API tools faq
paste
paladin316

Exes_eba0dacctBAD_exe.json

paladin316
Jun 17th, 2019
2,222
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 73.52 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_eba0dacc\tBAD.exe"
  7. [*] File Size: 204800
  8. [*] File Type: "PE32 executable (console) Intel 80386, for MS Windows"
  9. [*] SHA256: "e98443a228d8d8462a19bbd26459250ed464390538541835bab9a490453618df"
  10. [*] MD5: "8fce11acf47b9365d268f52b7f7e0dc9"
  11. [*] SHA1: "63072804200ca765288a66d871d75a93dbe0634b"
  12. [*] SHA512: "b90b913bc7b39fb4277a45595c38b9e17a0d20c3ae18d8a4b436575a1ddb9e92c8553ff5642b9b684be9c3963607dcbc0c4a88b1dedfd78259165cc50d6e59af"
  13. [*] CRC32: "EBA0DACC"
  14. [*] SSDEEP: "3072:yVweoY8qnOvPt0dhlB+sr8r/jWtvztUekrD8co/NDoS/ZoCESV4ojW:yVweTmntklB+gOIvztUvrD8cYEMoCE3"
  15.  
  16. [*] Process Execution: [
  17. "Exes_eba0dacc_BAD.exe"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Creates RWX memory",
  23. "Details": []
  24. },
  25. {
  26. "Description": "Performs some HTTP requests",
  27. "Details": [
  28. {
  29. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  30. },
  31. {
  32. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  33. },
  34. {
  35. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  36. },
  37. {
  38. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  39. },
  40. {
  41. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  42. },
  43. {
  44. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  45. },
  46. {
  47. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  48. },
  49. {
  50. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  51. },
  52. {
  53. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  54. },
  55. {
  56. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  57. },
  58. {
  59. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  60. },
  61. {
  62. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  63. },
  64. {
  65. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  66. },
  67. {
  68. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  69. },
  70. {
  71. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  72. },
  73. {
  74. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  75. },
  76. {
  77. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  78. },
  79. {
  80. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  81. },
  82. {
  83. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  84. },
  85. {
  86. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  87. },
  88. {
  89. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  90. },
  91. {
  92. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  93. },
  94. {
  95. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  96. },
  97. {
  98. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  99. },
  100. {
  101. "url": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes"
  102. }
  103. ]
  104. },
  105. {
  106. "Description": "The binary likely contains encrypted or compressed data.",
  107. "Details": [
  108. {
  109. "section": "name: .idata, entropy: 7.84, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00008000, virtual_size: 0x00007d99"
  110. },
  111. {
  112. "section": "name: .rdata0, entropy: 7.82, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00010000, virtual_size: 0x0000f097"
  113. }
  114. ]
  115. },
  116. {
  117. "Description": "File has been identified by 40 Antiviruses on VirusTotal as malicious",
  118. "Details": [
  119. {
  120. "Bkav": "HW32.Packed."
