API tools faq
paste
paladin316

fastaide_1151_exe.json

paladin316
Jun 19th, 2019
2,220
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 84.38 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 9.6
  5.  
  6. [*] File Name: "fastaide_1151.exe"
  7. [*] File Size: 2250240
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "b01094cffb3371d8a6ed0b4ac18782178363c11126e8485440b75183b17d03af"
  10. [*] MD5: "5d8e0e63295ea0bfbe038da68e12c3f2"
  11. [*] SHA1: "7bbf2c5653099e03cb493e895ee3dd9107080a1e"
  12. [*] SHA512: "dc6708263db56df766591421618768b69f905f2a7a78d305e26daa05dec3ada238adca5fd291c040b2267e81da59b4ecfbcfa6be767bee9fda35442779ea718a"
  13. [*] CRC32: "773B08DF"
  14. [*] SSDEEP: "49152:BUE+hMJMzoFibg/XIM0YCXMrRYujHkG9FkpePVHLWJcfRtMOC:rYMWoFyg/4M0YoMrRHjHkikpePViORty"
  15.  
  16. [*] Process Execution: [
  17. "fastaide_1151.exe",
  18. "cmd.exe",
  19. "atpbtqwlcs.exe",
  20. "atpbtqwlcs.tmp"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Creates RWX memory",
  26. "Details": []
  27. },
  28. {
  29. "Description": "Expresses interest in specific running processes",
  30. "Details": [
  31. {
  32. "process": "fastaide_1151.exe"
  33. }
  34. ]
  35. },
  36. {
  37. "Description": "Reads data out of its own binary image",
  38. "Details": [
  39. {
  40. "self_read": "process: atpbtqwlcs.exe, pid: 1180, offset: 0x000c32f3, length: 0x0000187e"
  41. },
  42. {
  43. "self_read": "process: atpbtqwlcs.exe, pid: 1180, offset: 0x000c4c4b, length: 0x000493ec"
  44. },
  45. {
  46. "self_read": "process: atpbtqwlcs.tmp, pid: 2736, offset: 0x00000000, length: 0x000e1200"
  47. }
  48. ]
  49. },
  50. {
  51. "Description": "A process created a hidden window",
  52. "Details": [
  53. {
  54. "Process": "fastaide_1151.exe -> cmd.exe"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "Drops a binary and executes it",
  60. "Details": [
  61. {
  62. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\is-2PN4T.tmp\\atpbtqwlcs.tmp"
  63. },
  64. {
  65. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\atpbtqwlcs.exe"
  66. }
  67. ]
  68. },
  69. {
  70. "Description": "Performs some HTTP requests",
  71. "Details": [
  72. {
  73. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  74. },
  75. {
  76. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  77. },
  78. {
  79. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  80. },
  81. {
  82. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  83. },
  84. {
  85. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  86. },
  87. {
  88. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  89. },
  90. {
  91. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  92. },
  93. {
  94. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  95. },
  96. {
  97. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  98. },
  99. {
  100. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  101. },
  102. {
  103. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  104. },
  105. {
  106. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  107. },
  108. {
  109. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  110. },
  111. {
  112. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  113. },
  114. {
  115. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  116. },
  117. {
  118. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  119. },
  120. {
  121. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  122. },
  123. {
  124. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  125. },
  126. {
  127. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  128. },
  129. {
  130. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  131. },
  132. {
  133. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  134. },
  135. {
  136. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  137. },
  138. {
  139. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  140. },
  141. {
  142. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe"
  143. },
  144. {
  145. "url": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes"
  146. }
  147. ]
  148. },
  149. {
  150. "Description": "The binary likely contains encrypted or compressed data.",
  151. "Details": [
  152. {
  153. "section": "name: UPX1, entropy: 7.85, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0021f600, virtual_size: 0x00220000"
  154. }
  155. ]
  156. },
  157. {
  158. "Description": "The executable is compressed using UPX",
  159. "Details": [
  160. {
  161. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x000dc000"
  162. }
  163. ]
  164. },
  165. {
  166. "Description": "Detects VirtualBox through the presence of a registry key",
  167. "Details": []
  168. },
  169. {
  170. "Description": "Detects VMware through the presence of a registry key",
  171. "Details": []
  172. }
  173. ]
  174.  
  175. [*] Started Service: []
  176.  
  177. [*] Executed Commands: [
  178. "cmd.exe /c start \"\" \"C:\\Users\\user\\AppData\\Local\\Temp\\atpbtqwlcs.exe\" /VERYSILENT",
  179. "\"C:\\Users\\user\\AppData\\Local\\Temp\\atpbtqwlcs.exe\" /VERYSILENT",
  180. "\"C:\\Users\\user\\AppData\\Local\\Temp\\is-2PN4T.tmp\\atpbtqwlcs.tmp\" /SL5=\"$150166,799475,54272,C:\\Users\\user\\AppData\\Local\\Temp\\atpbtqwlcs.exe\" /VERYSILENT"
  181. ]
  182.  
  183. [*] Mutexes: [
  184. "CicLoadWinStaWinSta0",
  185. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  186. "Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511",
  187. "Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000",
  188. "DefaultTabtip-MainUI"
  189. ]
  190.  
  191. [*] Modified Files: [
  192. "C:\\Users\\user\\AppData\\Local\\Temp\\atpbtqwlcs.exe",
  193. "\\Device\\Netbios",
  194. "C:\\Users\\user\\AppData\\Local\\Temp\\is-2PN4T.tmp\\atpbtqwlcs.tmp",
  195. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup\\_RegDLL.tmp",
  196. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup\\_setup64.tmp",
  197. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup\\_shfoldr.dll",
  198. "C:\\Program Files (x86)\\Xunjie\\msvcrt40.dll",
  199. "C:\\Program Files (x86)\\Xunjie\\msvidc32.dll",
  200. "C:\\Program Files (x86)\\Xunjie\\xjhelper.exe",
  201. "C:\\Program Files (x86)\\Xunjie\\unins000.dat",
  202. "C:\\Program Files (x86)\\Xunjie\\is-V2OE6.tmp",
  203. "C:\\Program Files (x86)\\Xunjie\\unins000.exe",
  204. "C:\\Program Files (x86)\\Xunjie\\is-8HG7Q.tmp",
  205. "C:\\Program Files (x86)\\Xunjie\\is-KB3K6.tmp",
  206. "C:\\Program Files (x86)\\Xunjie\\is-AEQFE.tmp",
  207. "C:\\Program Files (x86)\\Xunjie\\is-7P29Q.tmp",
  208. "C:\\Program Files (x86)\\Xunjie\\Config.ini",
  209. "C:\\Program Files (x86)\\Xunjie\\is-FST91.tmp",
  210. "C:\\Program Files (x86)\\Xunjie\\DATA.db",
  211. "\\??\\PIPE\\srvsvc",
  212. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96.lnk",
  213. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96\\\\xc3\\x90\\xc2\\xb6\\xc3\\x94\\xc3\\x98.lnk"
  214. ]
  215.  
