API tools faq
paste
paladin316

Exes_32674fa9511a3ed8146684cd934c81b5_exe_2019-07-25_21_30.txt

paladin316
Jul 26th, 2019
2,085
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 35.26 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_32674fa9511a3ed8146684cd934c81b5.exe"
  7. * File Size: 947200
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "910227d8a5c51b350a08bbc8df35534ef0b9185cadb40e72d9ec406fa9d91fc9"
  10. * MD5: "32674fa9511a3ed8146684cd934c81b5"
  11. * SHA1: "dc4189841e62222c951e5f1b874a1c0a2fa4784a"
  12. * SHA512: "7cda61b79a730a28700bcfbbab9015314404fa698e4433f7886ba4850159a8f404f0d88b76d0bf0aa1ffc68d1045ab20cfad18934e8fb314affb3a166125c263"
  13. * CRC32: "FDD8459A"
  14. * SSDEEP: "24576:3BWovvXqQlFwocghFjtR2oz54ocHRfMML2p:vRlDGRfMMap"
  15.  
  16. * Process Execution:
  17. "Exes_32674fa9511a3ed8146684cd934c81b5.exe",
  18. "jeffydvl.exe",
  19. "jeffydvl.exe",
  20. "cmd.exe",
  21. "timeout.exe",
  22. "services.exe",
  23. "lsass.exe",
  24. "taskhost.exe",
  25. "sc.exe",
  26. "svchost.exe",
  27. "WerFault.exe",
  28. "wermgr.exe",
  29. "svchost.exe"
  30.  
  31.  
  32. * Executed Commands:
  33. "\"C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe\"",
  34. "C:\\Windows\\System32\\cmd.exe /c C:\\Windows\\system32\\timeout.exe 3 & del \"jeffydvl.exe\"",
  35. "C:\\Windows\\system32\\lsass.exe",
  36. "taskhost.exe $(Arg0)",
  37. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  38. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  39. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  40. "C:\\Windows\\system32\\timeout.exe 3",
  41. "C:\\Windows\\system32\\WerFault.exe -u -p 1144 -s 288",
  42. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\""
  43.  
  44.  
  45. * Signatures Detected:
  46.  
  47. "Description": "At least one process apparently crashed during execution",
  48. "Details":
  49.  
  50.  
  51. "Description": "Attempts to connect to a dead IP:Port (4 unique times)",
  52. "Details":
  53.  
  54. "IP": "184.28.188.194:80"
  55.  
  56.  
  57. "IP": "205.185.216.42:80"
  58.  
  59.  
  60. "IP": "192.35.177.64:80"
  61.  
  62.  
  63. "IP": "184.28.188.193:80"
  64.  
  65.  
  66.  
  67.  
  68. "Description": "Creates RWX memory",
  69. "Details":
  70.  
  71.  
  72. "Description": "A process created a hidden window",
  73. "Details":
  74.  
  75. "Process": "jeffydvl.exe -> C:\\Windows\\System32\\cmd.exe"
  76.  
  77.  
  78.  
  79.  
  80. "Description": "Drops a binary and executes it",
  81. "Details":
  82.  
  83. "binary": "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe"
  84.  
  85.  
  86.  
  87.  
  88. "Description": "Performs some HTTP requests",
  89. "Details":
  90.  
  91. "url": "http://apps.identrust.com/roots/dstrootcax3.p7c"
  92.  
  93.  
  94. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  95.  
  96.  
  97. "url": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D"
  98.  
  99.  
  100. "url": "http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMaFqV0QYr8eBrEwE6o2AgpHg%3D%3D"
  101.  
  102.  
  103.  
  104.  
  105. "Description": "Executed a process and injected code into it, probably while unpacking",
  106. "Details":
  107.  
  108. "Injection": "jeffydvl.exe(2988) -> jeffydvl.exe(2484)"
  109.  
  110.  
  111.  
  112.  
  113. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  114. "Details":
  115.  
  116. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 8951555 times"
  117.  
