API tools faq
paste
paladin316

UpAgent_exe.json

paladin316
Jun 19th, 2019
2,192
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 77.89 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Malicious"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "UpAgent.exe"
  7. [*] File Size: 2537984
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "3d9001423202244e21ba1f4a7bf40f132a855d3bfe509a80f6fe6f36da4f6273"
  10. [*] MD5: "19d143ca6e612eaf3ad7af67fda7e2c8"
  11. [*] SHA1: "9c6bc3c6a0a576290dbc2432dc5f86849053626f"
  12. [*] SHA512: "0e7e9c12c9c5ac4e42699891f29609964862d200dccec4901c6bd11c7ceb7133130d7c5bd24ada3a15e1139153b44f87bb7270aa4a01a49c02b4946b34bc6bde"
  13. [*] CRC32: "9B25883C"
  14. [*] SSDEEP: "49152:yTF2P0FV/Wu7pBC18fHKzbf7CzkUxbIPgq5s0jHwB14cu62LANP9:yZ2uVjgkHKzvEkUx8zFLoj2LAN"
  15.  
  16. [*] Process Execution: [
  17. "UpAgent.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Expresses interest in specific running processes",
  27. "Details": [
  28. {
  29. "process": "System"
  30. }
  31. ]
  32. },
  33. {
  34. "Description": "Performs some HTTP requests",
  35. "Details": [
  36. {
  37. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  38. },
  39. {
  40. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  41. },
  42. {
  43. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  44. },
  45. {
  46. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  47. },
  48. {
  49. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  50. },
  51. {
  52. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  53. },
  54. {
  55. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  56. },
  57. {
  58. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  59. },
  60. {
  61. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  62. },
  63. {
  64. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  65. },
  66. {
  67. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  68. },
  69. {
  70. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  71. },
  72. {
  73. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  74. },
  75. {
  76. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  77. },
  78. {
  79. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  80. },
  81. {
  82. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  83. },
  84. {
  85. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  86. },
  87. {
  88. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  89. },
  90. {
  91. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  92. },
  93. {
  94. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  95. },
  96. {
  97. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  98. },
  99. {
  100. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  101. },
  102. {
  103. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  104. },
  105. {
  106. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  107. },
  108. {
  109. "url": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes"
  110. }
  111. ]
  112. },
  113. {
  114. "Description": "The binary likely contains encrypted or compressed data.",
  115. "Details": [
  116. {
  117. "section": "name: \\x00 , entropy: 7.97, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0002b600, virtual_size: 0x0005e000"
  118. },
  119. {
  120. "section": "name: .rsrc, entropy: 7.04, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000a00, virtual_size: 0x00001780"
  121. },
  122. {
  123. "section": "name: egbybkki, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0023b000, virtual_size: 0x0023c000"
  124. }
  125. ]
  126. },
  127. {
  128. "Description": "Checks for the presence of known windows from debuggers and forensic tools",
  129. "Details": [
  130. {
  131. "Window": "OLLYDBG"
  132. },
  133. {
  134. "Window": "GBDYLLO"
  135. },
  136. {
  137. "Window": "pediy06"
  138. },
  139. {
  140. "Window": "FilemonClass"
  141. },
  142. {
  143. "Window": "File Monitor - Sysinternals: www.sysinternals.com"
  144. },
  145. {
  146. "Window": "PROCMON_WINDOW_CLASS"
  147. },
  148. {
  149. "Window": "Process Monitor - Sysinternals: www.sysinternals.com"
  150. },
  151. {
  152. "Window": "RegmonClass"
  153. },
  154. {
  155. "Window": "Registry Monitor - Sysinternals: www.sysinternals.com"
  156. },
  157. {
  158. "Window": "18467-41"
  159. }
  160. ]
  161. },
  162. {
  163. "Description": "The following process appear to have been packed with Themida: UpAgent.exe",
  164. "Details": []
  165. },
  166. {
  167. "Description": "Checks for the presence of known devices from debuggers and forensic tools",
  168. "Details": []
  169. },
  170. {
  171. "Description": "Detects the presence of Wine emulator via registry key",
  172. "Details": []
  173. },
  174. {
  175. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  176. "Details": [
  177. {
  178. "Bkav": "HW32.Packed."
  179. },
  180. {
  181. "MicroWorld-eScan": "Trojan.GenericKD.41330434"
  182. },
  183. {
  184. "FireEye": "Generic.mg.19d143ca6e612eaf"
  185. },
  186. {
  187. "ALYac": "Trojan.GenericKD.41330434"
  188. },
  189. {
  190. "Cylance": "Unsafe"
  191. },
  192. {
  193. "Invincea": "heuristic"
  194. },
  195. {
  196. "Symantec": "ML.Attribute.HighConfidence"
  197. },
  198. {
  199. "APEX": "Malicious"
  200. },
  201. {
  202. "Paloalto": "generic.ml"
  203. },
  204. {
  205. "BitDefender": "Trojan.GenericKD.41330434"
  206. },
  207. {
  208. "AegisLab": "Trojan.Win32.Generic.4!c"
  209. },
  210. {
  211. "Ad-Aware": "Trojan.GenericKD.41330434"
  212. },
  213. {
  214. "Emsisoft": "Trojan.GenericKD.41330434 (B)"
  215. },
  216. {
  217. "McAfee-GW-Edition": "BehavesLike.Win32.Sality.vc"
  218. },
  219. {
  220. "SentinelOne": "DFI - Malicious PE"
  221. },
  222. {
  223. "Cyren": "W32/Trojan.LTQD-2571"
  224. },
  225. {
  226. "Microsoft": "Trojan:Win32/Occamy.C"
  227. },
  228. {
  229. "Endgame": "malicious (high confidence)"
  230. },
  231. {
  232. "Arcabit": "Trojan.Generic.D276A702"
  233. },
  234. {
  235. "GData": "Trojan.GenericKD.41330434"
  236. },
  237. {
  238. "Acronis": "suspicious"
  239. },
  240. {
  241. "McAfee": "Artemis!19D143CA6E61"
  242. },
  243. {
  244. "VBA32": "Malware-Cryptor.Win32.General.4"
  245. },
  246. {
  247. "TrendMicro-HouseCall": "TROJ_GEN.R002H09EU19"
  248. },
  249. {
  250. "Rising": "Trojan.Fuerboos!8.EFC8 (CLOUD)"
  251. },
  252. {
  253. "MaxSecure": "Trojan.Malware.73761585.susgen"
  254. },
  255. {
  256. "Cybereason": "malicious.6a0a57"
  257. },
  258. {
  259. "CrowdStrike": "win/malicious_confidence_70% (W)"
  260. },
  261. {
  262. "Qihoo-360": "HEUR/QVM19.1.8BD5.Malware.Gen"
  263. }
  264. ]
  265. },
  266. {
  267. "Description": "Checks the version of Bios, possibly for anti-virtualization",
  268. "Details": []
  269. },
  270. {
  271. "Description": "Detects VirtualBox using ACPI tricks",
  272. "Details": []
  273. },
  274. {
  275. "Description": "Detects VirtualBox through the presence of a registry key",
  276. "Details": []
  277. },
  278. {
  279. "Description": "Anomalous binary characteristics",
  280. "Details": [
  281. {
  282. "anomaly": "Unprintable characters found in section name"
  283. },
  284. {
  285. "anomaly": "Actual checksum does not match that reported in PE header"
  286. }
  287. ]
  288. }
  289. ]
  290.  