  121. },
  122. {
  123. "MicroWorld-eScan": "Trojan.GenericKD.41365985"
  124. },
  125. {
  126. "Qihoo-360": "HEUR/QVM20.1.D78F.Malware.Gen"
  127. },
  128. {
  129. "McAfee": "RDN/Generic.grp"
  130. },
  131. {
  132. "Cylance": "Unsafe"
  133. },
  134. {
  135. "BitDefender": "Trojan.GenericKD.41365985"
  136. },
  137. {
  138. "K7GW": "Trojan ( 005500da1 )"
  139. },
  140. {
  141. "Invincea": "heuristic"
  142. },
  143. {
  144. "APEX": "Malicious"
  145. },
  146. {
  147. "Paloalto": "generic.ml"
  148. },
  149. {
  150. "GData": "Trojan.GenericKD.41365985"
  151. },
  152. {
  153. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  154. },
  155. {
  156. "Alibaba": "Trojan:Win32/GenKryptik.74732f61"
  157. },
  158. {
  159. "Avast": "Win32:Trojan-gen"
  160. },
  161. {
  162. "Endgame": "malicious (high confidence)"
  163. },
  164. {
  165. "Sophos": "Mal/Generic-S"
  166. },
  167. {
  168. "Comodo": "Packed.Win32.TDSS.~AA@1rhbt5"
  169. },
  170. {
  171. "F-Secure": "Trojan.TR/Kryptik.giyvq"
  172. },
  173. {
  174. "McAfee-GW-Edition": "RDN/Generic.grp"
  175. },
  176. {
  177. "FireEye": "Generic.mg.8fce11acf47b9365"
  178. },
  179. {
  180. "Emsisoft": "Trojan.GenericKD.41365985 (B)"
  181. },
  182. {
  183. "Ikarus": "Trojan-Banker.Emotet"
  184. },
  185. {
  186. "Cyren": "W32/Trojan.JECX-0526"
  187. },
  188. {
  189. "ESET-NOD32": "a variant of Win32/GenKryptik.DKMR"
  190. },
  191. {
  192. "Webroot": "W32.Trojan.Emotet"
  193. },
  194. {
  195. "Avira": "TR/Kryptik.giyvq"
  196. },
  197. {
  198. "Arcabit": "Trojan.Generic.D27731E1"
  199. },
  200. {
  201. "AegisLab": "Trojan.Multi.Generic.4!c"
  202. },
  203. {
  204. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  205. },
  206. {
  207. "Acronis": "suspicious"
  208. },
  209. {
  210. "ALYac": "Trojan.GenericKD.41365985"
  211. },
  212. {
  213. "MAX": "malware (ai score=99)"
  214. },
  215. {
  216. "Ad-Aware": "Trojan.GenericKD.41365985"
  217. },
  218. {
  219. "TrendMicro-HouseCall": "TROJ_GEN.R002H06FD19"
  220. },
  221. {
  222. "Rising": "Trojan.Kryptik!8.8/N3#95% (RDM+:cmRtazpaYscZOFLr+yjtEN3jTiKv)"
  223. },
  224. {
  225. "SentinelOne": "DFI - Malicious PE"
  226. },
  227. {
  228. "Fortinet": "W32/GenKryptik.DKMR!tr"
  229. },
  230. {
  231. "AVG": "Win32:Trojan-gen"
  232. },
  233. {
  234. "Cybereason": "malicious.4200ca"
  235. },
  236. {
  237. "CrowdStrike": "win/malicious_confidence_100% (W)"
  238. }
  239. ]
  240. }
  241. ]
  242.  
  243. [*] Started Service: []
  244.  
  245. [*] Executed Commands: []
  246.  
  247. [*] Mutexes: [
  248. "DBWinMutex"
  249. ]
  250.  
  251. [*] Modified Files: []
  252.  
  253. [*] Deleted Files: []
  254.  
  255. [*] Modified Registry Keys: []
  256.  
  257. [*] Deleted Registry Keys: []
  258.  
  259. [*] DNS Communications: []
  260.  
  261. [*] Domains: []
  262.  
  263. [*] Network Communication - ICMP: []
  264.  
