API tools faq
paste
paladin316

pm4.json

paladin316
Jun 20th, 2019
2,188
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 49.63 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 6.8
  5.  
  6. [*] File Name: "pm4"
  7. [*] File Size: 163840
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 09:56:09 2012, Create Time/Date: Fri Sep 21 09:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 11:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0"
  9. [*] SHA256: "cbea31ca496945a22c1ddb992f3954056060e764d6599f1725ce3f3293b30934"
  10. [*] MD5: "f6638f53204699f3b407a0bfa443f98a"
  11. [*] SHA1: "2ea06ae915cf01e1a4ab206d1beedc06a528bb83"
  12. [*] SHA512: "9fb63c1564f01314063c12107e8e0004c20e68373bc2a60ee6a94116269c7405e4a3bb11320e00b271e7e0036d481ab8a92386aea4c6dd019d27a19b8d89099c"
  13. [*] CRC32: "6A17DF68"
  14. [*] SSDEEP: "1536:RElA2/nn/NLLnxeohgBQR/8At6Le/FI4GHrJj89b0wIjrMrammjhlHMNMlIAuCg0:REhn/NLjZgo/yMFIlNjokrMObZIpJ7"
  15.  
  16. [*] Process Execution: [
  17. "cmd.exe",
  18. "rundll32.exe",
  19. "services.exe",
  20. "svchost.exe",
  21. "msiexec.exe",
  22. "GoogleUpdate.exe",
  23. "svchost.exe"
  24. ]
  25.  
  26. [*] Signatures Detected: [
  27. {
  28. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  29. "Details": [
  30. {
  31. "IP": "172.217.0.227:443"
  32. }
  33. ]
  34. },
  35. {
  36. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  37. "Details": [
  38. {
  39. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  40. }
  41. ]
  42. },
  43. {
  44. "Description": "File has been identified by 10 Antiviruses on VirusTotal as malicious",
  45. "Details": [
  46. {
  47. "McAfee": "Artemis!55BBC8E3CAC8"
  48. },
  49. {
  50. "ESET-NOD32": "a variant of Win32/GenKryptik.DKZJ"
  51. },
  52. {
  53. "TrendMicro-HouseCall": "Backdoor.Win32.FLAWEDAMMY.SMKAT"
  54. },
  55. {
  56. "Invincea": "heuristic"
  57. },
  58. {
  59. "McAfee-GW-Edition": "Artemis"
  60. },
  61. {
  62. "Microsoft": "Trojan:Win32/Fuery.C!cl"
  63. },
  64. {
  65. "AhnLab-V3": "Win-Trojan/Suspig9.Exp"
  66. },
  67. {
  68. "ALYac": "Trojan.Downloader.DOC.gen"
  69. },
  70. {
  71. "Rising": "Trojan.GenKryptik!8.AA55 (CLOUD)"
  72. },
  73. {
  74. "Ikarus": "Backdoor.Rat.FlawedAmmyy"
  75. }
  76. ]
  77. },
  78. {
  79. "Description": "Performs some HTTP requests",
  80. "Details": [
  81. {
  82. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  83. },
  84. {
  85. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  86. },
  87. {
  88. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  89. },
  90. {
  91. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  92. },
  93. {
  94. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  95. },
  96. {
  97. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  98. },
  99. {
  100. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  101. },
  102. {
  103. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  104. },
  105. {
  106. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  107. },
  108. {
  109. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  110. },
  111. {
  112. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  113. },
  114. {
  115. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  116. },
  117. {
  118. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  119. },
  120. {
  121. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  122. },
  123. {
  124. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  125. },
  126. {
  127. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  128. },
  129. {
  130. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  131. },
  132. {
  133. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  134. },
  135. {
  136. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  137. },
  138. {
  139. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  140. },
  141. {
  142. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  143. },
  144. {
  145. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  146. },
  147. {
  148. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  149. },
  150. {
  151. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  152. },
  153. {
  154. "url": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561017451&mv=m&pl=24&shardbypass=yes"
  155. }
  156. ]
  157. },
  158. {
  159. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  160. "Details": [
  161. {
  162. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 7879067 times"
  163. }
  164. ]
  165. }
  166. ]
  167.  
  168. [*] Started Service: [
  169. "AppMgmt"
  170. ]
  171.  