  291. [*] Started Service: []
  292.  
  293. [*] Executed Commands: []
  294.  
  295. [*] Mutexes: [
  296. "DBWinMutex",
  297. "Global\\CLR_CASOFF_MUTEX",
  298. "Global\\.net clr networking",
  299. "CicLoadWinStaWinSta0",
  300. "Local\\MSCTF.CtfMonitorInstMutexDefault1"
  301. ]
  302.  
  303. [*] Modified Files: [
  304. "\\??\\SICE",
  305. "\\??\\SIWVID",
  306. "\\??\\NTICE",
  307. "\\??\\PhysicalDrive0",
  308. "C:\\ProgramData\\mntemp",
  309. "C:\\Users\\user\\AppData\\Local\\Temp\\Bully Dog Technologies\\Log.txt"
  310. ]
  311.  
  312. [*] Deleted Files: [
  313. "C:\\Users\\user\\AppData\\Roaming\\RestartApp.exe",
  314. "C:\\Users\\user\\AppData\\Local\\Temp\\Bully Dog Technologies\\UpAgent.exe",
  315. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.332.33125375",
  316. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.332.33125375",
  317. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.332.33125375"
  318. ]
  319.  
  320. [*] Modified Registry Keys: [
  321. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\UpAgent_RASAPI32",
  322. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\UpAgent_RASAPI32\\EnableFileTracing",
  323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\UpAgent_RASAPI32\\EnableConsoleTracing",
  324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\UpAgent_RASAPI32\\FileTracingMask",
  325. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\UpAgent_RASAPI32\\ConsoleTracingMask",
  326. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\UpAgent_RASAPI32\\MaxFileSize",
  327. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\UpAgent_RASAPI32\\FileDirectory"
  328. ]
  329.  
  330. [*] Deleted Registry Keys: []
  331.  
  332. [*] DNS Communications: []
  333.  
  334. [*] Domains: []
  335.  
  336. [*] Network Communication - ICMP: []
  337.  
  338. [*] Network Communication - HTTP: [
  339. {
  340. "count": 1,
  341. "body": "",
  342. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  343. "user-agent": "Microsoft-CryptoAPI/6.1",
  344. "method": "GET",
  345. "host": "ocsp.digicert.com",
  346. "version": "1.1",
  347. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  348. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  349. "port": 80
  350. },
  351. {
  352. "count": 1,
  353. "body": "",
  354. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  355. "user-agent": "Microsoft-CryptoAPI/6.1",
  356. "method": "GET",
  357. "host": "ocsp.digicert.com",
  358. "version": "1.1",
  359. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  360. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  361. "port": 80
  362. },
  363. {
  364. "count": 1,
  365. "body": "",
  366. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  367. "user-agent": "Microsoft-CryptoAPI/6.1",
  368. "method": "GET",
  369. "host": "ocsp.digicert.com",
  370. "version": "1.1",
  371. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  372. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  373. "port": 80
  374. },
  375. {
  376. "count": 1,
  377. "body": "",
  378. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  379. "user-agent": "Microsoft-CryptoAPI/6.1",
  380. "method": "GET",
  381. "host": "ocsp.pki.goog",
  382. "version": "1.1",
  383. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  384. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  385. "port": 80
  386. },
  387. {
  388. "count": 1,
  389. "body": "",
  390. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  391. "user-agent": "Microsoft-CryptoAPI/6.1",
  392. "method": "GET",
  393. "host": "ocsp.digicert.com",
  394. "version": "1.1",
  395. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  396. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  397. "port": 80
  398. },
  399. {
  400. "count": 1,
  401. "body": "",
  402. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  403. "user-agent": "Microsoft-CryptoAPI/6.1",
  404. "method": "GET",
  405. "host": "crl.microsoft.com",
  406. "version": "1.1",
  407. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  408. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  409. "port": 80
  410. },
  411. {
  412. "count": 1,
  413. "body": "",
  414. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  415. "user-agent": "Microsoft-CryptoAPI/6.1",
  416. "method": "GET",
  417. "host": "ocsp.comodoca.com",
  418. "version": "1.1",
  419. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  420. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  421. "port": 80
  422. },
  423. {
  424. "count": 1,
  425. "body": "",
  426. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  427. "user-agent": "Microsoft-CryptoAPI/6.1",
  428. "method": "GET",
  429. "host": "ocsp.pki.goog",
  430. "version": "1.1",
  431. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  432. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  433. "port": 80
  434. },
  435. {
  436. "count": 1,
  437. "body": "",
  438. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  439. "user-agent": "Microsoft-CryptoAPI/6.1",
  440. "method": "GET",
  441. "host": "ocsp.digicert.com",
  442. "version": "1.1",
  443. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  444. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  445. "port": 80
  446. },
  447. {
  448. "count": 1,
  449. "body": "",
  450. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  451. "user-agent": "Microsoft-CryptoAPI/6.1",
  452. "method": "GET",
  453. "host": "www.download.windowsupdate.com",
  454. "version": "1.1",
  455. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  456. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  457. "port": 80
  458. },
  459. {
  460. "count": 1,
  461. "body": "",
  462. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  463. "user-agent": "Microsoft-CryptoAPI/6.1",
  464. "method": "GET",
  465. "host": "crl.microsoft.com",
  466. "version": "1.1",
  467. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  468. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  469. "port": 80