  265. [*] Network Communication - HTTP: [
  266. {
  267. "count": 1,
  268. "body": "",
  269. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  270. "user-agent": "Microsoft-CryptoAPI/6.1",
  271. "method": "GET",
  272. "host": "ocsp.digicert.com",
  273. "version": "1.1",
  274. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  275. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  276. "port": 80
  277. },
  278. {
  279. "count": 1,
  280. "body": "",
  281. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  282. "user-agent": "Microsoft-CryptoAPI/6.1",
  283. "method": "GET",
  284. "host": "ocsp.digicert.com",
  285. "version": "1.1",
  286. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  287. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  288. "port": 80
  289. },
  290. {
  291. "count": 1,
  292. "body": "",
  293. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  294. "user-agent": "Microsoft-CryptoAPI/6.1",
  295. "method": "GET",
  296. "host": "ocsp.digicert.com",
  297. "version": "1.1",
  298. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  299. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  300. "port": 80
  301. },
  302. {
  303. "count": 1,
  304. "body": "",
  305. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  306. "user-agent": "Microsoft-CryptoAPI/6.1",
  307. "method": "GET",
  308. "host": "ocsp.pki.goog",
  309. "version": "1.1",
  310. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  311. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  312. "port": 80
  313. },
  314. {
  315. "count": 1,
  316. "body": "",
  317. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  318. "user-agent": "Microsoft-CryptoAPI/6.1",
  319. "method": "GET",
  320. "host": "ocsp.digicert.com",
  321. "version": "1.1",
  322. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  323. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  324. "port": 80
  325. },
  326. {
  327. "count": 1,
  328. "body": "",
  329. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  330. "user-agent": "Microsoft-CryptoAPI/6.1",
  331. "method": "GET",
  332. "host": "crl.microsoft.com",
  333. "version": "1.1",
  334. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  335. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  336. "port": 80
  337. },
  338. {
  339. "count": 1,
  340. "body": "",
  341. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  342. "user-agent": "Microsoft-CryptoAPI/6.1",
  343. "method": "GET",
  344. "host": "ocsp.comodoca.com",
  345. "version": "1.1",
  346. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  347. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  348. "port": 80
  349. },
  350. {
  351. "count": 1,
  352. "body": "",
  353. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  354. "user-agent": "Microsoft-CryptoAPI/6.1",
  355. "method": "GET",
  356. "host": "ocsp.pki.goog",
  357. "version": "1.1",
  358. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  359. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  360. "port": 80
  361. },
  362. {
  363. "count": 1,
  364. "body": "",
  365. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  366. "user-agent": "Microsoft-CryptoAPI/6.1",
  367. "method": "GET",
  368. "host": "ocsp.digicert.com",
  369. "version": "1.1",
  370. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  371. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  372. "port": 80
  373. },
  374. {
  375. "count": 1,
  376. "body": "",
  377. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  378. "user-agent": "Microsoft-CryptoAPI/6.1",
  379. "method": "GET",
  380. "host": "www.download.windowsupdate.com",
  381. "version": "1.1",
  382. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  383. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  384. "port": 80
  385. },
  386. {
  387. "count": 1,
  388. "body": "",
  389. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  390. "user-agent": "Microsoft-CryptoAPI/6.1",
  391. "method": "GET",
  392. "host": "crl.microsoft.com",
  393. "version": "1.1",
  394. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  395. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  396. "port": 80
  397. },
  398. {
  399. "count": 1,
  400. "body": "",
  401. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  402. "user-agent": "Microsoft-CryptoAPI/6.1",
  403. "method": "GET",
  404. "host": "ocsp.digicert.com",
  405. "version": "1.1",
  406. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  407. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  408. "port": 80
  409. },
  410. {
  411. "count": 1,
  412. "body": "",
  413. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  414. "user-agent": "Microsoft-CryptoAPI/6.1",
  415. "method": "GET",
  416. "host": "ocsp.digicert.com",
  417. "version": "1.1",
  418. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  419. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  420. "port": 80
  421. },
  422. {
  423. "count": 1,
  424. "body": "",
  425. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  426. "user-agent": "Microsoft-CryptoAPI/6.1",
  427. "method": "GET",
  428. "host": "ocsp.digicert.com",
  429. "version": "1.1",
  430. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  431. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  432. "port": 80
  433. },
  434. {
  435. "count": 1,
  436. "body": "",
  437. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  438. "user-agent": "Microsoft-CryptoAPI/6.1",
  439. "method": "GET",
  440. "host": "ocsp.pki.goog",
  441. "version": "1.1",
  442. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  443. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  444. "port": 80
  445. },
  446. {
  447. "count": 1,
  448. "body": "",