  172. [*] Executed Commands: [
  173. "\"C:\\Windows\\system32\\rundll32.exe\" C:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL C:\\Users\\user\\AppData\\Local\\Temp\\pm4",
  174. "C:\\Users\\user\\AppData\\Local\\Temp\\pm4 ",
  175. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  176. "C:\\Windows\\system32\\msiexec.exe /V",
  177. "\"C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe\" /svc",
  178. "C:\\Windows\\System32\\svchost.exe -k netsvcs"
  179. ]
  180.  
  181. [*] Mutexes: [
  182. "Local\\ZoneAttributeCacheCounterMutex",
  183. "Local\\ZonesCacheCounterMutex",
  184. "Local\\ZonesLockedCacheCounterMutex",
  185. "Global\\_MSIExecute",
  186. "Global\\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}",
  187. "Global\\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}",
  188. "Global\\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}",
  189. "Global\\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}"
  190. ]
  191.  
  192. [*] Modified Files: [
  193. "C:\\Windows\\Installer\\15f6e4f.msi",
  194. "C:\\Windows\\Installer\\15f6e50.msi",
  195. "\\??\\PIPE\\wkssvc",
  196. "\\??\\pipe\\GoogleCrashServices\\S-1-5-18"
  197. ]
  198.  
  199. [*] Deleted Files: [
  200. "C:\\Windows\\Installer\\15f6e4f.msi",
  201. "C:\\Program Files (x86)\\Google\\Update\\Install\\{0E51DEF1-ED79-4FDA-92A7-D7F8B9999365}\\GoogleUpdateSetup.exe",
  202. "C:\\Program Files (x86)\\Google\\Update\\Install\\{0E51DEF1-ED79-4FDA-92A7-D7F8B9999365}"
  203. ]
  204.  
  205. [*] Modified Registry Keys: [
  206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  208. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Start",
  209. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\BITS\\Type",
  210. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{F3A64988-9E9F-4B4B-A25B-85A8A4699BA5}",
  211. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{F3A64988-9E9F-4B4B-A25B-85A8A4699BA5}\\PersistedPingString",
  212. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{F3A64988-9E9F-4B4B-A25B-85A8A4699BA5}\\PersistedPingTime",
  213. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\pv",
  214. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\pv",
  215. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState",
  216. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue",
  217. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2E\\52C64B7E\\LanguageList",
  218. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\proxy\\source",
  219. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\RollCallDayStartSec",
  220. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\DayOfLastRollCall",
  221. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\ping_freshness",
  222. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\(Default)",
  223. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\hint",
  224. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\cohort\\name",
  225. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\LastCheckSuccess",
  226. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  227. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ActivePingDayStartSec",
  228. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\RollCallDayStartSec",
  229. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastActivity",
  230. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\DayOfLastRollCall",
  231. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\ping_freshness",
  232. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\(Default)",
  233. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\hint",
  234. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\cohort\\name",
  235. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableCount",
  236. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\UpdateAvailableSince",
  237. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\LastChecked",
  238. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\PersistedPings\\{EBD5EBAD-B617-4D66-B4FD-674E998319F9}",
  239. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{EBD5EBAD-B617-4D66-B4FD-674E998319F9}\\PersistedPingString",
  240. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\PersistedPings\\{EBD5EBAD-B617-4D66-B4FD-674E998319F9}\\PersistedPingTime",
  241. "HKEY_LOCAL_MACHINE\\Software\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState",
  242. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\DownloadTimeRemainingMs",
  243. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\DownloadProgressPercent",
  244. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\CurrentState\\StateValue"
  245. ]
  246.  
  247. [*] Deleted Registry Keys: [
  248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  249. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  251. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  252. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\uid",
  253. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\old-uid",
  254. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\tttoken",
  255. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableCount",
  256. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\UpdateAvailableSince",
  257. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\dr",
  258. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Google\\Update\\ClientState\\{8A69D345-D564-463C-AFF1-A69D9E530F96}\\tttoken"
  259. ]
  260.  
  261. [*] DNS Communications: []
  262.  
  263. [*] Domains: []
  264.  
  265. [*] Network Communication - ICMP: []
  266.  