  470. },
  471. {
  472. "count": 1,
  473. "body": "",
  474. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  475. "user-agent": "Microsoft-CryptoAPI/6.1",
  476. "method": "GET",
  477. "host": "ocsp.digicert.com",
  478. "version": "1.1",
  479. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  480. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  481. "port": 80
  482. },
  483. {
  484. "count": 1,
  485. "body": "",
  486. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  487. "user-agent": "Microsoft-CryptoAPI/6.1",
  488. "method": "GET",
  489. "host": "ocsp.digicert.com",
  490. "version": "1.1",
  491. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  492. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  493. "port": 80
  494. },
  495. {
  496. "count": 1,
  497. "body": "",
  498. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  499. "user-agent": "Microsoft-CryptoAPI/6.1",
  500. "method": "GET",
  501. "host": "ocsp.digicert.com",
  502. "version": "1.1",
  503. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  504. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  505. "port": 80
  506. },
  507. {
  508. "count": 1,
  509. "body": "",
  510. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  511. "user-agent": "Microsoft-CryptoAPI/6.1",
  512. "method": "GET",
  513. "host": "ocsp.pki.goog",
  514. "version": "1.1",
  515. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  516. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  517. "port": 80
  518. },
  519. {
  520. "count": 1,
  521. "body": "",
  522. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  523. "user-agent": "Microsoft-CryptoAPI/6.1",
  524. "method": "GET",
  525. "host": "ocsp.pki.goog",
  526. "version": "1.1",
  527. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  528. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  529. "port": 80
  530. },
  531. {
  532. "count": 1,
  533. "body": "",
  534. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  535. "user-agent": "Microsoft-CryptoAPI/6.1",
  536. "method": "GET",
  537. "host": "ocsp.digicert.com",
  538. "version": "1.1",
  539. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  540. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  541. "port": 80
  542. },
  543. {
  544. "count": 1,
  545. "body": "",
  546. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  547. "user-agent": "Microsoft-CryptoAPI/6.1",
  548. "method": "GET",
  549. "host": "ocsp.pki.goog",
  550. "version": "1.1",
  551. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  552. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  553. "port": 80
  554. },
  555. {
  556. "count": 1,
  557. "body": "",
  558. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  559. "user-agent": "Microsoft-CryptoAPI/6.1",
  560. "method": "GET",
  561. "host": "ocsp.msocsp.com",
  562. "version": "1.1",
  563. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  564. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  565. "port": 80
  566. },
  567. {
  568. "count": 1,
  569. "body": "",
  570. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  571. "user-agent": "Microsoft-CryptoAPI/6.1",
  572. "method": "GET",
  573. "host": "ocsp.thawte.com",
  574. "version": "1.1",
  575. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  576. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  577. "port": 80
  578. },
  579. {
  580. "count": 1,
  581. "body": "",
  582. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  583. "user-agent": "Microsoft-CryptoAPI/6.1",
  584. "method": "GET",
  585. "host": "ocsp.usertrust.com",
  586. "version": "1.1",
  587. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  588. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  589. "port": 80
  590. },
  591. {
  592. "count": 1,
  593. "body": "",
  594. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  595. "user-agent": "Microsoft-CryptoAPI/6.1",
  596. "method": "GET",
  597. "host": "th.symcd.com",
  598. "version": "1.1",
  599. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  600. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  601. "port": 80
  602. },
  603. {
  604. "count": 1,
  605. "body": "",
  606. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  607. "user-agent": "Microsoft-CryptoAPI/6.1",
  608. "method": "GET",
  609. "host": "ocsp.digicert.com",
  610. "version": "1.1",
  611. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  612. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  613. "port": 80
  614. },
  615. {
  616. "count": 1,
  617. "body": "",
  618. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  619. "user-agent": "Microsoft-CryptoAPI/6.1",
  620. "method": "GET",
  621. "host": "ocsp.digicert.com",
  622. "version": "1.1",
  623. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  624. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  625. "port": 80
  626. },
  627. {
  628. "count": 1,
  629. "body": "",
  630. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  631. "user-agent": "Microsoft-CryptoAPI/6.1",
  632. "method": "GET",
  633. "host": "ocsp.pki.goog",
  634. "version": "1.1",
  635. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  636. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  637. "port": 80
  638. },
  639. {
  640. "count": 1,
  641. "body": "",
  642. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  643. "user-agent": "Microsoft-CryptoAPI/6.1",
  644. "method": "GET",
  645. "host": "crl.microsoft.com",
  646. "version": "1.1",
  647. "path": "/pki/crl/products/microsoftrootcert.crl",
  648. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  649. "port": 80
  650. },
  651. {
  652. "count": 1,
  653. "body": "",
  654. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  655. "user-agent": "Microsoft BITS/7.5",
  656. "method": "HEAD",
  657. "host": "redirector.gvt1.com",
  658. "version": "1.1",
  659. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  660. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  661. "port": 80