  449. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  450. "user-agent": "Microsoft-CryptoAPI/6.1",
  451. "method": "GET",
  452. "host": "ocsp.pki.goog",
  453. "version": "1.1",
  454. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  455. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  456. "port": 80
  457. },
  458. {
  459. "count": 1,
  460. "body": "",
  461. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  462. "user-agent": "Microsoft-CryptoAPI/6.1",
  463. "method": "GET",
  464. "host": "ocsp.digicert.com",
  465. "version": "1.1",
  466. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  467. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  468. "port": 80
  469. },
  470. {
  471. "count": 1,
  472. "body": "",
  473. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  474. "user-agent": "Microsoft-CryptoAPI/6.1",
  475. "method": "GET",
  476. "host": "ocsp.pki.goog",
  477. "version": "1.1",
  478. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  479. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  480. "port": 80
  481. },
  482. {
  483. "count": 1,
  484. "body": "",
  485. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  486. "user-agent": "Microsoft-CryptoAPI/6.1",
  487. "method": "GET",
  488. "host": "ocsp.msocsp.com",
  489. "version": "1.1",
  490. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  491. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  492. "port": 80
  493. },
  494. {
  495. "count": 1,
  496. "body": "",
  497. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  498. "user-agent": "Microsoft-CryptoAPI/6.1",
  499. "method": "GET",
  500. "host": "ocsp.thawte.com",
  501. "version": "1.1",
  502. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  503. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  504. "port": 80
  505. },
  506. {
  507. "count": 1,
  508. "body": "",
  509. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  510. "user-agent": "Microsoft-CryptoAPI/6.1",
  511. "method": "GET",
  512. "host": "ocsp.usertrust.com",
  513. "version": "1.1",
  514. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  515. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  516. "port": 80
  517. },
  518. {
  519. "count": 1,
  520. "body": "",
  521. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  522. "user-agent": "Microsoft-CryptoAPI/6.1",
  523. "method": "GET",
  524. "host": "th.symcd.com",
  525. "version": "1.1",
  526. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  527. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  528. "port": 80
  529. },
  530. {
  531. "count": 1,
  532. "body": "",
  533. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  534. "user-agent": "Microsoft-CryptoAPI/6.1",
  535. "method": "GET",
  536. "host": "ocsp.digicert.com",
  537. "version": "1.1",
  538. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  539. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  540. "port": 80
  541. },
  542. {
  543. "count": 1,
  544. "body": "",
  545. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  546. "user-agent": "Microsoft-CryptoAPI/6.1",
  547. "method": "GET",
  548. "host": "ocsp.digicert.com",
  549. "version": "1.1",
  550. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  551. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  552. "port": 80
  553. },
  554. {
  555. "count": 1,
  556. "body": "",
  557. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  558. "user-agent": "Microsoft-CryptoAPI/6.1",
  559. "method": "GET",
  560. "host": "ocsp.pki.goog",
  561. "version": "1.1",
  562. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  563. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  564. "port": 80
  565. },
  566. {
  567. "count": 1,
  568. "body": "",
  569. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  570. "user-agent": "Microsoft-CryptoAPI/6.1",
  571. "method": "GET",
  572. "host": "crl.microsoft.com",
  573. "version": "1.1",
  574. "path": "/pki/crl/products/microsoftrootcert.crl",
  575. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  576. "port": 80
  577. },
  578. {
  579. "count": 1,
  580. "body": "",
  581. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  582. "user-agent": "Microsoft BITS/7.5",
  583. "method": "HEAD",
  584. "host": "redirector.gvt1.com",
  585. "version": "1.1",
  586. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  587. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  588. "port": 80
  589. },
  590. {
  591. "count": 1,
  592. "body": "",
  593. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  594. "user-agent": "Microsoft BITS/7.5",
  595. "method": "HEAD",
  596. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  597. "version": "1.1",
  598. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  599. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  600. "port": 80
  601. },
  602. {
  603. "count": 1,
  604. "body": "",
  605. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  606. "user-agent": "Microsoft BITS/7.5",
  607. "method": "GET",
  608. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  609. "version": "1.1",
  610. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  611. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-6415\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  612. "port": 80
  613. },
  614. {
  615. "count": 1,
  616. "body": "",
  617. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  618. "user-agent": "Microsoft BITS/7.5",
  619. "method": "GET",
  620. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  621. "version": "1.1",
  622. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  623. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6416-15275\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  624. "port": 80
  625. },
  626. {