  267. [*] Network Communication - HTTP: [
  268. {
  269. "count": 1,
  270. "body": "",
  271. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  272. "user-agent": "Microsoft-CryptoAPI/6.1",
  273. "method": "GET",
  274. "host": "ocsp.digicert.com",
  275. "version": "1.1",
  276. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  277. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  278. "port": 80
  279. },
  280. {
  281. "count": 1,
  282. "body": "",
  283. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  284. "user-agent": "Microsoft-CryptoAPI/6.1",
  285. "method": "GET",
  286. "host": "ocsp.digicert.com",
  287. "version": "1.1",
  288. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  289. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  290. "port": 80
  291. },
  292. {
  293. "count": 1,
  294. "body": "",
  295. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  296. "user-agent": "Microsoft-CryptoAPI/6.1",
  297. "method": "GET",
  298. "host": "ocsp.digicert.com",
  299. "version": "1.1",
  300. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  301. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  302. "port": 80
  303. },
  304. {
  305. "count": 1,
  306. "body": "",
  307. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  308. "user-agent": "Microsoft-CryptoAPI/6.1",
  309. "method": "GET",
  310. "host": "ocsp.pki.goog",
  311. "version": "1.1",
  312. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  313. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  314. "port": 80
  315. },
  316. {
  317. "count": 1,
  318. "body": "",
  319. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  320. "user-agent": "Microsoft-CryptoAPI/6.1",
  321. "method": "GET",
  322. "host": "ocsp.digicert.com",
  323. "version": "1.1",
  324. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  325. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  326. "port": 80
  327. },
  328. {
  329. "count": 1,
  330. "body": "",
  331. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  332. "user-agent": "Microsoft-CryptoAPI/6.1",
  333. "method": "GET",
  334. "host": "crl.microsoft.com",
  335. "version": "1.1",
  336. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  337. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  338. "port": 80
  339. },
  340. {
  341. "count": 1,
  342. "body": "",
  343. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  344. "user-agent": "Microsoft-CryptoAPI/6.1",
  345. "method": "GET",
  346. "host": "ocsp.comodoca.com",
  347. "version": "1.1",
  348. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  349. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  350. "port": 80
  351. },
  352. {
  353. "count": 1,
  354. "body": "",
  355. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  356. "user-agent": "Microsoft-CryptoAPI/6.1",
  357. "method": "GET",
  358. "host": "ocsp.pki.goog",
  359. "version": "1.1",
  360. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  361. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  362. "port": 80
  363. },
  364. {
  365. "count": 1,
  366. "body": "",
  367. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  368. "user-agent": "Microsoft-CryptoAPI/6.1",
  369. "method": "GET",
  370. "host": "ocsp.digicert.com",
  371. "version": "1.1",
  372. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  373. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  374. "port": 80
  375. },
  376. {
  377. "count": 1,
  378. "body": "",
  379. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  380. "user-agent": "Microsoft-CryptoAPI/6.1",
  381. "method": "GET",
  382. "host": "www.download.windowsupdate.com",
  383. "version": "1.1",
  384. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  385. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  386. "port": 80
  387. },
  388. {
  389. "count": 1,
  390. "body": "",
  391. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  392. "user-agent": "Microsoft-CryptoAPI/6.1",
  393. "method": "GET",
  394. "host": "crl.microsoft.com",
  395. "version": "1.1",
  396. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  397. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  398. "port": 80
  399. },
  400. {
  401. "count": 1,
  402. "body": "",
  403. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  404. "user-agent": "Microsoft-CryptoAPI/6.1",
  405. "method": "GET",
  406. "host": "ocsp.digicert.com",
  407. "version": "1.1",
  408. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  409. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  410. "port": 80
  411. },
  412. {
  413. "count": 1,
  414. "body": "",
  415. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  416. "user-agent": "Microsoft-CryptoAPI/6.1",
  417. "method": "GET",
  418. "host": "ocsp.digicert.com",
  419. "version": "1.1",
  420. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  421. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  422. "port": 80
  423. },
  424. {
  425. "count": 1,
  426. "body": "",
  427. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  428. "user-agent": "Microsoft-CryptoAPI/6.1",
  429. "method": "GET",
  430. "host": "ocsp.digicert.com",
  431. "version": "1.1",
  432. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  433. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  434. "port": 80
  435. },
  436. {
  437. "count": 1,
  438. "body": "",
  439. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  440. "user-agent": "Microsoft-CryptoAPI/6.1",