  216. [*] Deleted Files: [
  217. "C:\\Users\\user\\AppData\\Local\\Temp\\is-2PN4T.tmp\\atpbtqwlcs.tmp",
  218. "C:\\Users\\user\\AppData\\Local\\Temp\\is-2PN4T.tmp",
  219. "C:\\Program Files (x86)\\Xunjie\\is-V2OE6.tmp",
  220. "C:\\Program Files (x86)\\Xunjie\\is-8HG7Q.tmp",
  221. "C:\\Program Files (x86)\\Xunjie\\is-KB3K6.tmp",
  222. "C:\\Program Files (x86)\\Xunjie\\is-AEQFE.tmp",
  223. "C:\\Program Files (x86)\\Xunjie\\is-7P29Q.tmp",
  224. "C:\\Program Files (x86)\\Xunjie\\is-FST91.tmp",
  225. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96.lnk",
  226. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96.pif",
  227. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96.url",
  228. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96\\\\xef\\xbf\\x90\\xef\\xbe\\xb6\\xef\\xbf\\x94\\xef\\xbf\\x98.lnk",
  229. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96\\\\xef\\xbf\\x90\\xef\\xbe\\xb6\\xef\\xbf\\x94\\xef\\xbf\\x98.pif",
  230. "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96\\\\xef\\xbf\\x90\\xef\\xbe\\xb6\\xef\\xbf\\x94\\xef\\xbf\\x98.url",
  231. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup\\_RegDLL.tmp",
  232. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup\\_setup64.tmp",
  233. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup\\_shfoldr.dll",
  234. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp\\_isetup",
  235. "C:\\Users\\user\\AppData\\Local\\Temp\\is-5ES5M.tmp"
  236. ]
  237.  
  238. [*] Modified Registry Keys: [
  239. "HKEY_CURRENT_USER\\Software\\Fbmsign",
  240. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000",
  241. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\Owner",
  242. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\SessionHash",
  243. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\Sequence",
  244. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\RegFiles0000",
  245. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\RegFilesHash",
  246. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xef\\xbf\\x91\\xef\\xbe\\xb8\\xef\\xbe\\xbd\\xef\\xbf\\x9d\\xef\\xbf\\x96\\xef\\xbf\\xba\\xef\\xbf\\x8a\\xef\\xbf\\x96_is1",
  247. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: Setup Version",
  248. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: App Path",
  249. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\InstallLocation",
  250. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: Icon Group",
  251. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: User",
  252. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: Selected Tasks",
  253. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: Deselected Tasks",
  254. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Inno Setup: Language",
  255. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\DisplayName",
  256. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\DisplayIcon",
  257. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\UninstallString",
  258. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\UninstallDataFile",
  259. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\QuietUninstallString",
  260. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\Publisher",
  261. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\NoModify",
  262. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\NoRepair",
  263. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\InstallDate",
  264. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\\xc3\\x91\\xc2\\xb8\\xc2\\xbd\\xc3\\x9d\\xc3\\x96\\xc3\\xba\\xc3\\x8a\\xc3\\x96_is1\\EstimatedSize"
  265. ]
  266.  
  267. [*] Deleted Registry Keys: [
  268. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\RegFilesHash",
  269. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\RegFiles0000",
  270. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\Sequence",
  271. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\SessionHash",
  272. "HKEY_CURRENT_USER\\Software\\Microsoft\\RestartManager\\Session0000\\Owner"
  273. ]
  274.  
  275. [*] DNS Communications: []
  276.  
  277. [*] Domains: []
  278.  
  279. [*] Network Communication - ICMP: []
  280.  
  281. [*] Network Communication - HTTP: [
  282. {
  283. "count": 1,
  284. "body": "",
  285. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  286. "user-agent": "Microsoft-CryptoAPI/6.1",
  287. "method": "GET",
  288. "host": "ocsp.digicert.com",
  289. "version": "1.1",
  290. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  291. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  292. "port": 80
  293. },
  294. {
  295. "count": 1,
  296. "body": "",
  297. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  298. "user-agent": "Microsoft-CryptoAPI/6.1",
  299. "method": "GET",
  300. "host": "ocsp.digicert.com",
  301. "version": "1.1",
  302. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  303. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  304. "port": 80
  305. },
  306. {
  307. "count": 1,
  308. "body": "",
  309. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  310. "user-agent": "Microsoft-CryptoAPI/6.1",
  311. "method": "GET",
  312. "host": "ocsp.digicert.com",
  313. "version": "1.1",
  314. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  315. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  316. "port": 80
  317. },
  318. {
  319. "count": 1,
  320. "body": "",
  321. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  322. "user-agent": "Microsoft-CryptoAPI/6.1",
  323. "method": "GET",
  324. "host": "ocsp.pki.goog",
  325. "version": "1.1",
  326. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  327. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  328. "port": 80
  329. },
  330. {
  331. "count": 1,
  332. "body": "",
  333. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  334. "user-agent": "Microsoft-CryptoAPI/6.1",
  335. "method": "GET",
  336. "host": "ocsp.digicert.com",
  337. "version": "1.1",
  338. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  339. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  340. "port": 80
  341. },
  342. {
  343. "count": 1,
  344. "body": "",
  345. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  346. "user-agent": "Microsoft-CryptoAPI/6.1",
  347. "method": "GET",
  348. "host": "crl.microsoft.com",
  349. "version": "1.1",
  350. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  351. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  352. "port": 80
  353. },
  354. {
  355. "count": 1,
  356. "body": "",
  357. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  358. "user-agent": "Microsoft-CryptoAPI/6.1",
  359. "method": "GET",
  360. "host": "ocsp.comodoca.com",
  361. "version": "1.1",
  362. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  363. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  364. "port": 80
  365. },
  366. {
  367. "count": 1,
  368. "body": "",
  369. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  370. "user-agent": "Microsoft-CryptoAPI/6.1",
  371. "method": "GET",
  372. "host": "ocsp.pki.goog",
  373. "version": "1.1",
  374. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  375. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  376. "port": 80
  377. },
  378. {
  379. "count": 1,
  380. "body": "",
  381. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  382. "user-agent": "Microsoft-CryptoAPI/6.1",
  383. "method": "GET",
  384. "host": "ocsp.digicert.com",
  385. "version": "1.1",
  386. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  387. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  388. "port": 80
  389. },
  390. {
  391. "count": 1,
  392. "body": "",
  393. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  394. "user-agent": "Microsoft-CryptoAPI/6.1",
  395. "method": "GET",
  396. "host": "www.download.windowsupdate.com",
  397. "version": "1.1",
  398. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  399. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  400. "port": 80
  401. },
  402. {
  403. "count": 1,
  404. "body": "",
  405. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  406. "user-agent": "Microsoft-CryptoAPI/6.1",
  407. "method": "GET",
  408. "host": "crl.microsoft.com",
  409. "version": "1.1",
  410. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  411. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  412. "port": 80
  413. },
  414. {
  415. "count": 1,
  416. "body": "",
  417. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  418. "user-agent": "Microsoft-CryptoAPI/6.1",
  419. "method": "GET",
  420. "host": "ocsp.digicert.com",
  421. "version": "1.1",
  422. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  423. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  424. "port": 80
  425. },
  426. {
  427. "count": 1,
  428. "body": "",
  429. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  430. "user-agent": "Microsoft-CryptoAPI/6.1",
  431. "method": "GET",