  627. "count": 1,
  628. "body": "",
  629. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  630. "user-agent": "Microsoft BITS/7.5",
  631. "method": "GET",
  632. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  633. "version": "1.1",
  634. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  635. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=15276-26143\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  636. "port": 80
  637. },
  638. {
  639. "count": 1,
  640. "body": "",
  641. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  642. "user-agent": "Microsoft BITS/7.5",
  643. "method": "GET",
  644. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  645. "version": "1.1",
  646. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  647. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=26144-43693\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  648. "port": 80
  649. },
  650. {
  651. "count": 1,
  652. "body": "",
  653. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  654. "user-agent": "Microsoft BITS/7.5",
  655. "method": "GET",
  656. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  657. "version": "1.1",
  658. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  659. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=43694-65245\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  660. "port": 80
  661. },
  662. {
  663. "count": 1,
  664. "body": "",
  665. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  666. "user-agent": "Microsoft BITS/7.5",
  667. "method": "GET",
  668. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  669. "version": "1.1",
  670. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  671. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=65246-109665\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  672. "port": 80
  673. },
  674. {
  675. "count": 1,
  676. "body": "",
  677. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  678. "user-agent": "Microsoft BITS/7.5",
  679. "method": "GET",
  680. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  681. "version": "1.1",
  682. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  683. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=109666-199214\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  684. "port": 80
  685. },
  686. {
  687. "count": 1,
  688. "body": "",
  689. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  690. "user-agent": "Microsoft BITS/7.5",
  691. "method": "GET",
  692. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  693. "version": "1.1",
  694. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  695. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=199215-326389\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  696. "port": 80
  697. },
  698. {
  699. "count": 1,
  700. "body": "",
  701. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  702. "user-agent": "Microsoft BITS/7.5",
  703. "method": "GET",
  704. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  705. "version": "1.1",
  706. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  707. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=326390-687253\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  708. "port": 80
  709. },
  710. {
  711. "count": 1,
  712. "body": "",
  713. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  714. "user-agent": "Microsoft BITS/7.5",
  715. "method": "GET",
  716. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  717. "version": "1.1",
  718. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  719. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=687254-1348095\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  720. "port": 80
  721. },
  722. {
  723. "count": 1,
  724. "body": "",
  725. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  726. "user-agent": "Microsoft BITS/7.5",
  727. "method": "GET",
  728. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  729. "version": "1.1",
  730. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  731. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1348096-2753867\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  732. "port": 80
  733. },
  734. {
  735. "count": 1,
  736. "body": "",
  737. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  738. "user-agent": "Microsoft BITS/7.5",
  739. "method": "GET",
  740. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  741. "version": "1.1",
  742. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  743. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2753868-5571007\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  744. "port": 80
  745. },
  746. {
  747. "count": 1,
  748. "body": "",
  749. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  750. "user-agent": "Microsoft BITS/7.5",
  751. "method": "GET",
  752. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  753. "version": "1.1",
  754. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  755. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5571008-11319570\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  756. "port": 80
  757. },
  758. {
  759. "count": 1,
  760. "body": "",
  761. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  762. "user-agent": "Microsoft BITS/7.5",
  763. "method": "GET",
  764. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  765. "version": "1.1",
  766. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes",
  767. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560482384&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=11319571-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  768. "port": 80
  769. }
  770. ]
  771.  
  772. [*] Network Communication - SMTP: []
  773.  
  774. [*] Network Communication - Hosts: []
  775.  
  776. [*] Network Communication - IRC: []
  777.  