  441. "method": "GET",
  442. "host": "ocsp.pki.goog",
  443. "version": "1.1",
  444. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  445. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  446. "port": 80
  447. },
  448. {
  449. "count": 1,
  450. "body": "",
  451. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  452. "user-agent": "Microsoft-CryptoAPI/6.1",
  453. "method": "GET",
  454. "host": "ocsp.pki.goog",
  455. "version": "1.1",
  456. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  457. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  458. "port": 80
  459. },
  460. {
  461. "count": 1,
  462. "body": "",
  463. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  464. "user-agent": "Microsoft-CryptoAPI/6.1",
  465. "method": "GET",
  466. "host": "ocsp.digicert.com",
  467. "version": "1.1",
  468. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  469. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  470. "port": 80
  471. },
  472. {
  473. "count": 1,
  474. "body": "",
  475. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  476. "user-agent": "Microsoft-CryptoAPI/6.1",
  477. "method": "GET",
  478. "host": "ocsp.pki.goog",
  479. "version": "1.1",
  480. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  481. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  482. "port": 80
  483. },
  484. {
  485. "count": 1,
  486. "body": "",
  487. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  488. "user-agent": "Microsoft-CryptoAPI/6.1",
  489. "method": "GET",
  490. "host": "ocsp.msocsp.com",
  491. "version": "1.1",
  492. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  493. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  494. "port": 80
  495. },
  496. {
  497. "count": 1,
  498. "body": "",
  499. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  500. "user-agent": "Microsoft-CryptoAPI/6.1",
  501. "method": "GET",
  502. "host": "ocsp.thawte.com",
  503. "version": "1.1",
  504. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  505. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  506. "port": 80
  507. },
  508. {
  509. "count": 1,
  510. "body": "",
  511. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  512. "user-agent": "Microsoft-CryptoAPI/6.1",
  513. "method": "GET",
  514. "host": "ocsp.usertrust.com",
  515. "version": "1.1",
  516. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  517. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  518. "port": 80
  519. },
  520. {
  521. "count": 1,
  522. "body": "",
  523. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  524. "user-agent": "Microsoft-CryptoAPI/6.1",
  525. "method": "GET",
  526. "host": "th.symcd.com",
  527. "version": "1.1",
  528. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  529. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  530. "port": 80
  531. },
  532. {
  533. "count": 1,
  534. "body": "",
  535. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  536. "user-agent": "Microsoft-CryptoAPI/6.1",
  537. "method": "GET",
  538. "host": "ocsp.digicert.com",
  539. "version": "1.1",
  540. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  541. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  542. "port": 80
  543. },
  544. {
  545. "count": 1,
  546. "body": "",
  547. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  548. "user-agent": "Microsoft-CryptoAPI/6.1",
  549. "method": "GET",
  550. "host": "ocsp.digicert.com",
  551. "version": "1.1",
  552. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  553. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  554. "port": 80
  555. },
  556. {
  557. "count": 1,
  558. "body": "",
  559. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  560. "user-agent": "Microsoft-CryptoAPI/6.1",
  561. "method": "GET",
  562. "host": "ocsp.pki.goog",
  563. "version": "1.1",
  564. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  565. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  566. "port": 80
  567. },
  568. {
  569. "count": 1,
  570. "body": "",
  571. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  572. "user-agent": "Microsoft-CryptoAPI/6.1",
  573. "method": "GET",
  574. "host": "crl.microsoft.com",
  575. "version": "1.1",
  576. "path": "/pki/crl/products/microsoftrootcert.crl",
  577. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  578. "port": 80
  579. },
  580. {
  581. "count": 1,
  582. "body": "",
  583. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  584. "user-agent": "Microsoft BITS/7.5",
  585. "method": "HEAD",
  586. "host": "redirector.gvt1.com",
  587. "version": "1.1",
  588. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  589. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  590. "port": 80
  591. },
  592. {
  593. "count": 1,
  594. "body": "",
  595. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561017451&mv=m&pl=24&shardbypass=yes",
  596. "user-agent": "Microsoft BITS/7.5",
  597. "method": "HEAD",
  598. "host": "r4---sn-tt1eln7l.gvt1.com",
  599. "version": "1.1",
  600. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561017451&mv=m&pl=24&shardbypass=yes",
  601. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561017451&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  602. "port": 80
  603. }
  604. ]
  605.  
  606. [*] Network Communication - SMTP: []
  607.  
  608. [*] Network Communication - Hosts: []
  609.  
  610. [*] Network Communication - IRC: []
  611.  