  432. "host": "ocsp.digicert.com",
  433. "version": "1.1",
  434. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  435. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  436. "port": 80
  437. },
  438. {
  439. "count": 1,
  440. "body": "",
  441. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  442. "user-agent": "Microsoft-CryptoAPI/6.1",
  443. "method": "GET",
  444. "host": "ocsp.digicert.com",
  445. "version": "1.1",
  446. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  447. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  448. "port": 80
  449. },
  450. {
  451. "count": 1,
  452. "body": "",
  453. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  454. "user-agent": "Microsoft-CryptoAPI/6.1",
  455. "method": "GET",
  456. "host": "ocsp.pki.goog",
  457. "version": "1.1",
  458. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  459. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  460. "port": 80
  461. },
  462. {
  463. "count": 1,
  464. "body": "",
  465. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  466. "user-agent": "Microsoft-CryptoAPI/6.1",
  467. "method": "GET",
  468. "host": "ocsp.pki.goog",
  469. "version": "1.1",
  470. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  471. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  472. "port": 80
  473. },
  474. {
  475. "count": 1,
  476. "body": "",
  477. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  478. "user-agent": "Microsoft-CryptoAPI/6.1",
  479. "method": "GET",
  480. "host": "ocsp.digicert.com",
  481. "version": "1.1",
  482. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  483. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  484. "port": 80
  485. },
  486. {
  487. "count": 1,
  488. "body": "",
  489. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  490. "user-agent": "Microsoft-CryptoAPI/6.1",
  491. "method": "GET",
  492. "host": "ocsp.pki.goog",
  493. "version": "1.1",
  494. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  495. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  496. "port": 80
  497. },
  498. {
  499. "count": 1,
  500. "body": "",
  501. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  502. "user-agent": "Microsoft-CryptoAPI/6.1",
  503. "method": "GET",
  504. "host": "ocsp.msocsp.com",
  505. "version": "1.1",
  506. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  507. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  508. "port": 80
  509. },
  510. {
  511. "count": 1,
  512. "body": "",
  513. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  514. "user-agent": "Microsoft-CryptoAPI/6.1",
  515. "method": "GET",
  516. "host": "ocsp.thawte.com",
  517. "version": "1.1",
  518. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  519. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  520. "port": 80
  521. },
  522. {
  523. "count": 1,
  524. "body": "",
  525. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  526. "user-agent": "Microsoft-CryptoAPI/6.1",
  527. "method": "GET",
  528. "host": "ocsp.usertrust.com",
  529. "version": "1.1",
  530. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  531. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  532. "port": 80
  533. },
  534. {
  535. "count": 1,
  536. "body": "",
  537. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  538. "user-agent": "Microsoft-CryptoAPI/6.1",
  539. "method": "GET",
  540. "host": "th.symcd.com",
  541. "version": "1.1",
  542. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  543. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  544. "port": 80
  545. },
  546. {
  547. "count": 1,
  548. "body": "",
  549. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  550. "user-agent": "Microsoft-CryptoAPI/6.1",
  551. "method": "GET",
  552. "host": "ocsp.digicert.com",
  553. "version": "1.1",
  554. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  555. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  556. "port": 80
  557. },
  558. {
  559. "count": 1,
  560. "body": "",
  561. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  562. "user-agent": "Microsoft-CryptoAPI/6.1",
  563. "method": "GET",
  564. "host": "ocsp.digicert.com",
  565. "version": "1.1",
  566. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  567. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  568. "port": 80
  569. },
  570. {
  571. "count": 1,
  572. "body": "",
  573. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  574. "user-agent": "Microsoft-CryptoAPI/6.1",
  575. "method": "GET",
  576. "host": "ocsp.pki.goog",
  577. "version": "1.1",
  578. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  579. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  580. "port": 80
  581. },
  582. {
  583. "count": 1,
  584. "body": "",
  585. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  586. "user-agent": "Microsoft-CryptoAPI/6.1",
  587. "method": "GET",
  588. "host": "crl.microsoft.com",
  589. "version": "1.1",
  590. "path": "/pki/crl/products/microsoftrootcert.crl",
  591. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  592. "port": 80
  593. },
  594. {
  595. "count": 1,
  596. "body": "",
  597. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe",
  598. "user-agent": "Microsoft BITS/7.5",
  599. "method": "HEAD",
  600. "host": "redirector.gvt1.com",
  601. "version": "1.1",
  602. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe",
  603. "data": "HEAD /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  604. "port": 80
  605. },
  606. {
  607. "count": 1,
  608. "body": "",
  609. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  610. "user-agent": "Microsoft BITS/7.5",
  611. "method": "HEAD",
  612. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  613. "version": "1.1",
  614. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  615. "data": "HEAD /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  616. "port": 80
  617. },
  618. {
  619. "count": 1,
  620. "body": "",
  621. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  622. "user-agent": "Microsoft BITS/7.5",
  623. "method": "GET",
  624. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  625. "version": "1.1",
  626. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  627. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=0-6794\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  628. "port": 80
  629. },
  630. {
  631. "count": 1,
  632. "body": "",
  633. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  634. "user-agent": "Microsoft BITS/7.5",
  635. "method": "GET",
  636. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  637. "version": "1.1",
  638. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  639. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=6795-16772\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  640. "port": 80
  641. },
  642. {
  643. "count": 1,
  644. "body": "",
  645. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  646. "user-agent": "Microsoft BITS/7.5",
  647. "method": "GET",
  648. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  649. "version": "1.1",
  650. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  651. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=16773-26440\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  652. "port": 80
  653. },
  654. {
  655. "count": 1,
  656. "body": "",
  657. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  658. "user-agent": "Microsoft BITS/7.5",
  659. "method": "GET",
  660. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  661. "version": "1.1",
  662. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  663. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=26441-35828\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  664. "port": 80
  665. },
  666. {
  667. "count": 1,
  668. "body": "",
  669. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  670. "user-agent": "Microsoft BITS/7.5",
  671. "method": "GET",
  672. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  673. "version": "1.1",
  674. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  675. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=35829-65628\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  676. "port": 80
  677. },
  678. {
  679. "count": 1,
  680. "body": "",
  681. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  682. "user-agent": "Microsoft BITS/7.5",
  683. "method": "GET",
  684. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  685. "version": "1.1",
  686. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  687. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=65629-107097\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  688. "port": 80
  689. },
  690. {
  691. "count": 1,
  692. "body": "",
  693. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  694. "user-agent": "Microsoft BITS/7.5",
  695. "method": "GET",
  696. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  697. "version": "1.1",