  118.  
  119.  
  120.  
  121. "Description": "Steals private information from local Internet browsers",
  122. "Details":
  123.  
  124. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  125.  
  126.  
  127. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  128.  
  129.  
  130. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  131.  
  132.  
  133. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  134.  
  135.  
  136. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  137.  
  138.  
  139. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  140.  
  141.  
  142. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  143.  
  144.  
  145. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  146.  
  147.  
  148. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  149.  
  150.  
  151. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  152.  
  153.  
  154. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  155.  
  156.  
  157. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  158.  
  159.  
  160. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  161.  
  162.  
  163. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  164.  
  165.  
  166. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  167.  
  168.  
  169. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
  170.  
  171.  
  172. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  173.  
  174.  
  175. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  176.  
  177.  
  178. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  179.  
  180.  
  181. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  182.  
  183.  
  184.  
  185.  
  186. "Description": "Collects information about installed applications",
  187. "Details":
  188.  
  189. "Program": "Google Update Helper"
  190.  
  191.  
  192.  
  193.  
  194. "Program": "Microsoft Excel MUI 2013"
  195.  
  196.  
  197. "Program": "Microsoft Outlook MUI 2013"
  198.  
  199.  
  200.  
  201.  
  202. "Program": "Google Chrome"
  203.  
  204.  
  205. "Program": "Adobe Flash Player 29 NPAPI"
  206.  
  207.  
  208. "Program": "Adobe Flash Player 29 ActiveX"
  209.  
  210.  
  211. "Program": "Microsoft DCF MUI 2013"
  212.  
  213.  
  214. "Program": "Microsoft Access MUI 2013"
  215.  
  216.  
  217. "Program": "Microsoft Office Proofing Tools 2013 - English"
  218.  
  219.  
  220. "Program": "Adobe Acrobat Reader DC"
  221.  
  222.  
  223. "Program": "Microsoft Publisher MUI 2013"
  224.  
  225.  
  226. "Program": "Microsoft Office Shared MUI 2013"
  227.  
  228.  
  229. "Program": "Microsoft Office OSM MUI 2013"
  230.  
  231.  
  232. "Program": "Microsoft InfoPath MUI 2013"
  233.  
  234.  
  235. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  236.  
  237.  
  238. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  239.  
  240.  
  241. "Program": "Microsoft Word MUI 2013"
  242.  
  243.  
  244. "Program": "Microsoft OneDrive"
  245.  
  246.  
  247. "Program": "Microsoft Groove MUI 2013"
  248.  
  249.  
  250. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  251.  
  252.  
  253.  
  254.  
  255. "Program": "Microsoft Access Setup Metadata MUI 2013"
  256.  
  257.  
  258. "Program": "Microsoft Office OSM UX MUI 2013"
  259.  
  260.  
  261. "Program": "Java Auto Updater"
  262.  
  263.  
  264. "Program": "Microsoft PowerPoint MUI 2013"
  265.  
  266.  
  267. "Program": "Microsoft Office Professional Plus 2013"
  268.  
  269.  
  270. "Program": "Adobe Refresh Manager"
  271.  
  272.  
  273. "Program": "Microsoft Office Proofing 2013"
  274.  
  275.  
  276. "Program": "Microsoft Lync MUI 2013"
  277.  
  278.  
  279.  
  280.  
  281. "Program": "Microsoft OneNote MUI 2013"
  282.  
  283.  
  284.  
  285.  
  286. "Description": "File has been identified by 25 Antiviruses on VirusTotal as malicious",
  287. "Details":
  288.  
  289. "Cylance": "Unsafe"
  290.  
  291.  
  292. "K7GW": "Riskware ( 0040eff71 )"
  293.  
  294.  
  295. "K7AntiVirus": "Riskware ( 0040eff71 )"
  296.  
  297.  
  298. "F-Prot": "W32/Trojan3.AOGV"
  299.  
  300.  
  301. "Symantec": "Packed.Generic.516"
  302.  
  303.  
