "user32.dll.MonitorFromRect",
  1411. "user32.dll.MonitorFromPoint",
  1412. "user32.dll.EnumDisplayMonitors",
  1413. "user32.dll.GetMonitorInfoA",
  1414. "cryptsp.dll.CryptAcquireContextW",
  1415. "cryptsp.dll.CryptGenRandom",
  1416. "dwmapi.dll.DwmIsCompositionEnabled",
  1417. "gdi32.dll.GetLayout",
  1418. "gdi32.dll.GdiRealizationInfo",
  1419. "gdi32.dll.FontIsLinked",
  1420. "advapi32.dll.RegOpenKeyExW",
  1421. "advapi32.dll.RegQueryInfoKeyW",
  1422. "gdi32.dll.GetTextFaceAliasW",
  1423. "advapi32.dll.RegEnumValueW",
  1424. "advapi32.dll.RegCloseKey",
  1425. "advapi32.dll.RegQueryValueExW",
  1426. "gdi32.dll.GetFontAssocStatus",
  1427. "advapi32.dll.RegQueryValueExA",
  1428. "advapi32.dll.RegEnumKeyExW",
  1429. "gdi32.dll.GdiIsMetaPrintDC",
  1430. "msvbvm60.dll.GetMem4",
  1431. "kernel32.dll.EnumUILanguagesA",
  1432. "kernel32.dll.GetTickCount",
  1433. "kernel32.dll.Sleep",
  1434. "user32.dll.GetCursorPos",
  1435. "user32.dll.EnumWindows",
  1436. "kernel32.dll.SetErrorMode",
  1437. "kernel32.dll.SetLastError",
  1438. "kernel32.dll.VirtualAllocEx",
  1439. "kernel32.dll.CloseHandle",
  1440. "shell32.dll.ShellExecuteW",
  1441. "kernel32.dll.WriteFile",
  1442. "kernel32.dll.UnmapViewOfFile",
  1443. "kernel32.dll.CreateFileW",
  1444. "kernel32.dll.TerminateProcess",
  1445. "kernel32.dll.VirtualProtectEx",
  1446. "kernel32.dll.CreateProcessInternalW",
  1447. "kernel32.dll.GetTempPathW",
  1448. "kernel32.dll.GetLongPathNameW",
  1449. "kernel32.dll.GetFileSize",
  1450. "kernel32.dll.ReadFile",
  1451. "ntdll.dll.NtProtectVirtualMemory",
  1452. "kernel32.dll.GetCommandLineW"
  1453. ]
  1454.  
  1455. [*] Static Analysis: {
  1456. "pe": {
  1457. "peid_signatures": null,
  1458. "imports": [
  1459. {
  1460. "imports": [
  1461. {
  1462. "name": null,
  1463. "address": "0x401000"
  1464. },
  1465. {
  1466. "name": null,
  1467. "address": "0x401004"
  1468. },
  1469. {
  1470. "name": "_CIcos",
  1471. "address": "0x401008"
  1472. },
  1473. {
  1474. "name": "_adj_fptan",
  1475. "address": "0x40100c"
  1476. },
  1477. {
  1478. "name": "__vbaVarMove",
  1479. "address": "0x401010"
  1480. },
  1481. {
  1482. "name": null,
  1483. "address": "0x401014"
  1484. },
  1485. {
  1486. "name": null,
  1487. "address": "0x401018"
  1488. },
  1489. {
  1490. "name": "__vbaFreeVar",
  1491. "address": "0x40101c"
  1492. },
  1493. {
  1494. "name": "__vbaStrVarMove",
  1495. "address": "0x401020"
  1496. },
  1497. {
  1498. "name": null,
  1499. "address": "0x401024"
  1500. },
  1501. {
  1502. "name": null,
  1503. "address": "0x401028"
  1504. },
  1505. {
  1506. "name": null,
  1507. "address": "0x40102c"
  1508. },
  1509. {
  1510. "name": "__vbaFreeVarList",
  1511. "address": "0x401030"
  1512. },
  1513. {
  1514. "name": "_adj_fdiv_m64",
  1515. "address": "0x401034"
  1516. },
  1517. {
  1518. "name": "__vbaFpCDblR8",
  1519. "address": "0x401038"
  1520. },
  1521. {
  1522. "name": null,
  1523. "address": "0x40103c"
  1524. },
  1525. {
  1526. "name": "__vbaStrErrVarCopy",
  1527. "address": "0x401040"
  1528. },
  1529. {
  1530. "name": "_adj_fprem1",
  1531. "address": "0x401044"
  1532. },
  1533. {
  1534. "name": "__vbaStrCat",
  1535. "address": "0x401048"
  1536. },
  1537. {
  1538. "name": null,
  1539. "address": "0x40104c"
  1540. },
  1541. {
  1542. "name": null,
  1543. "address": "0x401050"
  1544. },
  1545. {
  1546. "name": "__vbaSetSystemError",
  1547. "address": "0x401054"
  1548. },