  612. [*] Static Analysis: {}
  613.  
  614. [*] Resolved APIs: [
  615. "shell32.dll.ShellExecuteExW",
  616. "ole32.dll.OleInitialize",
  617. "cryptbase.dll.SystemFunction036",
  618. "uxtheme.dll.ThemeInitApiHook",
  619. "user32.dll.IsProcessDPIAware",
  620. "ole32.dll.CreateBindCtx",
  621. "ole32.dll.CoTaskMemAlloc",
  622. "propsys.dll.PSCreateMemoryPropertyStore",
  623. "propsys.dll.PSPropertyBag_WriteDWORD",
  624. "ole32.dll.CoGetApartmentType",
  625. "ole32.dll.CoRegisterInitializeSpy",
  626. "ole32.dll.CoTaskMemFree",
  627. "comctl32.dll.#236",
  628. "oleaut32.dll.#6",
  629. "ole32.dll.CoGetMalloc",
  630. "propsys.dll.PSPropertyBag_ReadDWORD",
  631. "comctl32.dll.#320",
  632. "ole32.dll.StringFromGUID2",
  633. "comctl32.dll.#324",
  634. "comctl32.dll.#323",
  635. "advapi32.dll.RegEnumKeyW",
  636. "oleaut32.dll.#2",
  637. "propsys.dll.PSPropertyBag_ReadBSTR",
  638. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  639. "shell32.dll.#102",
  640. "advapi32.dll.OpenThreadToken",
  641. "ole32.dll.CoInitializeEx",
  642. "ole32.dll.CoCreateInstance",
  643. "advapi32.dll.InitializeSecurityDescriptor",
  644. "advapi32.dll.SetEntriesInAclW",
  645. "ntmarta.dll.GetMartaExtensionInterface",
  646. "advapi32.dll.SetSecurityDescriptorDacl",
  647. "advapi32.dll.IsTextUnicode",
  648. "comctl32.dll.#328",
  649. "comctl32.dll.#334",
  650. "comctl32.dll.#332",
  651. "comctl32.dll.#338",
  652. "ole32.dll.CoUninitialize",
  653. "sechost.dll.ConvertSidToStringSidW",
  654. "profapi.dll.#104",
  655. "propsys.dll.#417",
  656. "ole32.dll.PropVariantClear",
  657. "oleaut32.dll.#9",
  658. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  659. "comctl32.dll.#339",
  660. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  661. "comctl32.dll.#386",
  662. "advapi32.dll.RegQueryValueW",
  663. "apphelp.dll.ApphelpCheckShellObject",
  664. "propsys.dll.#430",
  665. "advapi32.dll.RegOpenKeyExW",
  666. "advapi32.dll.RegGetValueW",
  667. "advapi32.dll.RegCloseKey",
  668. "ole32.dll.CoTaskMemRealloc",
  669. "ole32.dll.CoAllowSetForegroundWindow",
  670. "advapi32.dll.InstallApplication",
  671. "oleaut32.dll.#500",
  672. "kernel32.dll.InitializeSRWLock",
  673. "kernel32.dll.AcquireSRWLockExclusive",
  674. "kernel32.dll.AcquireSRWLockShared",
  675. "kernel32.dll.ReleaseSRWLockExclusive",
  676. "kernel32.dll.ReleaseSRWLockShared",
  677. "shell32.dll.SHGetFolderPathW",
  678. "advapi32.dll.SaferGetPolicyInformation",
  679. "sfc.dll.SfcIsFileProtected",
  680. "ntdll.dll.RtlDllShutdownInProgress",
  681. "comctl32.dll.#329",
  682. "ole32.dll.OleUninitialize",
  683. "ole32.dll.CoRevokeInitializeSpy",
  684. "comctl32.dll.#388",
  685. "kernelbase.dll.SetThreadStackGuarantee",
  686. "ole32.dll.CoInitializeSecurity",
  687. "sechost.dll.LookupAccountNameLocalW",
  688. "advapi32.dll.LookupAccountSidW",
  689. "sechost.dll.LookupAccountSidLocalW",
  690. "kernel32.dll.SortGetHandle",
  691. "kernel32.dll.SortCloseHandle",
  692. "appmgmts.dll.ServiceMain",