  304. "ESET-NOD32": "a variant of Win32/GenKryptik.DOKP"
  305.  
  306.  
  307. "APEX": "Malicious"
  308.  
  309.  
  310. "Avast": "Win32:Malware-gen"
  311.  
  312.  
  313. "Rising": "Trojan.Injector!1.AFE3 (CLASSIC)"
  314.  
  315.  
  316. "Endgame": "malicious (high confidence)"
  317.  
  318.  
  319. "DrWeb": "Trojan.PWS.Stealer.19347"
  320.  
  321.  
  322. "Invincea": "heuristic"
  323.  
  324.  
  325. "McAfee-GW-Edition": "BehavesLike.Win32.Fareit.dh"
  326.  
  327.  
  328. "Trapmine": "malicious.high.ml.score"
  329.  
  330.  
  331. "FireEye": "Generic.mg.32674fa9511a3ed8"
  332.  
  333.  
  334. "SentinelOne": "DFI - Suspicious PE"
  335.  
  336.  
  337. "Cyren": "W32/Trojan.IIQR-7414"
  338.  
  339.  
  340. "Webroot": "W32.Trojan.Gen"
  341.  
  342.  
  343. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  344.  
  345.  
  346. "AhnLab-V3": "Win-Trojan/Delphiless.Exp"
  347.  
  348.  
  349. "Acronis": "suspicious"
  350.  
  351.  
  352. "Fortinet": "W32/Injector.EGKJ!tr"
  353.  
  354.  
  355. "MaxSecure": "Trojan.Malware.300983.susgen"
  356.  
  357.  
  358. "AVG": "Win32:Malware-gen"
  359.  
  360.  
  361. "Cybereason": "malicious.41e622"
  362.  
  363.  
  364.  
  365.  
  366. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  367. "Details":
  368.  
  369.  
  370. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  371. "Details":
  372.  
  373.  
  374. "Description": "Creates a copy of itself",
  375. "Details":
  376.  
  377. "copy": "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe"
  378.  
  379.  
  380.  
  381.  
  382. "Description": "Attempts to access Bitcoin/ALTCoin wallets",
  383. "Details":
  384.  
  385. "file": "C:\\Users\\user\\AppData\\Roaming\\Adobe\\wallet.dat"
  386.  
  387.  
  388. "file": "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\wallet.dat"
  389.  
  390.  
  391. "file": "C:\\Users\\user\\AppData\\Roaming\\Sun\\wallet.dat"
  392.  
  393.  
  394. "file": "C:\\Users\\user\\AppData\\Roaming\\Identities\\wallet.dat"
  395.  
  396.  
  397. "file": "C:\\Users\\user\\AppData\\Roaming\\Macromedia\\wallet.dat"
  398.  
  399.  
  400. "file": "C:\\Users\\user\\AppData\\wallet.dat"
  401.  
  402.  
  403. "file": "C:\\Users\\user\\AppData\\Roaming\\wallet.dat"
  404.  
  405.  
  406. "file": "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\wallet.dat"
  407.  
  408.  
  409. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\wallet.dat"
  410.  
  411.  
  412. "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\*"
  413.  
  414.  
  415.  
  416.  
  417. "Description": "Harvests credentials from local FTP client softwares",
  418. "Details":
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Roaming\\filezilla\\recentservers.xml"
  421.  
  422.  
  423.  
  424.  
  425. "Description": "Harvests information related to installed instant messenger clients",
  426. "Details":
  427.  
  428. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  429.  
  430.  
  431.  
  432.  
  433. "Description": "Harvests information related to installed mail clients",
  434. "Details":
  435.  
  436. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  437.  
  438.  
  439. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  440.  
  441.  
  442. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  443.  
  444.  
  445. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  446.  
  447.  
  448. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  449.  
  450.  
  451. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  452.  
  453.  
  454. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  455.  
  456.  
  457. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  458.  
  459.  
  460. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  461.  
  462.  
  463. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  464.  
  465.  