  1549. {
  1550. "name": "__vbaHresultCheckObj",
  1551. "address": "0x401058"
  1552. },
  1553. {
  1554. "name": "_adj_fdiv_m32",
  1555. "address": "0x40105c"
  1556. },
  1557. {
  1558. "name": null,
  1559. "address": "0x401060"
  1560. },
  1561. {
  1562. "name": "__vbaAryDestruct",
  1563. "address": "0x401064"
  1564. },
  1565. {
  1566. "name": null,
  1567. "address": "0x401068"
  1568. },
  1569. {
  1570. "name": "__vbaObjSet",
  1571. "address": "0x40106c"
  1572. },
  1573. {
  1574. "name": "__vbaOnError",
  1575. "address": "0x401070"
  1576. },
  1577. {
  1578. "name": "_adj_fdiv_m16i",
  1579. "address": "0x401074"
  1580. },
  1581. {
  1582. "name": "__vbaObjSetAddref",
  1583. "address": "0x401078"
  1584. },
  1585. {
  1586. "name": "_adj_fdivr_m16i",
  1587. "address": "0x40107c"
  1588. },
  1589. {
  1590. "name": null,
  1591. "address": "0x401080"
  1592. },
  1593. {
  1594. "name": null,
  1595. "address": "0x401084"
  1596. },
  1597. {
  1598. "name": "_CIsin",
  1599. "address": "0x401088"
  1600. },
  1601. {
  1602. "name": "__vbaChkstk",
  1603. "address": "0x40108c"
  1604. },
  1605. {
  1606. "name": null,
  1607. "address": "0x401090"
  1608. },
  1609. {
  1610. "name": "__vbaFileClose",
  1611. "address": "0x401094"
  1612. },
  1613. {
  1614. "name": "EVENT_SINK_AddRef",
  1615. "address": "0x401098"
  1616. },
  1617. {
  1618. "name": "__vbaGet3",
  1619. "address": "0x40109c"
  1620. },
  1621. {
  1622. "name": "__vbaVarTstEq",
  1623. "address": "0x4010a0"
  1624. },
  1625. {
  1626. "name": null,
  1627. "address": "0x4010a4"
  1628. },
  1629. {
  1630. "name": "DllFunctionCall",
  1631. "address": "0x4010a8"
  1632. },
  1633. {
  1634. "name": "_adj_fpatan",
  1635. "address": "0x4010ac"
  1636. },
  1637. {
  1638. "name": "__vbaLateIdCallLd",
  1639. "address": "0x4010b0"
  1640. },
  1641. {
  1642. "name": "__vbaRedim",
  1643. "address": "0x4010b4"
  1644. },
  1645. {
  1646. "name": "EVENT_SINK_Release",
  1647. "address": "0x4010b8"
  1648. },
  1649. {
  1650. "name": "__vbaUI1I2",
  1651. "address": "0x4010bc"
  1652. },
  1653. {
  1654. "name": "_CIsqrt",
  1655. "address": "0x4010c0"
  1656. },
  1657. {
  1658. "name": "EVENT_SINK_QueryInterface",
  1659. "address": "0x4010c4"
  1660. },
  1661. {
  1662. "name": "__vbaExceptHandler",
  1663. "address": "0x4010c8"
  1664. },
  1665. {
  1666. "name": "__vbaStrToUnicode",
  1667. "address": "0x4010cc"
  1668. },
  1669. {
  1670. "name": "_adj_fprem",
  1671. "address": "0x4010d0"
  1672. },
  1673. {
  1674. "name": "_adj_fdivr_m64",
  1675. "address": "0x4010d4"
  1676. },
  1677. {
  1678. "name": null,
  1679. "address": "0x4010d8"
  1680. },
  1681. {
  1682. "name": null,
  1683. "address": "0x4010dc"
  1684. },
  1685. {
  1686. "name": "__vbaFPException",
  1687. "address": "0x4010e0"
  1688. },
  1689. {
  1690. "name": "__vbaInStrVar",
  1691. "address": "0x4010e4"
  1692. },
  1693. {
  1694. "name": "__vbaDateVar",
  1695. "address": "0x4010e8"
  1696. },
  1697. {
  1698. "name": "__vbaI2Var",
  1699. "address": "0x4010ec"
  1700. },
  1701. {
  1702. "name": "__vbaFileSeek",
  1703. "address": "0x4010f0"
  1704. },
  1705. {
  1706. "name": null,
  1707. "address": "0x4010f4"
  1708. },
  1709. {
  1710. "name": "_CIlog",
  1711. "address": "0x4010f8"
  1712. },
  1713. {
  1714. "name": null,
  1715. "address": "0x4010fc"
  1716. },
  1717. {
  1718. "name": "__vbaErrorOverflow",
  1719. "address": "0x401100"
  1720. },