  698. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  699. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=107098-194193\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  700. "port": 80
  701. },
  702. {
  703. "count": 1,
  704. "body": "",
  705. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  706. "user-agent": "Microsoft BITS/7.5",
  707. "method": "GET",
  708. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  709. "version": "1.1",
  710. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  711. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=194194-308321\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  712. "port": 80
  713. },
  714. {
  715. "count": 1,
  716. "body": "",
  717. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  718. "user-agent": "Microsoft BITS/7.5",
  719. "method": "GET",
  720. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  721. "version": "1.1",
  722. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  723. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=308322-669779\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  724. "port": 80
  725. },
  726. {
  727. "count": 1,
  728. "body": "",
  729. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  730. "user-agent": "Microsoft BITS/7.5",
  731. "method": "GET",
  732. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  733. "version": "1.1",
  734. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  735. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=669780-1137913\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  736. "port": 80
  737. },
  738. {
  739. "count": 1,
  740. "body": "",
  741. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  742. "user-agent": "Microsoft BITS/7.5",
  743. "method": "GET",
  744. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  745. "version": "1.1",
  746. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  747. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=1137914-2597093\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  748. "port": 80
  749. },
  750. {
  751. "count": 1,
  752. "body": "",
  753. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  754. "user-agent": "Microsoft BITS/7.5",
  755. "method": "GET",
  756. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  757. "version": "1.1",
  758. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  759. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=2597094-5461476\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  760. "port": 80
  761. },
  762. {
  763. "count": 1,
  764. "body": "",
  765. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  766. "user-agent": "Microsoft BITS/7.5",
  767. "method": "GET",
  768. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  769. "version": "1.1",
  770. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  771. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=5461477-11240435\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  772. "port": 80
  773. },
  774. {
  775. "count": 1,
  776. "body": "",
  777. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  778. "user-agent": "Microsoft BITS/7.5",
  779. "method": "GET",
  780. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  781. "version": "1.1",
  782. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  783. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=11240436-22610763\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  784. "port": 80
  785. },
  786. {
  787. "count": 1,
  788. "body": "",
  789. "uri": "http://r4---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  790. "user-agent": "Microsoft BITS/7.5",
  791. "method": "GET",
  792. "host": "r4---sn-bvvbax-2ime.gvt1.com",
  793. "version": "1.1",
  794. "path": "/edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes",
  795. "data": "GET /edgedl/release2/chrome/Y4U1MkTGX94_75.0.3770.80/75.0.3770.80_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560393141&mv=m&nh=EAM&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 04 Jun 2019 09:17:17 GMT\r\nRange: bytes=22610764-33486591\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  796. "port": 80
  797. }
  798. ]
  799.  
  800. [*] Network Communication - SMTP: []
  801.  
  802. [*] Network Communication - Hosts: []
  803.  
  804. [*] Network Communication - IRC: []
  805.  
  806. [*] Static Analysis: {
  807. "pe": {
  808. "peid_signatures": null,
  809. "imports": [
  810. {
  811. "imports": [
  812. {
  813. "name": "LoadLibraryA",
  814. "address": "0x7029b4"
  815. },
  816. {
  817. "name": "ExitProcess",
  818. "address": "0x7029b8"
  819. },
  820. {
  821. "name": "GetProcAddress",
  822. "address": "0x7029bc"
  823. },
  824. {
  825. "name": "VirtualProtect",
  826. "address": "0x7029c0"
  827. }
  828. ],
  829. "dll": "KERNEL32.DLL"
  830. },
  831. {
  832. "imports": [
  833. {
  834. "name": "EndPaint",
  835. "address": "0x7029c8"
  836. }
  837. ],
  838. "dll": "USER32.dll"
  839. }
  840. ],
  841. "digital_signers": null,
  842. "exported_dll_name": null,
  843. "actual_checksum": "0x0022be47",
  844. "overlay": null,
  845. "imagebase": "0x00400000",
  846. "reported_checksum": "0x00000000",
  847. "icon_hash": null,
  848. "entrypoint": "0x006fc290",
  849. "timestamp": "2019-06-10 19:05:42",
  850. "osversion": "5.1",
  851. "sections": [
  852. {
  853. "name": "UPX0",
  854. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  855. "virtual_address": "0x00001000",
  856. "size_of_data": "0x00000000",
  857. "entropy": "0.00",
  858. "raw_address": "0x00000400",
  859. "virtual_size": "0x000dc000",
  860. "characteristics_raw": "0xe0000080"
  861. },
  862. {
  863. "name": "UPX1",
  864. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  865. "virtual_address": "0x000dd000",
  866. "size_of_data": "0x0021f600",
  867. "entropy": "7.85",
  868. "raw_address": "0x00000400",
  869. "virtual_size": "0x00220000",
  870. "characteristics_raw": "0xe0000040"
  871. },
  872. {
  873. "name": ".rsrc",
  874. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  875. "virtual_address": "0x002fd000",
  876. "size_of_data": "0x00005c00",
  877. "entropy": "3.96",
  878. "raw_address": "0x0021fa00",
  879. "virtual_size": "0x00006000",
  880. "characteristics_raw": "0xc0000040"
  881. }
  882. ],
  883. "resources": [],
  884. "dirents": [
  885. {
  886. "virtual_address": "0x00000000",
  887. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  888. "size": "0x00000000"
  889. },
  890. {
  891. "virtual_address": "0x00302978",
  892. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  893. "size": "0x000000b8"
  894. },
  895. {
  896. "virtual_address": "0x002fd000",
  897. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  898. "size": "0x00005978"
  899. },
  900. {
  901. "virtual_address": "0x00000000",
  902. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  903. "size": "0x00000000"
  904. },
  905. {
  906. "virtual_address": "0x00000000",
  907. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  908. "size": "0x00000000"
  909. },
  910. {
  911. "virtual_address": "0x00302a30",
  912. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  913. "size": "0x00000010"
  914. },
  915. {
  916. "virtual_address": "0x00000000",
  917. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  918. "size": "0x00000000"
  919. },
  920. {
  921. "virtual_address": "0x00000000",
  922. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  923. "size": "0x00000000"
  924. },
  925. {
  926. "virtual_address": "0x00000000",
  927. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  928. "size": "0x00000000"
  929. },
  930. {
  931. "virtual_address": "0x00000000",
  932. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  933. "size": "0x00000000"
  934. },
  935. {
  936. "virtual_address": "0x002fc474",
  937. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  938. "size": "0x000000a0"
  939. },
  940. {
  941. "virtual_address": "0x00000000",
  942. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  943. "size": "0x00000000"
  944. },
  945. {
  946. "virtual_address": "0x00000000",
  947. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  948. "size": "0x00000000"
  949. },
  950. {
  951. "virtual_address": "0x00000000",
  952. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  953. "size": "0x00000000"
  954. },
  955. {
  956. "virtual_address": "0x00000000",
  957. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  958. "size": "0x00000000"
  959. },
  960. {
  961. "virtual_address": "0x00000000",
  962. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  963. "size": "0x00000000"
  964. }
  965. ],
  966. "exports": [],
  967. "guest_signers": {},
  968. "imphash": "3f1e61913f859565204efabdfca6bdaa",
  969. "icon_fuzzy": null,
  970. "icon": null,
  971. "pdbpath": null,
  972. "imported_dll_count": 2,
  973. "versioninfo": []
  974. }
  975. }
  976.  