  778. [*] Static Analysis: {
  779. "pe": {
  780. "peid_signatures": null,
  781. "imports": [
  782. {
  783. "imports": [
  784. {
  785. "name": "I_RpcBindingIsClientLocal",
  786. "address": "0xa01805c"
  787. }
  788. ],
  789. "dll": "RPCRT4.dll"
  790. },
  791. {
  792. "imports": [
  793. {
  794. "name": "CreateURLMoniker",
  795. "address": "0xa018094"
  796. }
  797. ],
  798. "dll": "urlmon.dll"
  799. },
  800. {
  801. "imports": [
  802. {
  803. "name": "GetCurrentProcess",
  804. "address": "0xa018024"
  805. },
  806. {
  807. "name": "GetProcessIoCounters",
  808. "address": "0xa018028"
  809. },
  810. {
  811. "name": "GetCommandLineA",
  812. "address": "0xa01802c"
  813. },
  814. {
  815. "name": "SetConsoleCP",
  816. "address": "0xa018030"
  817. },
  818. {
  819. "name": "GetPriorityClass",
  820. "address": "0xa018034"
  821. },
  822. {
  823. "name": "GetLogicalDrives",
  824. "address": "0xa018038"
  825. },
  826. {
  827. "name": "HeapSize",
  828. "address": "0xa01803c"
  829. },
  830. {
  831. "name": "CancelIo",
  832. "address": "0xa018040"
  833. }
  834. ],
  835. "dll": "KERNEL32.dll"
  836. },
  837. {
  838. "imports": [
  839. {
  840. "name": "GetIpForwardTable",
  841. "address": "0xa01801c"
  842. }
  843. ],
  844. "dll": "IPHLPAPI.DLL"
  845. },
  846. {
  847. "imports": [
  848. {
  849. "name": "SysStringLen",
  850. "address": "0xa018050"
  851. },
  852. {
  853. "name": "VarI2FromR4",
  854. "address": "0xa018054"
  855. }
  856. ],
  857. "dll": "OLEAUT32.dll"
  858. },
  859. {
  860. "imports": [
  861. {
  862. "name": "UnlockUrlCacheEntryStream",
  863. "address": "0xa01808c"
  864. }
  865. ],
  866. "dll": "WININET.dll"
  867. },
  868. {
  869. "imports": [
  870. {
  871. "name": "GetClipCursor",
  872. "address": "0xa018064"
  873. },
  874. {
  875. "name": "GetSubMenu",
  876. "address": "0xa018068"
  877. },
  878. {
  879. "name": "LockWindowUpdate",
  880. "address": "0xa01806c"
  881. },
  882. {
  883. "name": "DestroyCursor",
  884. "address": "0xa018070"
  885. },
  886. {
  887. "name": "GetClipboardSequenceNumber",
  888. "address": "0xa018074"
  889. },
  890. {
  891. "name": "SendDlgItemMessageA",
  892. "address": "0xa018078"
  893. },
  894. {
  895. "name": "ToAsciiEx",
  896. "address": "0xa01807c"
  897. },
  898. {
  899. "name": "EndPaint",
  900. "address": "0xa018080"
  901. },
  902. {
  903. "name": "ChangeMenuW",
  904. "address": "0xa018084"
  905. }
  906. ],
  907. "dll": "USER32.dll"
  908. },
  909. {
  910. "imports": [
  911. {
  912. "name": "NetShareEnum",
  913. "address": "0xa018048"
  914. }
  915. ],
  916. "dll": "NETAPI32.dll"
  917. },
  918. {
  919. "imports": [
  920. {
  921. "name": "RegQueryValueExA",
  922. "address": "0xa018000"
  923. },
  924. {
  925. "name": "RegOpenKeyW",
  926. "address": "0xa018004"
  927. },
  928. {
  929. "name": "GetSecurityDescriptorDacl",
  930. "address": "0xa018008"
  931. }
  932. ],
  933. "dll": "ADVAPI32.dll"
  934. },
  935. {
  936. "imports": [
  937. {
  938. "name": "RoundRect",
  939. "address": "0xa018010"
  940. },
  941. {
  942. "name": "GetRandomRgn",
  943. "address": "0xa018014"
  944. }
  945. ],
  946. "dll": "GDI32.dll"
  947. }
  948. ],
  949. "digital_signers": null,
  950. "exported_dll_name": null,
  951. "actual_checksum": "0x00035b52",
  952. "overlay": null,
  953. "imagebase": "0x0a000000",
  954. "reported_checksum": "0x00000000",
  955. "icon_hash": null,
  956. "entrypoint": "0x0a001f60",
  957. "timestamp": "2019-06-13 13:14:03",
  958. "osversion": "5.0",
  959. "sections": [
  960. {
  961. "name": ".text",
  962. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  963. "virtual_address": "0x00001000",
  964. "size_of_data": "0x00003000",
  965. "entropy": "5.02",
  966. "raw_address": "0x00001000",
  967. "virtual_size": "0x000021ae",
  968. "characteristics_raw": "0x60000020"
  969. },
  970. {
  971. "name": ".data",
  972. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  973. "virtual_address": "0x00004000",
  974. "size_of_data": "0x00014000",
  975. "entropy": "5.09",