  1721. {
  1722. "name": "__vbaFileOpen",
  1723. "address": "0x401104"
  1724. },
  1725. {
  1726. "name": "__vbaNew2",
  1727. "address": "0x401108"
  1728. },
  1729. {
  1730. "name": "__vbaInStr",
  1731. "address": "0x40110c"
  1732. },
  1733. {
  1734. "name": "_adj_fdiv_m32i",
  1735. "address": "0x401110"
  1736. },
  1737. {
  1738. "name": "_adj_fdivr_m32i",
  1739. "address": "0x401114"
  1740. },
  1741. {
  1742. "name": "__vbaStrCopy",
  1743. "address": "0x401118"
  1744. },
  1745. {
  1746. "name": "__vbaFreeStrList",
  1747. "address": "0x40111c"
  1748. },
  1749. {
  1750. "name": "__vbaDerefAry1",
  1751. "address": "0x401120"
  1752. },
  1753. {
  1754. "name": "_adj_fdivr_m32",
  1755. "address": "0x401124"
  1756. },
  1757. {
  1758. "name": "_adj_fdiv_r",
  1759. "address": "0x401128"
  1760. },
  1761. {
  1762. "name": null,
  1763. "address": "0x40112c"
  1764. },
  1765. {
  1766. "name": null,
  1767. "address": "0x401130"
  1768. },
  1769. {
  1770. "name": "__vbaI4Var",
  1771. "address": "0x401134"
  1772. },
  1773. {
  1774. "name": "__vbaFpCy",
  1775. "address": "0x401138"
  1776. },
  1777. {
  1778. "name": null,
  1779. "address": "0x40113c"
  1780. },
  1781. {
  1782. "name": "__vbaInStrB",
  1783. "address": "0x401140"
  1784. },
  1785. {
  1786. "name": "__vbaVarDup",
  1787. "address": "0x401144"
  1788. },
  1789. {
  1790. "name": "__vbaStrComp",
  1791. "address": "0x401148"
  1792. },
  1793. {
  1794. "name": "__vbaStrToAnsi",
  1795. "address": "0x40114c"
  1796. },
  1797. {
  1798. "name": "__vbaR4Sgn",
  1799. "address": "0x401150"
  1800. },
  1801. {
  1802. "name": null,
  1803. "address": "0x401154"
  1804. },
  1805. {
  1806. "name": "__vbaFpI4",
  1807. "address": "0x401158"
  1808. },
  1809. {
  1810. "name": null,
  1811. "address": "0x40115c"
  1812. },
  1813. {
  1814. "name": "_CIatan",
  1815. "address": "0x401160"
  1816. },
  1817. {
  1818. "name": "__vbaStrMove",
  1819. "address": "0x401164"
  1820. },
  1821. {
  1822. "name": "__vbaCastObj",
  1823. "address": "0x401168"
  1824. },
  1825. {
  1826. "name": null,
  1827. "address": "0x40116c"
  1828. },
  1829. {
  1830. "name": "__vbaR8IntI4",
  1831. "address": "0x401170"
  1832. },
  1833. {
  1834. "name": "_allmul",
  1835. "address": "0x401174"
  1836. },
  1837. {
  1838. "name": "_CItan",
  1839. "address": "0x401178"
  1840. },
  1841. {
  1842. "name": null,
  1843. "address": "0x40117c"
  1844. },
  1845. {
  1846. "name": "_CIexp",
  1847. "address": "0x401180"
  1848. },
  1849. {
  1850. "name": "__vbaFreeStr",
  1851. "address": "0x401184"
  1852. },
  1853. {
  1854. "name": "__vbaFreeObj",
  1855. "address": "0x401188"
  1856. },
  1857. {
  1858. "name": null,
  1859. "address": "0x40118c"
  1860. }
  1861. ],
  1862. "dll": "MSVBVM60.DLL"
  1863. }
  1864. ],
  1865. "digital_signers": null,
  1866. "exported_dll_name": null,
  1867. "actual_checksum": "0x0013b229",
  1868. "overlay": {
  1869. "size": "0x00001780",
  1870. "offset": "0x0012d000"
  1871. },
  1872. "imagebase": "0x00400000",
  1873. "reported_checksum": "0x0013b229",
  1874. "icon_hash": null,
  1875. "entrypoint": "0x00401fd8",
  1876. "timestamp": "2013-02-07 19:38:27",
  1877. "osversion": "4.0",
  1878. "sections": [
  1879. {
  1880. "name": ".text",
  1881. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1882. "virtual_address": "0x00001000",
  1883. "size_of_data": "0x00128000",
  1884. "entropy": "2.40",
  1885. "raw_address": "0x00001000",