  693. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  694. "shell32.dll.OpenAs_RunDLLW",
  695. "dwmapi.dll.DwmIsCompositionEnabled",
  696. "comctl32.dll.InitCommonControlsEx",
  697. "uxtheme.dll.EnableThemeDialogTexture",
  698. "comctl32.dll.RegisterClassNameW",
  699. "uxtheme.dll.OpenThemeData",
  700. "uxtheme.dll.GetThemeBool",
  701. "uxtheme.dll.IsThemePartDefined",
  702. "uxtheme.dll.GetThemePartSize",
  703. "uxtheme.dll.GetThemeFont",
  704. "uxtheme.dll.GetThemeColor",
  705. "imm32.dll.ImmIsIME",
  706. "uxtheme.dll.CloseThemeData",
  707. "uxtheme.dll.GetThemeTextExtent",
  708. "gdi32.dll.GetLayout",
  709. "gdi32.dll.GdiRealizationInfo",
  710. "gdi32.dll.FontIsLinked",
  711. "advapi32.dll.RegQueryInfoKeyW",
  712. "gdi32.dll.GetTextFaceAliasW",
  713. "advapi32.dll.RegEnumValueW",
  714. "advapi32.dll.RegQueryValueExW",
  715. "gdi32.dll.GetFontAssocStatus",
  716. "advapi32.dll.RegQueryValueExA",
  717. "advapi32.dll.RegEnumKeyExW",
  718. "uxtheme.dll.GetThemeMargins",
  719. "gdi32.dll.GetTextExtentExPointWPri",
  720. "comctl32.dll.ImageList_CoCreateInstance",
  721. "windowscodecs.dll.WICCreateImagingFactory_Proxy",
  722. "shlwapi.dll.PathRemoveFileSpecW",
  723. "lpk.dll.LpkEditControl",
  724. "kernel32.dll.HeapSetInformation",
  725. "advapi32.dll.CheckTokenMembership",
  726. "kernel32.dll.GetSystemWindowsDirectoryW",
  727. "kernel32.dll.CreateWaitableTimerW",
  728. "kernel32.dll.SetWaitableTimer",
  729. "ole32.dll.CLSIDFromOle1Class",
  730. "clbcatq.dll.GetCatalogObject",
  731. "clbcatq.dll.GetCatalogObject2",
  732. "cryptsp.dll.CryptAcquireContextW",
  733. "cryptsp.dll.CryptGenRandom",
  734. "ole32.dll.NdrOleInitializeExtension",
  735. "ole32.dll.CoGetClassObject",
  736. "ole32.dll.CoGetMarshalSizeMax",
  737. "ole32.dll.CoMarshalInterface",
  738. "ole32.dll.CoUnmarshalInterface",
  739. "ole32.dll.StringFromIID",
  740. "ole32.dll.CoGetPSClsid",
  741. "ole32.dll.CoReleaseMarshalData",
  742. "ole32.dll.DcomChannelSetHResult",
  743. "msi.dll.QueryInstanceCount",
  744. "kernel32.dll.CancelWaitableTimer",
  745. "msi.dll.DllGetClassObject",
  746. "msi.dll.DllCanUnloadNow",
  747. "ole32.dll.CoGetCallContext",
  748. "rpcrt4.dll.I_RpcBindingInqLocalClientPID",
  749. "userenv.dll.CreateEnvironmentBlock",
  750. "userenv.dll.DestroyEnvironmentBlock",
  751. "kernel32.dll.GetThreadPreferredUILanguages",
  752. "ntdll.dll.WinSqmIsOptedIn",
  753. "kernel32.dll.WTSGetActiveConsoleSessionId",
  754. "ole32.dll.CoInitialize",
  755. "netapi32.dll.NetGetJoinInformation",
  756. "netapi32.dll.NetApiBufferFree",
  757. "shlwapi.dll.UrlIsW",
  758. "ole32.dll.StgOpenStorage",
  759. "kernel32.dll.GetFileAttributesExW",
  760. "advapi32.dll.CreateWellKnownSid",
  761. "advapi32.dll.SaferCreateLevel",
  762. "advapi32.dll.SaferCloseLevel",
  763. "apphelp.dll.SdbInitDatabase",
  764. "apphelp.dll.SdbFindFirstMsiPackage_Str",
  765. "apphelp.dll.SdbReleaseDatabase",
  766. "version.dll.GetFileVersionInfoSizeW",
  767. "version.dll.GetFileVersionInfoW",
  768. "version.dll.VerQueryValueW",