  976. "raw_address": "0x00004000",
  977. "virtual_size": "0x00013fd1",
  978. "characteristics_raw": "0xc0000040"
  979. },
  980. {
  981. "name": ".idata",
  982. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  983. "virtual_address": "0x00018000",
  984. "size_of_data": "0x00008000",
  985. "entropy": "7.84",
  986. "raw_address": "0x00018000",
  987. "virtual_size": "0x00007d99",
  988. "characteristics_raw": "0x40000040"
  989. },
  990. {
  991. "name": ".rdata0",
  992. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  993. "virtual_address": "0x00020000",
  994. "size_of_data": "0x00010000",
  995. "entropy": "7.82",
  996. "raw_address": "0x00020000",
  997. "virtual_size": "0x0000f097",
  998. "characteristics_raw": "0xc0000040"
  999. },
  1000. {
  1001. "name": ".rsrc",
  1002. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1003. "virtual_address": "0x00030000",
  1004. "size_of_data": "0x00001000",
  1005. "entropy": "0.97",
  1006. "raw_address": "0x00030000",
  1007. "virtual_size": "0x000003a0",
  1008. "characteristics_raw": "0x40000040"
  1009. },
  1010. {
  1011. "name": ".reloc",
  1012. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1013. "virtual_address": "0x00031000",
  1014. "size_of_data": "0x00001000",
  1015. "entropy": "0.59",
  1016. "raw_address": "0x00031000",
  1017. "virtual_size": "0x000000f8",
  1018. "characteristics_raw": "0x42000040"
  1019. }
  1020. ],
  1021. "resources": [],
  1022. "dirents": [
  1023. {
  1024. "virtual_address": "0x00000000",
  1025. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1026. "size": "0x00000000"
  1027. },
  1028. {
  1029. "virtual_address": "0x0001f664",
  1030. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1031. "size": "0x000000dc"
  1032. },
  1033. {
  1034. "virtual_address": "0x00030000",
  1035. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1036. "size": "0x000003a0"
  1037. },
  1038. {
  1039. "virtual_address": "0x00000000",
  1040. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1041. "size": "0x00000000"
  1042. },
  1043. {
  1044. "virtual_address": "0x00000000",
  1045. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1046. "size": "0x00000000"
  1047. },
  1048. {
  1049. "virtual_address": "0x00031000",
  1050. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1051. "size": "0x000000f8"
  1052. },
  1053. {
  1054. "virtual_address": "0x0001f420",
  1055. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1056. "size": "0x00000038"
  1057. },
  1058. {
  1059. "virtual_address": "0x00000000",
  1060. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1061. "size": "0x00000000"
  1062. },
  1063. {
  1064. "virtual_address": "0x00000000",
  1065. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1066. "size": "0x00000000"
  1067. },
  1068. {
  1069. "virtual_address": "0x00000000",
  1070. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1071. "size": "0x00000000"
  1072. },
  1073. {
  1074. "virtual_address": "0x00000000",
  1075. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1076. "size": "0x00000000"
  1077. },
  1078. {
  1079. "virtual_address": "0x00000000",
  1080. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1081. "size": "0x00000000"
  1082. },
  1083. {
  1084. "virtual_address": "0x00018000",
  1085. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1086. "size": "0x0000009c"
  1087. },
  1088. {
  1089. "virtual_address": "0x00000000",
  1090. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1091. "size": "0x00000000"
  1092. },
  1093. {
  1094. "virtual_address": "0x00000000",
  1095. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1096. "size": "0x00000000"
  1097. },
  1098. {
  1099. "virtual_address": "0x00000000",
  1100. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1101. "size": "0x00000000"
  1102. }
  1103. ],
  1104. "exports": [],
  1105. "guest_signers": {},
  1106. "imphash": "1696b7fd0f4c3a18dafe6f9660993e15",
  1107. "icon_fuzzy": null,
  1108. "icon": null,
  1109. "pdbpath": null,
  1110. "imported_dll_count": 10,
  1111. "versioninfo": []
  1112. }
  1113. }
  1114.  