  466. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  467.  
  468.  
  469. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  470.  
  471.  
  472. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  473.  
  474.  
  475. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  476.  
  477.  
  478. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  479.  
  480.  
  481. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  482.  
  483.  
  484. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  485.  
  486.  
  487. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  488.  
  489.  
  490. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  491.  
  492.  
  493. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  494.  
  495.  
  496. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  497.  
  498.  
  499.  
  500.  
  501. "Description": "Attempts to interact with an Alternate Data Stream (ADS)",
  502. "Details":
  503.  
  504. "file": "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe:ZoneIdentifier"
  505.  
  506.  
  507.  
  508.  
  509. "Description": "Collects information to fingerprint the system",
  510. "Details":
  511.  
  512.  
  513. "Description": "Anomalous binary characteristics",
  514. "Details":
  515.  
  516. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  517.  
  518.  
  519.  
  520.  
  521.  
  522. * Started Service:
  523. "VaultSvc",
  524. "WerSvc",
  525. "W32Time"
  526.  
  527.  
  528. * Mutexes:
  529. "A81FB8C6-0BBE6E18-6FC9B5DB-536DA455-933946726",
  530. "Local\\WERReportingForProcess1144",
  531. "Global\\\\xe5\\x88\\x90\\x7f",
  532. "Global\\\\xed\\x95\\xb0\\xc7\\x93",
  533. "WERUI_BEX64-eb71ef964c95de5826f5dbf6417783430b96dd1"
  534.  
  535.  
  536. * Modified Files:
  537. "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe",
  538. "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe:ZoneIdentifier",
  539. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\E0F5C59F9FA661F6F4C50B87FEF3A15A",
  540. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\E0F5C59F9FA661F6F4C50B87FEF3A15A",
  541. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  542. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
  543. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08",
  544. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08",
  545. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\D2A318D6D3EF18EBD051B9748D599B9F",
  546. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\D2A318D6D3EF18EBD051B9748D599B9F",
  547. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-console-l1-1-0.dll",
  548. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-datetime-l1-1-0.dll",
  549. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-debug-l1-1-0.dll",
  550. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-errorhandling-l1-1-0.dll",
  551. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-1-0.dll",
  552. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-2-0.dll",
  553. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l2-1-0.dll",
  554. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-handle-l1-1-0.dll",
  555. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-heap-l1-1-0.dll",
  556. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-interlocked-l1-1-0.dll",
  557. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-libraryloader-l1-1-0.dll",
  558. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-localization-l1-2-0.dll",
  559. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-memory-l1-1-0.dll",
  560. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-namedpipe-l1-1-0.dll",
  561. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processenvironment-l1-1-0.dll",
  562. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-0.dll",
  563. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-1.dll",
  564. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-profile-l1-1-0.dll",
  565. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  566. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-string-l1-1-0.dll",
  567. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-1-0.dll",
  568. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-2-0.dll",
  569. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-sysinfo-l1-1-0.dll",
  570. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-timezone-l1-1-0.dll",
  571. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-util-l1-1-0.dll",
  572. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-conio-l1-1-0.dll",
  573. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-convert-l1-1-0.dll",
  574. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-environment-l1-1-0.dll",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-filesystem-l1-1-0.dll",
  576. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-heap-l1-1-0.dll",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-locale-l1-1-0.dll",
  578. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-math-l1-1-0.dll",
  579. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-multibyte-l1-1-0.dll",
  580. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-private-l1-1-0.dll",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-process-l1-1-0.dll",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-runtime-l1-1-0.dll",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-stdio-l1-1-0.dll",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-string-l1-1-0.dll",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-time-l1-1-0.dll",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-utility-l1-1-0.dll",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\freebl3.dll",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\mozglue.dll",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\msvcp140.dll",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nss3.dll",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nssdbm3.dll",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\softokn3.dll",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\ucrtbase.dll",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\vcruntime140.dll",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\315277811793309777637278.tmp",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\315790468408562062009021.tmp",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\3157915640178165946755.tmp",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\315792039521180383969892.tmp",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\315792819420385745412813.tmp",
  600. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  601. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  602. "C:\\Windows\\sysnative\\LogFiles\\Scm\\1b711859-b045-4c59-9c08-78ceb138fe31",
  603. "\\??\\PIPE\\lsarpc",
  604. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB1E2.tmp.appcompat.txt",
  605. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC9B1.tmp.WERInternalMetadata.xml",
  606. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC9D1.tmp.hdmp",
  607. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERE0C5.tmp.mdmp",
  608. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\WERB1E2.tmp.appcompat.txt",
  609. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\WERC9B1.tmp.WERInternalMetadata.xml",
  610. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\WERC9D1.tmp.hdmp",
  611. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\WERE0C5.tmp.mdmp",
  612. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\Report.wer",
  613. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\Report.wer.tmp"
  614.  