  769. "mscoree.dll.GetCORSystemDirectory",
  770. "kernel32.dll.SetThreadExecutionState",
  771. "sfc.dll.SfcIsKeyProtected",
  772. "kernel32.dll.FlsAlloc",
  773. "kernel32.dll.FlsSetValue",
  774. "kernel32.dll.FlsGetValue",
  775. "kernel32.dll.LCMapStringEx",
  776. "kernel32.dll.InitializeCriticalSectionEx",
  777. "kernel32.dll.FlsFree",
  778. "kernel32.dll.InitOnceExecuteOnce",
  779. "kernel32.dll.CreateEventExW",
  780. "kernel32.dll.CreateSemaphoreW",
  781. "kernel32.dll.CreateSemaphoreExW",
  782. "kernel32.dll.CreateThreadpoolTimer",
  783. "kernel32.dll.SetThreadpoolTimer",
  784. "kernel32.dll.WaitForThreadpoolTimerCallbacks",
  785. "kernel32.dll.CloseThreadpoolTimer",
  786. "kernel32.dll.CreateThreadpoolWait",
  787. "kernel32.dll.SetThreadpoolWait",
  788. "kernel32.dll.CloseThreadpoolWait",
  789. "kernel32.dll.FlushProcessWriteBuffers",
  790. "kernel32.dll.FreeLibraryWhenCallbackReturns",
  791. "kernel32.dll.GetCurrentProcessorNumber",
  792. "kernel32.dll.CreateSymbolicLinkW",
  793. "kernel32.dll.GetTickCount64",
  794. "kernel32.dll.GetFileInformationByHandleEx",
  795. "kernel32.dll.SetFileInformationByHandle",
  796. "kernel32.dll.InitializeConditionVariable",
  797. "kernel32.dll.WakeConditionVariable",
  798. "kernel32.dll.WakeAllConditionVariable",
  799. "kernel32.dll.SleepConditionVariableCS",
  800. "kernel32.dll.TryAcquireSRWLockExclusive",
  801. "kernel32.dll.SleepConditionVariableSRW",
  802. "kernel32.dll.CreateThreadpoolWork",
  803. "kernel32.dll.SubmitThreadpoolWork",
  804. "kernel32.dll.CloseThreadpoolWork",
  805. "kernel32.dll.CompareStringEx",
  806. "kernel32.dll.GetLocaleInfoEx",
  807. "goopdate.dll.DllEntry",
  808. "kernel32.dll.RtlCaptureStackBackTrace",
  809. "wkscli.dll.NetWkstaGetInfo",
  810. "cscapi.dll.CscNetApiGetInterface",
  811. "kernel32.dll.CreateMutexExW",
  812. "dbghelp.dll.MiniDumpWriteDump",
  813. "rpcrt4.dll.UuidCreate",
  814. "psmachine.dll.DllGetClassObject",
  815. "psmachine.dll.DllCanUnloadNow",
  816. "advapi32.dll.RegOpenKeyW",
  817. "ntdll.dll.RtlGetVersion",
  818. "kernel32.dll.GetNativeSystemInfo",
  819. "winhttp.dll.WinHttpAddRequestHeaders",
  820. "winhttp.dll.WinHttpCheckPlatform",
  821. "winhttp.dll.WinHttpCloseHandle",
  822. "winhttp.dll.WinHttpConnect",
  823. "winhttp.dll.WinHttpCrackUrl",
  824. "winhttp.dll.WinHttpCreateUrl",
  825. "winhttp.dll.WinHttpDetectAutoProxyConfigUrl",
  826. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  827. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  828. "winhttp.dll.WinHttpGetProxyForUrl",
  829. "winhttp.dll.WinHttpOpen",
  830. "winhttp.dll.WinHttpOpenRequest",
  831. "winhttp.dll.WinHttpQueryAuthSchemes",
  832. "winhttp.dll.WinHttpQueryDataAvailable",
  833. "winhttp.dll.WinHttpQueryHeaders",
  834. "winhttp.dll.WinHttpQueryOption",
  835. "winhttp.dll.WinHttpReadData",
  836. "winhttp.dll.WinHttpReceiveResponse",
  837. "winhttp.dll.WinHttpSendRequest",
  838. "winhttp.dll.WinHttpSetDefaultProxyConfiguration",
  839. "winhttp.dll.WinHttpSetCredentials",