  662. },
  663. {
  664. "count": 1,
  665. "body": "",
  666. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  667. "user-agent": "Microsoft BITS/7.5",
  668. "method": "HEAD",
  669. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  670. "version": "1.1",
  671. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  672. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  673. "port": 80
  674. },
  675. {
  676. "count": 1,
  677. "body": "",
  678. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  679. "user-agent": "Microsoft BITS/7.5",
  680. "method": "GET",
  681. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  682. "version": "1.1",
  683. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  684. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-6845\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  685. "port": 80
  686. },
  687. {
  688. "count": 1,
  689. "body": "",
  690. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  691. "user-agent": "Microsoft BITS/7.5",
  692. "method": "GET",
  693. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  694. "version": "1.1",
  695. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  696. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6846-18319\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  697. "port": 80
  698. },
  699. {
  700. "count": 1,
  701. "body": "",
  702. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  703. "user-agent": "Microsoft BITS/7.5",
  704. "method": "GET",
  705. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  706. "version": "1.1",
  707. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  708. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=18320-28391\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  709. "port": 80
  710. },
  711. {
  712. "count": 1,
  713. "body": "",
  714. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  715. "user-agent": "Microsoft BITS/7.5",
  716. "method": "GET",
  717. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  718. "version": "1.1",
  719. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  720. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=28392-38097\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  721. "port": 80
  722. },
  723. {
  724. "count": 1,
  725. "body": "",
  726. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  727. "user-agent": "Microsoft BITS/7.5",
  728. "method": "GET",
  729. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  730. "version": "1.1",
  731. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  732. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=38098-59119\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  733. "port": 80
  734. },
  735. {
  736. "count": 1,
  737. "body": "",
  738. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  739. "user-agent": "Microsoft BITS/7.5",
  740. "method": "GET",
  741. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  742. "version": "1.1",
  743. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  744. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=59120-101989\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  745. "port": 80
  746. },
  747. {
  748. "count": 1,
  749. "body": "",
  750. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  751. "user-agent": "Microsoft BITS/7.5",
  752. "method": "GET",
  753. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  754. "version": "1.1",
  755. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  756. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=101990-189436\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  757. "port": 80
  758. },
  759. {
  760. "count": 1,
  761. "body": "",
  762. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  763. "user-agent": "Microsoft BITS/7.5",
  764. "method": "GET",
  765. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  766. "version": "1.1",
  767. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  768. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=189437-368304\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  769. "port": 80
  770. },
  771. {
  772. "count": 1,
  773. "body": "",
  774. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  775. "user-agent": "Microsoft BITS/7.5",
  776. "method": "GET",
  777. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  778. "version": "1.1",
  779. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  780. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=368305-600691\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  781. "port": 80
  782. },
  783. {
  784. "count": 1,
  785. "body": "",
  786. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  787. "user-agent": "Microsoft BITS/7.5",
  788. "method": "GET",
  789. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  790. "version": "1.1",
  791. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  792. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=600692-1324396\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  793. "port": 80
  794. },
  795. {
  796. "count": 1,
  797. "body": "",
  798. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  799. "user-agent": "Microsoft BITS/7.5",
  800. "method": "GET",
  801. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  802. "version": "1.1",
  803. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  804. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1324397-2263713\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  805. "port": 80
  806. },
  807. {
  808. "count": 1,
  809. "body": "",
  810. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  811. "user-agent": "Microsoft BITS/7.5",
  812. "method": "GET",
  813. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  814. "version": "1.1",
  815. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  816. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2263714-5180498\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  817. "port": 80
  818. },
  819. {
  820. "count": 1,