  977. [*] Resolved APIs: [
  978. "kernel32.dll.SetLastError",
  979. "kernel32.dll.GetProcAddress",
  980. "kernel32.dll.FreeLibrary",
  981. "kernel32.dll.HeapAlloc",
  982. "kernel32.dll.GetProcessHeap",
  983. "kernel32.dll.HeapFree",
  984. "kernel32.dll.GetModuleHandleW",
  985. "kernel32.dll.VerSetConditionMask",
  986. "kernel32.dll.VerifyVersionInfoW",
  987. "kernel32.dll.WaitForSingleObject",
  988. "kernel32.dll.CloseHandle",
  989. "kernel32.dll.TerminateProcess",
  990. "kernel32.dll.GetCurrentProcess",
  991. "kernel32.dll.CreateEventW",
  992. "kernel32.dll.GetLastError",
  993. "kernel32.dll.GetTickCount",
  994. "kernel32.dll.CreateThread",
  995. "kernel32.dll.SetEvent",
  996. "kernel32.dll.SetProcessShutdownParameters",
  997. "kernel32.dll.WriteConsoleW",
  998. "kernel32.dll.SetFilePointerEx",
  999. "kernel32.dll.GetConsoleMode",
  1000. "kernel32.dll.GetConsoleCP",
  1001. "kernel32.dll.FlushFileBuffers",
  1002. "kernel32.dll.HeapSize",
  1003. "kernel32.dll.SetStdHandle",
  1004. "kernel32.dll.GetFileType",
  1005. "kernel32.dll.UnhandledExceptionFilter",
  1006. "kernel32.dll.SetUnhandledExceptionFilter",
  1007. "kernel32.dll.IsProcessorFeaturePresent",
  1008. "kernel32.dll.IsDebuggerPresent",
  1009. "kernel32.dll.GetStartupInfoW",
  1010. "kernel32.dll.QueryPerformanceCounter",
  1011. "kernel32.dll.GetCurrentProcessId",
  1012. "kernel32.dll.GetCurrentThreadId",
  1013. "kernel32.dll.GetSystemTimeAsFileTime",
  1014. "kernel32.dll.InitializeSListHead",
  1015. "kernel32.dll.RtlUnwind",
  1016. "kernel32.dll.RaiseException",
  1017. "kernel32.dll.EnterCriticalSection",
  1018. "kernel32.dll.LeaveCriticalSection",
  1019. "kernel32.dll.DeleteCriticalSection",
  1020. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1021. "kernel32.dll.TlsAlloc",
  1022. "kernel32.dll.TlsGetValue",
  1023. "kernel32.dll.TlsSetValue",
  1024. "kernel32.dll.TlsFree",
  1025. "kernel32.dll.LoadLibraryExW",
  1026. "kernel32.dll.ExitProcess",
  1027. "kernel32.dll.GetModuleHandleExW",
  1028. "kernel32.dll.GetModuleFileNameW",
  1029. "kernel32.dll.MultiByteToWideChar",
  1030. "kernel32.dll.WideCharToMultiByte",
  1031. "kernel32.dll.GetStdHandle",
  1032. "kernel32.dll.WriteFile",
  1033. "kernel32.dll.GetACP",
  1034. "kernel32.dll.HeapReAlloc",
  1035. "kernel32.dll.GetStringTypeW",
  1036. "kernel32.dll.LCMapStringW",
  1037. "kernel32.dll.FindClose",
  1038. "kernel32.dll.FindFirstFileExW",
  1039. "kernel32.dll.FindNextFileW",
  1040. "kernel32.dll.IsValidCodePage",
  1041. "kernel32.dll.GetOEMCP",
  1042. "kernel32.dll.GetCPInfo",
  1043. "kernel32.dll.GetCommandLineA",
  1044. "kernel32.dll.GetCommandLineW",
  1045. "kernel32.dll.GetEnvironmentStringsW",
  1046. "kernel32.dll.FreeEnvironmentStringsW",
  1047. "kernel32.dll.CreateFileW",
  1048. "user32.dll.DefWindowProcW",
  1049. "user32.dll.PostQuitMessage",
  1050. "user32.dll.EndPaint",
  1051. "user32.dll.BeginPaint",
  1052. "user32.dll.ShowWindow",
  1053. "user32.dll.RegisterClassExW",
  1054. "user32.dll.LoadCursorW",
  1055. "user32.dll.DispatchMessageW",
  1056. "user32.dll.TranslateMessage",
  1057. "user32.dll.GetMessageW",
  1058. "user32.dll.CreateWindowExW",
  1059. "kernel32.dll.InitializeCriticalSectionEx",
  1060. "kernel32.dll.FlsAlloc",
  1061. "kernel32.dll.FlsSetValue",
  1062. "kernel32.dll.FlsGetValue",
  1063. "kernel32.dll.LCMapStringEx",
  1064. "uxtheme.dll.ThemeInitApiHook",
  1065. "user32.dll.IsProcessDPIAware",
  1066. "dwmapi.dll.DwmIsCompositionEnabled",
  1067. "kernel32.dll.GetModuleHandleA",
  1068. "kernel32.dll.LoadLibraryA",
  1069. "kernel32.dll.VirtualAlloc",
  1070. "kernel32.dll.VirtualFree",
  1071. "kernel32.dll.VirtualProtect",
  1072. "winhttp.dll.WinHttpReadData",
  1073. "winhttp.dll.WinHttpConnect",
  1074. "winhttp.dll.WinHttpOpenRequest",
  1075. "winhttp.dll.WinHttpSetCredentials",
  1076. "winhttp.dll.WinHttpAddRequestHeaders",
  1077. "winhttp.dll.WinHttpSendRequest",
  1078. "winhttp.dll.WinHttpReceiveResponse",
  1079. "winhttp.dll.WinHttpCloseHandle",
  1080. "winhttp.dll.WinHttpOpen",
  1081. "winhttp.dll.WinHttpQueryDataAvailable",
  1082. "winhttp.dll.WinHttpQueryHeaders",
  1083. "wininet.dll.InternetCheckConnectionW",
  1084. "kernel32.dll.CreateToolhelp32Snapshot",
  1085. "kernel32.dll.Process32FirstW",
  1086. "kernel32.dll.Process32NextW",
  1087. "kernel32.dll.lstrcpyW",
  1088. "kernel32.dll.GetSystemDirectoryA",
  1089. "kernel32.dll.GetVolumeInformationA",
  1090. "kernel32.dll.CopyFileA",
  1091. "kernel32.dll.GetVersion",
  1092. "kernel32.dll.lstrlenW",
  1093. "kernel32.dll.DeviceIoControl",
  1094. "kernel32.dll.CreateFileA",
  1095. "kernel32.dll.SetPriorityClass",
  1096. "kernel32.dll.GetVersionExW",
  1097. "kernel32.dll.ReadFile",
  1098. "kernel32.dll.CreateProcessA",
  1099. "kernel32.dll.GetThreadContext",
  1100. "kernel32.dll.ReadProcessMemory",
  1101. "kernel32.dll.VirtualAllocEx",
  1102. "kernel32.dll.WriteProcessMemory",
  1103. "kernel32.dll.VirtualProtectEx",
  1104. "kernel32.dll.VirtualFreeEx",
  1105. "kernel32.dll.SetThreadContext",