  840. "winhttp.dll.WinHttpSetOption",
  841. "winhttp.dll.WinHttpSetStatusCallback",
  842. "winhttp.dll.WinHttpSetTimeouts",
  843. "winhttp.dll.WinHttpWriteData",
  844. "shlwapi.dll.StrCmpNW",
  845. "shlwapi.dll.#153",
  846. "ws2_32.dll.GetAddrInfoW",
  847. "ws2_32.dll.WSASocketW",
  848. "ws2_32.dll.#2",
  849. "ws2_32.dll.#21",
  850. "ws2_32.dll.#9",
  851. "ws2_32.dll.WSAIoctl",
  852. "ws2_32.dll.FreeAddrInfoW",
  853. "ws2_32.dll.#6",
  854. "ws2_32.dll.#5",
  855. "schannel.dll.SpUserModeInitialize",
  856. "advapi32.dll.RegCreateKeyExW",
  857. "ws2_32.dll.WSASend",
  858. "ws2_32.dll.WSARecv",
  859. "advapi32.dll.RevertToSelf",
  860. "secur32.dll.FreeContextBuffer",
  861. "ncrypt.dll.SslOpenProvider",
  862. "ncrypt.dll.GetSChannelInterface",
  863. "bcryptprimitives.dll.GetHashInterface",
  864. "ncrypt.dll.SslIncrementProviderReferenceCount",
  865. "ncrypt.dll.SslImportKey",
  866. "bcryptprimitives.dll.GetCipherInterface",
  867. "ncrypt.dll.SslLookupCipherSuiteInfo",
  868. "user32.dll.LoadStringW",
  869. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  870. "ncrypt.dll.BCryptGetProperty",
  871. "ncrypt.dll.BCryptCreateHash",
  872. "ncrypt.dll.BCryptHashData",
  873. "ncrypt.dll.BCryptFinishHash",
  874. "ncrypt.dll.BCryptDestroyHash",
  875. "crypt32.dll.CertGetCertificateChain",
  876. "userenv.dll.GetUserProfileDirectoryW",
  877. "sechost.dll.ConvertStringSidToSidW",
  878. "userenv.dll.RegisterGPNotification",
  879. "gpapi.dll.RegisterGPNotificationInternal",
  880. "sechost.dll.OpenSCManagerW",
  881. "sechost.dll.OpenServiceW",
  882. "sechost.dll.CloseServiceHandle",
  883. "sechost.dll.QueryServiceConfigW",
  884. "winsta.dll.WinStationRegisterNotificationEvent",
  885. "rpcrt4.dll.RpcStringBindingComposeW",
  886. "rpcrt4.dll.RpcBindingFromStringBindingW",
  887. "rpcrt4.dll.RpcStringFreeW",
  888. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  889. "rpcrt4.dll.RpcAsyncInitializeHandle",
  890. "rpcrt4.dll.NdrClientCall2",
  891. "rpcrt4.dll.NdrAsyncClientCall",
  892. "cryptsp.dll.CryptAcquireContextA",
  893. "cryptsp.dll.CryptCreateHash",
  894. "cryptsp.dll.CryptHashData",
  895. "cryptsp.dll.CryptVerifySignatureA",
  896. "cryptsp.dll.CryptDestroyKey",
  897. "cryptsp.dll.CryptDestroyHash",
  898. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  899. "ncrypt.dll.BCryptImportKeyPair",
  900. "ncrypt.dll.BCryptVerifySignature",
  901. "ncrypt.dll.BCryptDestroyKey",
  902. "crypt32.dll.CertVerifyCertificateChainPolicy",
  903. "crypt32.dll.CertFreeCertificateChain",
  904. "crypt32.dll.CertDuplicateCertificateContext",
  905. "ncrypt.dll.SslEncryptPacket",
  906. "ncrypt.dll.SslDecryptPacket",
  907. "winsta.dll.WinStationEnumerateW",
  908. "rpcrt4.dll.I_RpcExceptionFilter",
  909. "rpcrt4.dll.RpcBindingFree",
  910. "winsta.dll.WinStationFreeMemory",
  911. "winsta.dll.WinStationQueryInformationW",
  912. "bitsprx4.dll.DllGetClassObject",
  913. "bitsprx4.dll.DllCanUnloadNow"
  914. ]
  915.  
  916. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!