  615.  
  616. * Deleted Files:
  617. "C:\\Users\\user\\AppData\\Roaming\\jeffysb\\jeffydvl.exe",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\315277811793309777637278.tmp",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\315790468408562062009021.tmp",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\3157915640178165946755.tmp",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\315792039521180383969892.tmp",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\315792819420385745412813.tmp",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-console-l1-1-0.dll",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-datetime-l1-1-0.dll",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-debug-l1-1-0.dll",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-errorhandling-l1-1-0.dll",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-1-0.dll",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-2-0.dll",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l2-1-0.dll",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-handle-l1-1-0.dll",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-heap-l1-1-0.dll",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-interlocked-l1-1-0.dll",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-libraryloader-l1-1-0.dll",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-localization-l1-2-0.dll",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-memory-l1-1-0.dll",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-namedpipe-l1-1-0.dll",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processenvironment-l1-1-0.dll",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-0.dll",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-1.dll",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-profile-l1-1-0.dll",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-string-l1-1-0.dll",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-1-0.dll",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-2-0.dll",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-sysinfo-l1-1-0.dll",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-timezone-l1-1-0.dll",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-util-l1-1-0.dll",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-conio-l1-1-0.dll",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-convert-l1-1-0.dll",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-environment-l1-1-0.dll",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-filesystem-l1-1-0.dll",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-heap-l1-1-0.dll",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-locale-l1-1-0.dll",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-math-l1-1-0.dll",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-multibyte-l1-1-0.dll",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-private-l1-1-0.dll",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-process-l1-1-0.dll",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-runtime-l1-1-0.dll",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-stdio-l1-1-0.dll",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-string-l1-1-0.dll",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-time-l1-1-0.dll",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-utility-l1-1-0.dll",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\freebl3.dll",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\mozglue.dll",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\msvcp140.dll",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nss3.dll",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nssdbm3.dll",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\softokn3.dll",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\ucrtbase.dll",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\vcruntime140.dll",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\",
  672. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB1E2.tmp",
  673. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB1E2.tmp.appcompat.txt",
  674. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC9B1.tmp",
  675. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC9B1.tmp.WERInternalMetadata.xml",
  676. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC9D1.tmp",
  677. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERC9D1.tmp.hdmp",
  678. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERE0C5.tmp",
  679. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERE0C5.tmp.mdmp",
  680. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0481860c\\Report.wer.tmp"
  681.  
  682.  
  683. * Modified Registry Keys:
  684. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  685. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  686. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
  687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent"
  689.  
  690.  
  691. * Deleted Registry Keys:
  692.  
  693. * DNS Communications:
  694.  
  695. "type": "A",
  696. "request": "a.icf-fx.kz",
  697. "answers":
  698.  
  699. "data": "194.5.179.42",
  700. "type": "A"
  701.  
  702.  
  703.  
  704.  
  705. "type": "A",
  706. "request": "apps.identrust.com",
  707. "answers":
  708.  
  709. "data": "192.35.177.64",
  710. "type": "A"
  711.  
  712.  
  713. "data": "apps.digsigtrust.com",
  714. "type": "CNAME"
  715.  