  1106. "kernel32.dll.ResumeThread",
  1107. "kernel32.dll.lstrcmpW",
  1108. "kernel32.dll.FindNextFileA",
  1109. "kernel32.dll.FindFirstFileExA",
  1110. "kernel32.dll.GetTempPathW",
  1111. "kernel32.dll.FindFirstFileW",
  1112. "kernel32.dll.DeleteFileW",
  1113. "kernel32.dll.Sleep",
  1114. "kernel32.dll.lstrcatW",
  1115. "kernel32.dll.GetWindowsDirectoryW",
  1116. "kernel32.dll.CreateMutexW",
  1117. "kernel32.dll.OpenProcess",
  1118. "kernel32.dll.LoadLibraryW",
  1119. "kernel32.dll.SetEnvironmentVariableA",
  1120. "kernel32.dll.SetEndOfFile",
  1121. "kernel32.dll.ReadConsoleW",
  1122. "kernel32.dll.GetTimeZoneInformation",
  1123. "kernel32.dll.EnumSystemLocalesW",
  1124. "kernel32.dll.GetUserDefaultLCID",
  1125. "kernel32.dll.IsValidLocale",
  1126. "kernel32.dll.GetTimeFormatW",
  1127. "kernel32.dll.GetDateFormatW",
  1128. "kernel32.dll.SwitchToThread",
  1129. "kernel32.dll.CompareStringW",
  1130. "kernel32.dll.GetLocaleInfoW",
  1131. "kernel32.dll.OutputDebugStringW",
  1132. "kernel32.dll.InterlockedFlushSList",
  1133. "kernel32.dll.GetFileAttributesExW",
  1134. "kernel32.dll.GetModuleFileNameA",
  1135. "user32.dll.wsprintfW",
  1136. "advapi32.dll.RegQueryValueExW",
  1137. "advapi32.dll.CryptReleaseContext",
  1138. "advapi32.dll.CryptDestroyHash",
  1139. "advapi32.dll.CryptGetHashParam",
  1140. "advapi32.dll.CryptHashData",
  1141. "advapi32.dll.CryptCreateHash",
  1142. "advapi32.dll.CryptAcquireContextW",
  1143. "advapi32.dll.GetTokenInformation",
  1144. "advapi32.dll.OpenProcessToken",
  1145. "advapi32.dll.RegOpenKeyW",
  1146. "advapi32.dll.RegCreateKeyW",
  1147. "advapi32.dll.RegCloseKey",
  1148. "advapi32.dll.RegOpenKeyExW",
  1149. "shell32.dll.SHGetFolderPathW",
  1150. "shell32.dll.ShellExecuteW",
  1151. "shell32.dll.CommandLineToArgvW",
  1152. "shell32.dll.ShellExecuteExA",
  1153. "ole32.dll.CoGetObject",
  1154. "ole32.dll.IIDFromString",
  1155. "ole32.dll.CoInitializeEx",
  1156. "shlwapi.dll.StrStrIW",
  1157. "shlwapi.dll.PathFileExistsA",
  1158. "netapi32.dll.Netbios",
  1159. "kernel32.dll.FlsFree",
  1160. "kernel32.dll.InitOnceExecuteOnce",
  1161. "kernel32.dll.CreateEventExW",
  1162. "kernel32.dll.CreateSemaphoreW",
  1163. "kernel32.dll.CreateSemaphoreExW",
  1164. "kernel32.dll.CreateThreadpoolTimer",
  1165. "kernel32.dll.SetThreadpoolTimer",
  1166. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  1167. "kernel32.dll.CloseThreadpoolTimer",
  1168. "kernel32.dll.CreateThreadpoolWait",
  1169. "kernel32.dll.SetThreadpoolWait",
  1170. "kernel32.dll.CloseThreadpoolWait",
  1171. "kernel32.dll.FlushProcessWriteBuffers",
  1172. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  1173. "kernel32.dll.GetCurrentProcessorNumber",
  1174. "kernel32.dll.CreateSymbolicLinkW",
  1175. "kernel32.dll.GetTickCount64",
  1176. "kernel32.dll.GetFileInformationByHandleEx",
  1177. "kernel32.dll.SetFileInformationByHandle",
  1178. "kernel32.dll.InitializeConditionVariable",
  1179. "kernel32.dll.WakeConditionVariable",
  1180. "kernel32.dll.WakeAllConditionVariable",
  1181. "kernel32.dll.SleepConditionVariableCS",
  1182. "kernel32.dll.InitializeSRWLock",
  1183. "kernel32.dll.AcquireSRWLockExclusive",
  1184. "kernel32.dll.TryAcquireSRWLockExclusive",
  1185. "kernel32.dll.ReleaseSRWLockExclusive",
  1186. "kernel32.dll.SleepConditionVariableSRW",
  1187. "kernel32.dll.CreateThreadpoolWork",
  1188. "kernel32.dll.SubmitThreadpoolWork",
  1189. "kernel32.dll.CloseThreadpoolWork",
  1190. "kernel32.dll.CompareStringEx",
  1191. "kernel32.dll.GetLocaleInfoEx",
  1192. "ntdll.dll.RtlGetVersion",
  1193. "kernel32.dll.SortGetHandle",
  1194. "kernel32.dll.SortCloseHandle",
  1195. "cryptbase.dll.SystemFunction036",
  1196. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  1197. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  1198. "comctl32.dll.#332",
  1199. "comctl32.dll.#386",
  1200. "netbios.dll.Netbios",
  1201. "kernel32.dll.SetThreadUILanguage",
  1202. "kernel32.dll.CopyFileExW",
  1203. "kernel32.dll.SetConsoleInputExeNameW",
  1204. "kernel32.dll.SetDllDirectoryW",
  1205. "kernel32.dll.SetSearchPathMode",
  1206. "kernel32.dll.SetProcessDEPPolicy",
  1207. "kernel32.dll.Wow64DisableWow64FsRedirection",
  1208. "kernel32.dll.Wow64RevertWow64FsRedirection",
  1209. "kernel32.dll.GetUserDefaultUILanguage",
  1210. "comctl32.dll.RegisterClassNameW",
  1211. "uxtheme.dll.EnableThemeDialogTexture",
  1212. "uxtheme.dll.OpenThemeData",
  1213. "uxtheme.dll.CloseThemeData",
  1214. "uxtheme.dll.DrawThemeBackground",
  1215. "uxtheme.dll.DrawThemeText",
  1216. "uxtheme.dll.GetThemeBackgroundContentRect",
  1217. "uxtheme.dll.GetThemePartSize",
  1218. "uxtheme.dll.GetThemeTextExtent",
  1219. "uxtheme.dll.GetThemeTextMetrics",
  1220. "uxtheme.dll.GetThemeBackgroundRegion",
  1221. "uxtheme.dll.HitTestThemeBackground",
  1222. "uxtheme.dll.DrawThemeEdge",
  1223. "uxtheme.dll.DrawThemeIcon",
  1224. "uxtheme.dll.IsThemePartDefined",
  1225. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  1226. "uxtheme.dll.GetThemeColor",