  821. "body": "",
  822. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  823. "user-agent": "Microsoft BITS/7.5",
  824. "method": "GET",
  825. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  826. "version": "1.1",
  827. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  828. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5180499-8940146\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  829. "port": 80
  830. },
  831. {
  832. "count": 1,
  833. "body": "",
  834. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  835. "user-agent": "Microsoft BITS/7.5",
  836. "method": "GET",
  837. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  838. "version": "1.1",
  839. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes",
  840. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560392789&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=8940147-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  841. "port": 80
  842. }
  843. ]
  844.  
  845. [*] Network Communication - SMTP: []
  846.  
  847. [*] Network Communication - Hosts: []
  848.  
  849. [*] Network Communication - IRC: []
  850.  
  851. [*] Static Analysis: {
  852. "pe": {
  853. "peid_signatures": null,
  854. "imports": [
  855. {
  856. "imports": [
  857. {
  858. "name": "lstrcpy",
  859. "address": "0x462034"
  860. }
  861. ],
  862. "dll": "kernel32.dll"
  863. }
  864. ],
  865. "digital_signers": null,
  866. "exported_dll_name": null,
  867. "actual_checksum": "0x0026c3b5",
  868. "overlay": null,
  869. "imagebase": "0x00400000",
  870. "reported_checksum": "0x002785d5",
  871. "icon_hash": null,
  872. "entrypoint": "0x00a5a000",
  873. "timestamp": "2019-05-28 14:41:50",
  874. "osversion": "4.0",
  875. "sections": [
  876. {
  877. "name": " \\x00 ",
  878. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  879. "virtual_address": "0x00002000",
  880. "size_of_data": "0x0002b600",
  881. "entropy": "7.97",
  882. "raw_address": "0x00002000",
  883. "virtual_size": "0x0005e000",
  884. "characteristics_raw": "0xe0000040"
  885. },
  886. {
  887. "name": ".rsrc",
  888. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  889. "virtual_address": "0x00060000",
  890. "size_of_data": "0x00000a00",
  891. "entropy": "7.04",
  892. "raw_address": "0x0002d600",
  893. "virtual_size": "0x00001780",
  894. "characteristics_raw": "0xc0000040"
  895. },
  896. {
  897. "name": ".idata ",
  898. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  899. "virtual_address": "0x00062000",
  900. "size_of_data": "0x00000200",
  901. "entropy": "1.01",
  902. "raw_address": "0x0002e000",
  903. "virtual_size": "0x00002000",
  904. "characteristics_raw": "0xc0000040"
  905. },
  906. {
  907. "name": " ",
  908. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  909. "virtual_address": "0x00064000",
  910. "size_of_data": "0x00000200",
  911. "entropy": "0.26",
  912. "raw_address": "0x0002e200",
  913. "virtual_size": "0x003b8000",
  914. "characteristics_raw": "0xe0000040"
  915. },
  916. {
  917. "name": "egbybkki",
  918. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  919. "virtual_address": "0x0041c000",
  920. "size_of_data": "0x0023b000",
  921. "entropy": "7.95",
  922. "raw_address": "0x0002e400",
  923. "virtual_size": "0x0023c000",
  924. "characteristics_raw": "0xe0000040"
  925. },
  926. {
  927. "name": "ergatstg",
  928. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  929. "virtual_address": "0x00658000",
  930. "size_of_data": "0x00000400",
  931. "entropy": "6.51",
  932. "raw_address": "0x00269400",
  933. "virtual_size": "0x00002000",
  934. "characteristics_raw": "0xe0000040"
  935. },
  936. {
  937. "name": ".taggant",
  938. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  939. "virtual_address": "0x0065a000",
  940. "size_of_data": "0x00002200",
  941. "entropy": "1.03",
  942. "raw_address": "0x00269800",
  943. "virtual_size": "0x00004000",
  944. "characteristics_raw": "0xe0000040"
  945. }
  946. ],
  947. "resources": [],
  948. "dirents": [
  949. {
  950. "virtual_address": "0x00000000",
  951. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  952. "size": "0x00000000"
  953. },
  954. {
  955. "virtual_address": "0x00062055",
  956. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  957. "size": "0x00000069"
  958. },
  959. {
  960. "virtual_address": "0x00060000",
  961. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  962. "size": "0x00001780"
  963. },
  964. {
  965. "virtual_address": "0x00000000",
  966. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  967. "size": "0x00000000"
  968. },
  969. {
  970. "virtual_address": "0x00000000",
  971. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  972. "size": "0x00000000"
  973. },
  974. {
  975. "virtual_address": "0x000621f8",
  976. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  977. "size": "0x00000008"
  978. },
  979. {
  980. "virtual_address": "0x00000000",
  981. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  982. "size": "0x00000000"
  983. },
  984. {
  985. "virtual_address": "0x00000000",
  986. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  987. "size": "0x00000000"
  988. },
  989. {
  990. "virtual_address": "0x00000000",
  991. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  992. "size": "0x00000000"
  993. },
  994. {
  995. "virtual_address": "0x00000000",
  996. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  997. "size": "0x00000000"
  998. },
  999. {
  1000. "virtual_address": "0x00000000",
  1001. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1002. "size": "0x00000000"
  1003. },
  1004. {
  1005. "virtual_address": "0x00000000",
  1006. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1007. "size": "0x00000000"
  1008. },
  1009. {
  1010. "virtual_address": "0x00000000",
  1011. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1012. "size": "0x00000000"
  1013. },
  1014. {
  1015. "virtual_address": "0x00000000",
  1016. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1017. "size": "0x00000000"