  1886. "virtual_size": "0x00127498",
  1887. "characteristics_raw": "0x60000020"
  1888. },
  1889. {
  1890. "name": ".data",
  1891. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1892. "virtual_address": "0x00129000",
  1893. "size_of_data": "0x00001000",
  1894. "entropy": "0.00",
  1895. "raw_address": "0x00129000",
  1896. "virtual_size": "0x00000b44",
  1897. "characteristics_raw": "0xc0000040"
  1898. },
  1899. {
  1900. "name": ".rsrc",
  1901. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1902. "virtual_address": "0x0012a000",
  1903. "size_of_data": "0x00003000",
  1904. "entropy": "3.71",
  1905. "raw_address": "0x0012a000",
  1906. "virtual_size": "0x0000259c",
  1907. "characteristics_raw": "0x40000040"
  1908. }
  1909. ],
  1910. "resources": [],
  1911. "dirents": [
  1912. {
  1913. "virtual_address": "0x00000000",
  1914. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1915. "size": "0x00000000"
  1916. },
  1917. {
  1918. "virtual_address": "0x00127e44",
  1919. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1920. "size": "0x00000028"
  1921. },
  1922. {
  1923. "virtual_address": "0x0012a000",
  1924. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1925. "size": "0x0000259c"
  1926. },
  1927. {
  1928. "virtual_address": "0x00000000",
  1929. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1930. "size": "0x00000000"
  1931. },
  1932. {
  1933. "virtual_address": "0x0012d000",
  1934. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1935. "size": "0x00001780"
  1936. },
  1937. {
  1938. "virtual_address": "0x00000000",
  1939. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1940. "size": "0x00000000"
  1941. },
  1942. {
  1943. "virtual_address": "0x00000000",
  1944. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1945. "size": "0x00000000"
  1946. },
  1947. {
  1948. "virtual_address": "0x00000000",
  1949. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1950. "size": "0x00000000"
  1951. },
  1952. {
  1953. "virtual_address": "0x00000000",
  1954. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1955. "size": "0x00000000"
  1956. },
  1957. {
  1958. "virtual_address": "0x00000000",
  1959. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1960. "size": "0x00000000"
  1961. },
  1962. {
  1963. "virtual_address": "0x00000000",
  1964. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1965. "size": "0x00000000"
  1966. },
  1967. {
  1968. "virtual_address": "0x00000228",
  1969. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1970. "size": "0x00000020"
  1971. },
  1972. {
  1973. "virtual_address": "0x00001000",
  1974. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1975. "size": "0x00000194"
  1976. },
  1977. {
  1978. "virtual_address": "0x00000000",
  1979. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1980. "size": "0x00000000"
  1981. },
  1982. {
  1983. "virtual_address": "0x00000000",
  1984. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1985. "size": "0x00000000"
  1986. },
  1987. {
  1988. "virtual_address": "0x00000000",
  1989. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1990. "size": "0x00000000"
  1991. }
  1992. ],
  1993. "exports": [],
  1994. "guest_signers": {},
  1995. "imphash": "d9b314182ad9bd44de010beb276056f8",
  1996. "icon_fuzzy": null,
  1997. "icon": null,
  1998. "pdbpath": null,
  1999. "imported_dll_count": 1,
  2000. "versioninfo": []
  2001. }
  2002. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!