  1227. "uxtheme.dll.GetThemeMetric",
  1228. "uxtheme.dll.GetThemeString",
  1229. "uxtheme.dll.GetThemeBool",
  1230. "uxtheme.dll.GetThemeInt",
  1231. "uxtheme.dll.GetThemeEnumValue",
  1232. "uxtheme.dll.GetThemePosition",
  1233. "uxtheme.dll.GetThemeFont",
  1234. "uxtheme.dll.GetThemeRect",
  1235. "uxtheme.dll.GetThemeMargins",
  1236. "uxtheme.dll.GetThemeIntList",
  1237. "uxtheme.dll.GetThemePropertyOrigin",
  1238. "uxtheme.dll.SetWindowTheme",
  1239. "uxtheme.dll.GetThemeFilename",
  1240. "uxtheme.dll.GetThemeSysColor",
  1241. "uxtheme.dll.GetThemeSysColorBrush",
  1242. "uxtheme.dll.GetThemeSysBool",
  1243. "uxtheme.dll.GetThemeSysSize",
  1244. "uxtheme.dll.GetThemeSysFont",
  1245. "uxtheme.dll.GetThemeSysString",
  1246. "uxtheme.dll.GetThemeSysInt",
  1247. "uxtheme.dll.IsThemeActive",
  1248. "uxtheme.dll.IsAppThemed",
  1249. "uxtheme.dll.GetWindowTheme",
  1250. "uxtheme.dll.IsThemeDialogTextureEnabled",
  1251. "uxtheme.dll.GetThemeAppProperties",
  1252. "uxtheme.dll.SetThemeAppProperties",
  1253. "uxtheme.dll.GetCurrentThemeName",
  1254. "uxtheme.dll.GetThemeDocumentationProperty",
  1255. "uxtheme.dll.DrawThemeParentBackground",
  1256. "uxtheme.dll.EnableTheming",
  1257. "user32.dll.NotifyWinEvent",
  1258. "shell32.dll.SHCreateItemFromParsingName",
  1259. "shell32.dll.SHPathPrepareForWriteA",
  1260. "kernel32.dll.GetNativeSystemInfo",
  1261. "kernel32.dll.IsWow64Process",
  1262. "kernel32.dll.GetSystemWow64DirectoryA",
  1263. "advapi32.dll.RegDeleteKeyExA",
  1264. "user32.dll.AnimateWindow",
  1265. "gdi32.dll.GetLayout",
  1266. "gdi32.dll.GdiRealizationInfo",
  1267. "gdi32.dll.FontIsLinked",
  1268. "advapi32.dll.RegQueryInfoKeyW",
  1269. "gdi32.dll.GetTextFaceAliasW",
  1270. "advapi32.dll.RegEnumValueW",
  1271. "gdi32.dll.GetFontAssocStatus",
  1272. "advapi32.dll.RegQueryValueExA",
  1273. "advapi32.dll.RegEnumKeyExW",
  1274. "gdi32.dll.GdiIsMetaPrintDC",
  1275. "ole32.dll.CoUninitialize",
  1276. "ole32.dll.CoRegisterInitializeSpy",
  1277. "ole32.dll.CoRevokeInitializeSpy",
  1278. "comctl32.dll._TrackMouseEvent",
  1279. "msimg32.dll.TransparentBlt",
  1280. "user32.dll.DisableProcessWindowsGhosting",
  1281. "advapi32.dll.CheckTokenMembership",
  1282. "user32.dll.ShutdownBlockReasonDestroy",
  1283. "user32.dll.ShutdownBlockReasonCreate",
  1284. "shfolder.dll.SHGetFolderPathA",
  1285. "rstrtmgr.dll.RmStartSession",
  1286. "rstrtmgr.dll.RmRegisterResources",
  1287. "rstrtmgr.dll.RmGetList",
  1288. "rstrtmgr.dll.RmShutdown",
  1289. "rstrtmgr.dll.RmRestart",
  1290. "rstrtmgr.dll.RmEndSession",
  1291. "bcryptprimitives.dll.GetHashInterface",
  1292. "comctl32.dll.HIMAGELIST_QueryInterface",
  1293. "comctl32.dll.DrawShadowText",
  1294. "comctl32.dll.DrawSizeBox",
  1295. "comctl32.dll.DrawScrollBar",
  1296. "comctl32.dll.SizeBoxHwnd",
  1297. "comctl32.dll.ScrollBar_MouseMove",
  1298. "comctl32.dll.ScrollBar_Menu",
  1299. "comctl32.dll.HandleScrollCmd",
  1300. "comctl32.dll.DetachScrollBars",
  1301. "comctl32.dll.AttachScrollBars",
  1302. "comctl32.dll.CCSetScrollInfo",
  1303. "comctl32.dll.CCGetScrollInfo",
  1304. "comctl32.dll.CCEnableScrollBar",
  1305. "comctl32.dll.QuerySystemGestureStatus",
  1306. "uxtheme.dll.#49",
  1307. "user32.dll.ChangeWindowMessageFilterEx",
  1308. "gdi32.dll.GetTextExtentExPointWPri",
  1309. "imm32.dll.ImmIsIME",
  1310. "imm32.dll.ImmGetContext",
  1311. "imm32.dll.ImmReleaseContext",
  1312. "imm32.dll.ImmAssociateContext",
  1313. "user32.dll.MonitorFromRect",
  1314. "user32.dll.GetMonitorInfoA",
  1315. "shlwapi.dll.SHAutoComplete",
  1316. "ole32.dll.CoCreateInstance",
  1317. "comctl32.dll.#411",
  1318. "comctl32.dll.#410",
  1319. "ole32.dll.CLSIDFromString",
  1320. "comctl32.dll.#413",
  1321. "sfc.dll.SfcIsFileProtected",
  1322. "setupapi.dll.PnpIsFilePnpDriver",
  1323. "kernel32.dll.RegOpenKeyExW",
  1324. "kernel32.dll.RegCloseKey",
  1325. "devrtl.dll.DevRtlGetThreadLogToken",
  1326. "propsys.dll.PSCreateMemoryPropertyStore",
  1327. "comctl32.dll.#328",
  1328. "comctl32.dll.#334",
  1329. "advapi32.dll.InitializeSecurityDescriptor",
  1330. "advapi32.dll.SetEntriesInAclW",
  1331. "ntmarta.dll.GetMartaExtensionInterface",
  1332. "advapi32.dll.SetSecurityDescriptorDacl",
  1333. "advapi32.dll.IsTextUnicode",
  1334. "comctl32.dll.#338",
  1335. "comctl32.dll.#339",
  1336. "shell32.dll.#102",
  1337. "sechost.dll.ConvertSidToStringSidW",
  1338. "profapi.dll.#104",
  1339. "ole32.dll.CoTaskMemFree",
  1340. "linkinfo.dll.CreateLinkInfoW",
  1341. "user32.dll.IsCharAlphaW",
  1342. "user32.dll.CharPrevW",
  1343. "ntshrui.dll.GetNetResourceFromLocalPathW",
  1344. "srvcli.dll.NetShareEnum",
  1345. "cscapi.dll.CscNetApiGetInterface",
  1346. "slc.dll.SLGetWindowsInformationDWORD",
  1347. "shlwapi.dll.PathRemoveFileSpecW",
  1348. "linkinfo.dll.DestroyLinkInfo",
  1349. "comctl32.dll.#412",
  1350. "comctl32.dll.#388",
  1351. "oleaut32.dll.#500",
  1352. "netutils.dll.NetApiBufferFree",
  1353. "advapi32.dll.UnregisterTraceGuids",
  1354. "comctl32.dll.#321"
  1355. ]
  1356.  