  1018. },
  1019. {
  1020. "virtual_address": "0x00000000",
  1021. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1022. "size": "0x00000000"
  1023. },
  1024. {
  1025. "virtual_address": "0x00000000",
  1026. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1027. "size": "0x00000000"
  1028. }
  1029. ],
  1030. "exports": [],
  1031. "guest_signers": {},
  1032. "imphash": "2eabe9054cad5152567f0699947a2c5b",
  1033. "icon_fuzzy": null,
  1034. "icon": null,
  1035. "pdbpath": null,
  1036. "imported_dll_count": 1,
  1037. "versioninfo": []
  1038. }
  1039. }
  1040.  
  1041. [*] Resolved APIs: [
  1042. "kernel32.dll.GetNativeSystemInfo",
  1043. "winmm.dll.timeGetTime",
  1044. "shell32.dll.IsUserAnAdmin",
  1045. "ntdll.dll.NtOpenThread",
  1046. "shell32.dll.SHGetSpecialFolderPathA",
  1047. "shlwapi.dll.PathAddExtensionA",
  1048. "shlwapi.dll.PathRemoveFileSpecA",
  1049. "shlwapi.dll.PathCombineA",
  1050. "shlwapi.dll.StrChrA",
  1051. "shlwapi.dll.StrToIntA",
  1052. "ntdll.dll.RtlAllocateHeap",
  1053. "ntdll.dll.RtlFreeHeap",
  1054. "kernel32.dll.LoadLibraryA",
  1055. "kernel32.dll.LoadLibraryW",
  1056. "kernelbase.dll.LoadLibraryExA",
  1057. "kernel32.dll.LoadLibraryExA",
  1058. "kernelbase.dll.LoadLibraryExW",
  1059. "kernel32.dll.LoadLibraryExW",
  1060. "kernelbase.dll.GetProcAddress",
  1061. "kernel32.dll.GetProcAddress",
  1062. "kernelbase.dll.FreeLibrary",
  1063. "kernel32.dll.FreeLibrary",
  1064. "kernelbase.dll.GetModuleFileNameA",
  1065. "kernel32.dll.GetModuleFileNameA",
  1066. "kernelbase.dll.GetModuleFileNameW",
  1067. "kernel32.dll.GetModuleFileNameW",
  1068. "kernelbase.dll.GetModuleHandleA",
  1069. "kernel32.dll.GetModuleHandleA",
  1070. "kernelbase.dll.GetModuleHandleW",
  1071. "kernel32.dll.GetModuleHandleW",
  1072. "kernelbase.dll.GetModuleHandleExA",
  1073. "kernel32.dll.GetModuleHandleExA",
  1074. "kernelbase.dll.GetModuleHandleExW",
  1075. "kernel32.dll.GetModuleHandleExW",
  1076. "kernelbase.dll.CloseHandle",
  1077. "kernel32.dll.CloseHandle",
  1078. "kernelbase.dll.ReadFile",
  1079. "kernel32.dll.ReadFile",
  1080. "kernelbase.dll.GetFileSize",
  1081. "kernel32.dll.GetFileSize",
  1082. "kernelbase.dll.LockFile",
  1083. "kernel32.dll.LockFile",
  1084. "kernelbase.dll.LockFileEx",
  1085. "kernel32.dll.LockFileEx",
  1086. "kernelbase.dll.DuplicateHandle",
  1087. "kernel32.dll.DuplicateHandle",
  1088. "kernelbase.dll.GetFileSizeEx",
  1089. "kernel32.dll.GetFileSizeEx",
  1090. "kernelbase.dll.CreateFileA",
  1091. "kernel32.dll.CreateFileA",
  1092. "kernelbase.dll.CreateFileW",
  1093. "kernel32.dll.CreateFileW",
  1094. "kernelbase.dll.SetFilePointer",
  1095. "kernel32.dll.SetFilePointer",
  1096. "kernel32.dll.CopyFileA",
  1097. "kernelbase.dll.GetFileType",
  1098. "kernel32.dll.GetFileType",
  1099. "kernelbase.dll.GetFileAttributesA",
  1100. "kernel32.dll.GetFileAttributesA",
  1101. "kernelbase.dll.GetFileTime",
  1102. "kernel32.dll.GetFileTime",
  1103. "kernelbase.dll.GetFileInformationByHandle",
  1104. "kernel32.dll.GetFileInformationByHandle",
  1105. "kernelbase.dll.SetFilePointerEx",
  1106. "kernel32.dll.SetFilePointerEx",
  1107. "kernel32.dll.CopyFileExA",
  1108. "kernelbase.dll.GetFileAttributesExA",
  1109. "kernel32.dll.GetFileAttributesExA",
  1110. "kernel32.dll.CopyFileW",
  1111. "kernel32.dll.CopyFileExW",
  1112. "kernelbase.dll.GetFileAttributesW",
  1113. "kernel32.dll.GetFileAttributesW",
  1114. "kernelbase.dll.GetFileAttributesExW",
  1115. "kernel32.dll.GetFileAttributesExW",
  1116. "kernel32.dll.CreateFileMappingA",
  1117. "kernelbase.dll.CreateFileMappingW",
  1118. "kernel32.dll.CreateFileMappingW",
  1119. "kernel32.dll.OpenFileMappingA",
  1120. "kernelbase.dll.OpenFileMappingW",
  1121. "kernel32.dll.OpenFileMappingW",
  1122. "kernelbase.dll.MapViewOfFileEx",
  1123. "kernel32.dll.MapViewOfFileEx",
  1124. "kernelbase.dll.MapViewOfFile",
  1125. "kernel32.dll.MapViewOfFile",
  1126. "kernelbase.dll.UnmapViewOfFile",
  1127. "kernel32.dll.UnmapViewOfFile",
  1128. "advapi32.dll.CryptVerifySignatureA",
  1129. "kernelbase.dll.ExitProcess",
  1130. "kernel32.dll.ExitProcess",
  1131. "ntdll.dll.NtQuerySystemInformation",
  1132. "kernelbase.dll.GetEnvironmentVariableA",
  1133. "kernel32.dll.GetEnvironmentVariableA",
  1134. "kernelbase.dll.GetEnvironmentVariableW",
  1135. "kernel32.dll.GetEnvironmentVariableW",
  1136. "ntdll.dll.RtlReAllocateHeap",
  1137. "shell32.dll.SHGetFolderPathA",
  1138. "iphlpapi.dll.GetAdaptersInfo",
  1139. "ntdll.dll.RtlAcquireSRWLockExclusive",
  1140. "advapi32.dll.RegOpenKeyExW",
  1141. "advapi32.dll.RegQueryInfoKeyW",
  1142. "advapi32.dll.RegEnumKeyExW",
  1143. "advapi32.dll.RegEnumValueW",
  1144. "advapi32.dll.RegCloseKey",
  1145. "advapi32.dll.RegQueryValueExW",
  1146. "kernel32.dll.QueryActCtxW",
  1147. "shlwapi.dll.UrlIsW",
  1148. "kernel32.dll.FlsAlloc",
  1149. "kernel32.dll.FlsGetValue",
  1150. "kernel32.dll.FlsSetValue",
  1151. "kernel32.dll.FlsFree",
  1152. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1153. "kernel32.dll.IsProcessorFeaturePresent",
  1154. "msvcrt.dll._set_error_mode",
  1155. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  1156. "mscoree.dll.GetProcessExecutableHeap",
  1157. "mscorwks.dll._CorExeMain",
  1158. "mscorwks.dll.GetCLRFunction",
  1159. "advapi32.dll.RegisterTraceGuidsW",
  1160. "advapi32.dll.UnregisterTraceGuids",
  1161. "advapi32.dll.GetTraceLoggerHandle",
  1162. "advapi32.dll.GetTraceEnableLevel",
  1163. "advapi32.dll.GetTraceEnableFlags",
  1164. "advapi32.dll.TraceEvent",
  1165. "mscoree.dll.IEE",
  1166. "mscorwks.dll.IEE",
  1167. "mscoree.dll.GetStartupFlags",
  1168. "mscoree.dll.GetHostConfigurationFile",
  1169. "mscoree.dll.GetCORSystemDirectory",
  1170. "ntdll.dll.RtlUnwind",
  1171. "kernel32.dll.IsWow64Process",
  1172. "kernel32.dll.GetSystemWindowsDirectoryW",
  1173. "advapi32.dll.AllocateAndInitializeSid",
  1174. "advapi32.dll.OpenProcessToken",
  1175. "advapi32.dll.GetTokenInformation",
  1176. "advapi32.dll.InitializeAcl",