  716.  
  717.  
  718.  
  719. "type": "A",
  720. "request": "isrg.trustid.ocsp.identrust.com",
  721. "answers":
  722.  
  723. "data": "184.28.188.193",
  724. "type": "A"
  725.  
  726.  
  727. "data": "184.28.188.187",
  728. "type": "A"
  729.  
  730.  
  731. "data": "isrg.trustid.ocsp.identrust.com.edgesuite.net",
  732. "type": "CNAME"
  733.  
  734.  
  735. "data": "a279.dscq.akamai.net",
  736. "type": "CNAME"
  737.  
  738.  
  739.  
  740.  
  741. "type": "A",
  742. "request": "ocsp.int-x3.letsencrypt.org",
  743. "answers":
  744.  
  745. "data": "184.28.188.194",
  746. "type": "A"
  747.  
  748.  
  749. "data": "a771.dscq.akamai.net",
  750. "type": "CNAME"
  751.  
  752.  
  753. "data": "ocsp.int-x3.letsencrypt.org.edgesuite.net",
  754. "type": "CNAME"
  755.  
  756.  
  757. "data": "184.28.188.187",
  758. "type": "A"
  759.  
  760.  
  761.  
  762.  
  763.  
  764. * Domains:
  765.  
  766. "ip": "194.5.179.42",
  767. "domain": "a.icf-fx.kz"
  768.  
  769.  
  770. "ip": "192.35.177.64",
  771. "domain": "apps.identrust.com"
  772.  
  773.  
  774. "ip": "184.28.188.187",
  775. "domain": "isrg.trustid.ocsp.identrust.com"
  776.  
  777.  
  778. "ip": "184.28.188.194",
  779. "domain": "ocsp.int-x3.letsencrypt.org"
  780.  
  781.  
  782.  
  783. * Network Communication - ICMP:
  784.  
  785. * Network Communication - HTTP:
  786.  
  787. "count": 1,
  788. "body": "",
  789. "uri": "http://apps.identrust.com/roots/dstrootcax3.p7c",
  790. "user-agent": "Microsoft-CryptoAPI/6.1",
  791. "method": "GET",
  792. "host": "apps.identrust.com",
  793. "version": "1.1",
  794. "path": "/roots/dstrootcax3.p7c",
  795. "data": "GET /roots/dstrootcax3.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: apps.identrust.com\r\n\r\n",
  796. "port": 80
  797.  
  798.  
  799. "count": 1,
  800. "body": "",
  801. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  802. "user-agent": "Microsoft-CryptoAPI/6.1",
  803. "method": "GET",
  804. "host": "www.download.windowsupdate.com",
  805. "version": "1.1",
  806. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  807. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  808. "port": 80
  809.  
  810.  
  811. "count": 1,
  812. "body": "",
  813. "uri": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
  814. "user-agent": "Microsoft-CryptoAPI/6.1",
  815. "method": "GET",
  816. "host": "isrg.trustid.ocsp.identrust.com",
  817. "version": "1.1",
  818. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
  819. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: isrg.trustid.ocsp.identrust.com\r\n\r\n",
  820. "port": 80
  821.  
  822.  
  823. "count": 1,
  824. "body": "",
  825. "uri": "http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMaFqV0QYr8eBrEwE6o2AgpHg%3D%3D",
  826. "user-agent": "Microsoft-CryptoAPI/6.1",
  827. "method": "GET",
  828. "host": "ocsp.int-x3.letsencrypt.org",
  829. "version": "1.1",
  830. "path": "/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMaFqV0QYr8eBrEwE6o2AgpHg%3D%3D",
  831. "data": "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMaFqV0QYr8eBrEwE6o2AgpHg%3D%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.int-x3.letsencrypt.org\r\n\r\n",
  832. "port": 80
  833.  
  834.  
  835.  
  836. * Network Communication - SMTP:
  837.  
  838. * Network Communication - Hosts:
  839.  
  840. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!