  1357. [*] Static Analysis: {
  1358. "pe": {
  1359. "peid_signatures": null,
  1360. "imports": [
  1361. {
  1362. "imports": [
  1363. {
  1364. "name": "LoadLibraryA",
  1365. "address": "0x7029b4"
  1366. },
  1367. {
  1368. "name": "ExitProcess",
  1369. "address": "0x7029b8"
  1370. },
  1371. {
  1372. "name": "GetProcAddress",
  1373. "address": "0x7029bc"
  1374. },
  1375. {
  1376. "name": "VirtualProtect",
  1377. "address": "0x7029c0"
  1378. }
  1379. ],
  1380. "dll": "KERNEL32.DLL"
  1381. },
  1382. {
  1383. "imports": [
  1384. {
  1385. "name": "EndPaint",
  1386. "address": "0x7029c8"
  1387. }
  1388. ],
  1389. "dll": "USER32.dll"
  1390. }
  1391. ],
  1392. "digital_signers": null,
  1393. "exported_dll_name": null,
  1394. "actual_checksum": "0x0022be47",
  1395. "overlay": null,
  1396. "imagebase": "0x00400000",
  1397. "reported_checksum": "0x00000000",
  1398. "icon_hash": null,
  1399. "entrypoint": "0x006fc290",
  1400. "timestamp": "2019-06-10 19:05:42",
  1401. "osversion": "5.1",
  1402. "sections": [
  1403. {
  1404. "name": "UPX0",
  1405. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1406. "virtual_address": "0x00001000",
  1407. "size_of_data": "0x00000000",
  1408. "entropy": "0.00",
  1409. "raw_address": "0x00000400",
  1410. "virtual_size": "0x000dc000",
  1411. "characteristics_raw": "0xe0000080"
  1412. },
  1413. {
  1414. "name": "UPX1",
  1415. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1416. "virtual_address": "0x000dd000",
  1417. "size_of_data": "0x0021f600",
  1418. "entropy": "7.85",
  1419. "raw_address": "0x00000400",
  1420. "virtual_size": "0x00220000",
  1421. "characteristics_raw": "0xe0000040"
  1422. },
  1423. {
  1424. "name": ".rsrc",
  1425. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1426. "virtual_address": "0x002fd000",
  1427. "size_of_data": "0x00005c00",
  1428. "entropy": "3.96",
  1429. "raw_address": "0x0021fa00",
  1430. "virtual_size": "0x00006000",
  1431. "characteristics_raw": "0xc0000040"
  1432. }
  1433. ],
  1434. "resources": [],
  1435. "dirents": [
  1436. {
  1437. "virtual_address": "0x00000000",
  1438. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1439. "size": "0x00000000"
  1440. },
  1441. {
  1442. "virtual_address": "0x00302978",
  1443. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1444. "size": "0x000000b8"
  1445. },
  1446. {
  1447. "virtual_address": "0x002fd000",
  1448. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1449. "size": "0x00005978"
  1450. },
  1451. {
  1452. "virtual_address": "0x00000000",
  1453. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1454. "size": "0x00000000"
  1455. },
  1456. {
  1457. "virtual_address": "0x00000000",
  1458. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1459. "size": "0x00000000"
  1460. },
  1461. {
  1462. "virtual_address": "0x00302a30",
  1463. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1464. "size": "0x00000010"
  1465. },
  1466. {
  1467. "virtual_address": "0x00000000",
  1468. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1469. "size": "0x00000000"
  1470. },
  1471. {
  1472. "virtual_address": "0x00000000",
  1473. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1474. "size": "0x00000000"
  1475. },
  1476. {
  1477. "virtual_address": "0x00000000",
  1478. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1479. "size": "0x00000000"
  1480. },
  1481. {
  1482. "virtual_address": "0x00000000",
  1483. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1484. "size": "0x00000000"
  1485. },
  1486. {
  1487. "virtual_address": "0x002fc474",
  1488. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1489. "size": "0x000000a0"
  1490. },
  1491. {
  1492. "virtual_address": "0x00000000",
  1493. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1494. "size": "0x00000000"
  1495. },
  1496. {
  1497. "virtual_address": "0x00000000",
  1498. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1499. "size": "0x00000000"
  1500. },
  1501. {
  1502. "virtual_address": "0x00000000",
  1503. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1504. "size": "0x00000000"
  1505. },
  1506. {
  1507. "virtual_address": "0x00000000",
  1508. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1509. "size": "0x00000000"
  1510. },
  1511. {
  1512. "virtual_address": "0x00000000",
  1513. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1514. "size": "0x00000000"
  1515. }
  1516. ],
  1517. "exports": [],
  1518. "guest_signers": {},
  1519. "imphash": "3f1e61913f859565204efabdfca6bdaa",
  1520. "icon_fuzzy": null,
  1521. "icon": null,
  1522. "pdbpath": null,
  1523. "imported_dll_count": 2,
  1524. "versioninfo": []
  1525. }
  1526. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!