  1177. "advapi32.dll.AddAccessAllowedAce",
  1178. "advapi32.dll.FreeSid",
  1179. "kernel32.dll.SetThreadStackGuarantee",
  1180. "kernel32.dll.AddVectoredContinueHandler",
  1181. "kernel32.dll.RemoveVectoredContinueHandler",
  1182. "advapi32.dll.ConvertSidToStringSidW",
  1183. "shell32.dll.SHGetFolderPathW",
  1184. "kernel32.dll.FlushProcessWriteBuffers",
  1185. "kernel32.dll.GetWriteWatch",
  1186. "kernel32.dll.ResetWriteWatch",
  1187. "kernel32.dll.CreateMemoryResourceNotification",
  1188. "kernel32.dll.QueryMemoryResourceNotification",
  1189. "mscoree.dll._CorExeMain",
  1190. "mscoree.dll._CorImageUnloading",
  1191. "mscoree.dll._CorValidateImage",
  1192. "ole32.dll.CoInitializeEx",
  1193. "cryptbase.dll.SystemFunction036",
  1194. "uxtheme.dll.ThemeInitApiHook",
  1195. "user32.dll.IsProcessDPIAware",
  1196. "ole32.dll.CoGetContextToken",
  1197. "kernel32.dll.GetFullPathNameW",
  1198. "kernel32.dll.GetVersionExW",
  1199. "advapi32.dll.CryptAcquireContextA",
  1200. "advapi32.dll.CryptReleaseContext",
  1201. "advapi32.dll.CryptCreateHash",
  1202. "advapi32.dll.CryptDestroyHash",
  1203. "advapi32.dll.CryptHashData",
  1204. "advapi32.dll.CryptGetHashParam",
  1205. "advapi32.dll.CryptImportKey",
  1206. "advapi32.dll.CryptExportKey",
  1207. "advapi32.dll.CryptGenKey",
  1208. "advapi32.dll.CryptGetKeyParam",
  1209. "advapi32.dll.CryptDestroyKey",
  1210. "advapi32.dll.CryptSignHashA",
  1211. "advapi32.dll.CryptGetProvParam",
  1212. "advapi32.dll.CryptGetUserKey",
  1213. "advapi32.dll.CryptEnumProvidersA",
  1214. "mscoree.dll.GetMetaDataInternalInterface",
  1215. "mscorwks.dll.GetMetaDataInternalInterface",
  1216. "mscorjit.dll.getJit",
  1217. "kernel32.dll.GetCurrentProcess",
  1218. "kernel32.dll.GetCurrentThread",
  1219. "kernel32.dll.GetCurrentThreadId",
  1220. "advapi32.dll.LookupPrivilegeValueW",
  1221. "advapi32.dll.AdjustTokenPrivileges",
  1222. "kernel32.dll.GetTempPathW",
  1223. "kernel32.dll.SetErrorMode",
  1224. "kernel32.dll.CreateDirectoryW",
  1225. "kernel32.dll.DeleteFileW",
  1226. "kernel32.dll.GetUserDefaultUILanguage",
  1227. "kernel32.dll.CreateEventW",
  1228. "kernel32.dll.lstrlen",
  1229. "kernel32.dll.lstrlenW",
  1230. "mscoree.dll.ND_RI2",
  1231. "rasapi32.dll.RasEnumConnectionsW",
  1232. "rtutils.dll.TraceRegisterExA",
  1233. "rtutils.dll.TracePrintfExA",
  1234. "sechost.dll.OpenSCManagerW",
  1235. "sechost.dll.OpenServiceW",
  1236. "sechost.dll.QueryServiceStatus",
  1237. "sechost.dll.CloseServiceHandle",
  1238. "ws2_32.dll.WSAStartup",
  1239. "ws2_32.dll.WSASocketW",
  1240. "ws2_32.dll.setsockopt",
  1241. "ws2_32.dll.WSAEventSelect",
  1242. "ws2_32.dll.ioctlsocket",
  1243. "ws2_32.dll.closesocket",
  1244. "kernel32.dll.GetCurrentProcessId",
  1245. "kernel32.dll.GetComputerNameW",
  1246. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  1247. "kernel32.dll.LocalFree",
  1248. "kernel32.dll.VirtualQuery",
  1249. "kernel32.dll.ReleaseMutex",
  1250. "advapi32.dll.CreateWellKnownSid",
  1251. "kernel32.dll.CreateMutexW",
  1252. "kernel32.dll.WaitForSingleObject",
  1253. "kernel32.dll.OpenMutexW",
  1254. "kernel32.dll.OpenProcess",
  1255. "kernel32.dll.GetProcessTimes",
  1256. "ws2_32.dll.WSAIoctl",
  1257. "kernel32.dll.FormatMessageW",
  1258. "rasapi32.dll.RasConnectionNotificationW",
  1259. "sechost.dll.OpenSCManagerA",
  1260. "advapi32.dll.RegOpenCurrentUser",
  1261. "sechost.dll.NotifyServiceStatusChangeA",
  1262. "advapi32.dll.RegNotifyChangeKeyValue",
  1263. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1264. "kernel32.dll.SetEvent",
  1265. "kernel32.dll.SwitchToThread",
  1266. "kernel32.dll.ResetEvent",
  1267. "ole32.dll.CoWaitForMultipleHandles",
  1268. "sechost.dll.LookupAccountNameLocalW",
  1269. "advapi32.dll.LookupAccountSidW",
  1270. "sechost.dll.LookupAccountSidLocalW",
  1271. "cryptsp.dll.CryptAcquireContextW",
  1272. "cryptsp.dll.CryptGenRandom",
  1273. "ole32.dll.NdrOleInitializeExtension",
  1274. "ole32.dll.CoGetClassObject",
  1275. "ole32.dll.CoGetMarshalSizeMax",
  1276. "ole32.dll.CoMarshalInterface",
  1277. "ole32.dll.CoUnmarshalInterface",
  1278. "ole32.dll.StringFromIID",
  1279. "ole32.dll.CoGetPSClsid",
  1280. "ole32.dll.CoTaskMemAlloc",
  1281. "ole32.dll.CoTaskMemFree",
  1282. "ole32.dll.CoCreateInstance",
  1283. "ole32.dll.CoReleaseMarshalData",
  1284. "ole32.dll.DcomChannelSetHResult",
  1285. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  1286. "kernel32.dll.GetACP",
  1287. "kernel32.dll.GetSystemInfo",
  1288. "kernel32.dll.CreateIoCompletionPort",
  1289. "kernel32.dll.PostQueuedCompletionStatus",
  1290. "ntdll.dll.NtQueryInformationThread",
  1291. "ntdll.dll.NtGetCurrentProcessorNumber",
  1292. "iphlpapi.dll.GetNetworkParams",
  1293. "dnsapi.dll.DnsQueryConfig",
  1294. "iphlpapi.dll.GetAdaptersAddresses",
  1295. "iphlpapi.dll.GetIpInterfaceEntry",
  1296. "iphlpapi.dll.GetBestInterfaceEx",
  1297. "kernel32.dll.LocalAlloc",
  1298. "ws2_32.dll.inet_addr",
  1299. "kernel32.dll.WriteFile",
  1300. "user32.dll.GetProcessWindowStation",
  1301. "user32.dll.GetUserObjectInformationA",
  1302. "user32.dll.GetActiveWindow",
  1303. "ole32.dll.OleInitialize",
  1304. "ole32.dll.CoRegisterMessageFilter",
  1305. "user32.dll.EnumThreadWindows",
  1306. "user32.dll.GetFocus",
  1307. "user32.dll.MessageBoxW",
  1308. "gdi32.dll.GetLayout",
  1309. "gdi32.dll.GdiRealizationInfo",
  1310. "gdi32.dll.FontIsLinked",
  1311. "gdi32.dll.GetTextFaceAliasW",
  1312. "gdi32.dll.GetFontAssocStatus",
  1313. "advapi32.dll.RegQueryValueExA",
  1314. "dwmapi.dll.DwmIsCompositionEnabled",
  1315. "gdi32.dll.GdiIsMetaPrintDC",
  1316. "ole32.dll.CoUninitialize",
  1317. "ole32.dll.CoRegisterInitializeSpy",
  1318. "ole32.dll.CoRevokeInitializeSpy",
  1319. "user32.dll.SendMessageW",
  1320. "kernel32.dll.CreateActCtxW",
  1321. "kernel32.dll.AddRefActCtx",
  1322. "kernel32.dll.ReleaseActCtx",
  1323. "kernel32.dll.ActivateActCtx",
  1324. "kernel32.dll.DeactivateActCtx",
  1325. "kernel32.dll.GetCurrentActCtx",
  1326. "cryptsp.dll.CryptReleaseContext"
  1327. ]
  1328.  
  1329. [*] Static Analysis: {
  1330. "pe": {
  1331. "peid_signatures": null,
  1332. "imports": [
  1333. {
  1334. "imports": [
  1335. {
  1336. "name": "lstrcpy",
  1337. "address": "0x462034"
  1338. }
  1339. ],
  1340. "dll": "kernel32.dll"
  1341. }
  1342. ],
  1343. "digital_signers": null,
  1344. "exported_dll_name": null,
  1345. "actual_checksum": "0x0026c3b5",
  1346. "overlay": null,
  1347. "imagebase": "0x00400000",
  1348. "reported_checksum": "0x002785d5",
  1349. "icon_hash": null,
  1350. "entrypoint": "0x00a5a000",
  1351. "timestamp": "2019-05-28 14:41:50",
  1352. "osversion": "4.0",
  1353. "sections": [
  1354. {
  1355. "name": " \\x00 ",
  1356. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1357. "virtual_address": "0x00002000",
  1358. "size_of_data": "0x0002b600",
  1359. "entropy": "7.97",
  1360. "raw_address": "0x00002000",
  1361. "virtual_size": "0x0005e000",
  1362. "characteristics_raw": "0xe0000040"
  1363. },
  1364. {
  1365. "name": ".rsrc",
  1366. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1367. "virtual_address": "0x00060000",
  1368. "size_of_data": "0x00000a00",
  1369. "entropy": "7.04",
  1370. "raw_address": "0x0002d600",
  1371. "virtual_size": "0x00001780",
  1372. "characteristics_raw": "0xc0000040"
  1373. },
  1374. {
  1375. "name": ".idata ",
  1376. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1377. "virtual_address": "0x00062000",
  1378. "size_of_data": "0x00000200",
  1379. "entropy": "1.01",
  1380. "raw_address": "0x0002e000",
  1381. "virtual_size": "0x00002000",
  1382. "characteristics_raw": "0xc0000040"
  1383. },
  1384. {
  1385. "name": " ",
  1386. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1387. "virtual_address": "0x00064000",
  1388. "size_of_data": "0x00000200",
  1389. "entropy": "0.26",
  1390. "raw_address": "0x0002e200",
  1391. "virtual_size": "0x003b8000",
  1392. "characteristics_raw": "0xe0000040"
  1393. },
  1394. {
  1395. "name": "egbybkki",
  1396. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1397. "virtual_address": "0x0041c000",
  1398. "size_of_data": "0x0023b000",
  1399. "entropy": "7.95",
  1400. "raw_address": "0x0002e400",
  1401. "virtual_size": "0x0023c000",
  1402. "characteristics_raw": "0xe0000040"
  1403. },
  1404. {
  1405. "name": "ergatstg",
  1406. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1407. "virtual_address": "0x00658000",
  1408. "size_of_data": "0x00000400",
  1409. "entropy": "6.51",
  1410. "raw_address": "0x00269400",
  1411. "virtual_size": "0x00002000",
  1412. "characteristics_raw": "0xe0000040"
  1413. },
  1414. {
  1415. "name": ".taggant",
  1416. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1417. "virtual_address": "0x0065a000",
  1418. "size_of_data": "0x00002200",
  1419. "entropy": "1.03",
  1420. "raw_address": "0x00269800",
  1421. "virtual_size": "0x00004000",
  1422. "characteristics_raw": "0xe0000040"
  1423. }
  1424. ],
  1425. "resources": [],
  1426. "dirents": [
  1427. {
  1428. "virtual_address": "0x00000000",
  1429. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1430. "size": "0x00000000"
  1431. },
  1432. {
  1433. "virtual_address": "0x00062055",
  1434. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1435. "size": "0x00000069"
  1436. },
  1437. {
  1438. "virtual_address": "0x00060000",
  1439. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1440. "size": "0x00001780"
  1441. },
  1442. {
  1443. "virtual_address": "0x00000000",
  1444. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1445. "size": "0x00000000"
  1446. },
  1447. {
  1448. "virtual_address": "0x00000000",
  1449. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1450. "size": "0x00000000"
  1451. },
  1452. {
  1453. "virtual_address": "0x000621f8",
  1454. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1455. "size": "0x00000008"
  1456. },
  1457. {
  1458. "virtual_address": "0x00000000",
  1459. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1460. "size": "0x00000000"
  1461. },
  1462. {
  1463. "virtual_address": "0x00000000",
  1464. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1465. "size": "0x00000000"
  1466. },
  1467. {
  1468. "virtual_address": "0x00000000",
  1469. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1470. "size": "0x00000000"
  1471. },
  1472. {
  1473. "virtual_address": "0x00000000",
  1474. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1475. "size": "0x00000000"
  1476. },
  1477. {
  1478. "virtual_address": "0x00000000",
  1479. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1480. "size": "0x00000000"
  1481. },
  1482. {
  1483. "virtual_address": "0x00000000",
  1484. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1485. "size": "0x00000000"
  1486. },
  1487. {
  1488. "virtual_address": "0x00000000",
  1489. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1490. "size": "0x00000000"
  1491. },
  1492. {
  1493. "virtual_address": "0x00000000",
  1494. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1495. "size": "0x00000000"
  1496. },
  1497. {
  1498. "virtual_address": "0x00000000",
  1499. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1500. "size": "0x00000000"
  1501. },
  1502. {
  1503. "virtual_address": "0x00000000",
  1504. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1505. "size": "0x00000000"
  1506. }
  1507. ],
  1508. "exports": [],
  1509. "guest_signers": {},
  1510. "imphash": "2eabe9054cad5152567f0699947a2c5b",
  1511. "icon_fuzzy": null,
  1512. "icon": null,
  1513. "pdbpath": null,
  1514. "imported_dll_count": 1,
  1515. "versioninfo": []
  1516. }
  1517. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!