  1115. [*] Resolved APIs: [
  1116. "kernel32.dll.VirtualAlloc",
  1117. "kernel32.dll.VirtualProtect",
  1118. "kernel32.dll.LoadLibraryA",
  1119. "kernel32.dll.GetProcAddress",
  1120. "kernel32.dll.FreeConsole",
  1121. "kernel32.dll.Sleep",
  1122. "kernel32.dll.OutputDebugStringW"
  1123. ]
  1124.  
  1125. [*] Static Analysis: {
  1126. "pe": {
  1127. "peid_signatures": null,
  1128. "imports": [
  1129. {
  1130. "imports": [
  1131. {
  1132. "name": "I_RpcBindingIsClientLocal",
  1133. "address": "0xa01805c"
  1134. }
  1135. ],
  1136. "dll": "RPCRT4.dll"
  1137. },
  1138. {
  1139. "imports": [
  1140. {
  1141. "name": "CreateURLMoniker",
  1142. "address": "0xa018094"
  1143. }
  1144. ],
  1145. "dll": "urlmon.dll"
  1146. },
  1147. {
  1148. "imports": [
  1149. {
  1150. "name": "GetCurrentProcess",
  1151. "address": "0xa018024"
  1152. },
  1153. {
  1154. "name": "GetProcessIoCounters",
  1155. "address": "0xa018028"
  1156. },
  1157. {
  1158. "name": "GetCommandLineA",
  1159. "address": "0xa01802c"
  1160. },
  1161. {
  1162. "name": "SetConsoleCP",
  1163. "address": "0xa018030"
  1164. },
  1165. {
  1166. "name": "GetPriorityClass",
  1167. "address": "0xa018034"
  1168. },
  1169. {
  1170. "name": "GetLogicalDrives",
  1171. "address": "0xa018038"
  1172. },
  1173. {
  1174. "name": "HeapSize",
  1175. "address": "0xa01803c"
  1176. },
  1177. {
  1178. "name": "CancelIo",
  1179. "address": "0xa018040"
  1180. }
  1181. ],
  1182. "dll": "KERNEL32.dll"
  1183. },
  1184. {
  1185. "imports": [
  1186. {
  1187. "name": "GetIpForwardTable",
  1188. "address": "0xa01801c"
  1189. }
  1190. ],
  1191. "dll": "IPHLPAPI.DLL"
  1192. },
  1193. {
  1194. "imports": [
  1195. {
  1196. "name": "SysStringLen",
  1197. "address": "0xa018050"
  1198. },
  1199. {
  1200. "name": "VarI2FromR4",
  1201. "address": "0xa018054"
  1202. }
  1203. ],
  1204. "dll": "OLEAUT32.dll"
  1205. },
  1206. {
  1207. "imports": [
  1208. {
  1209. "name": "UnlockUrlCacheEntryStream",
  1210. "address": "0xa01808c"
  1211. }
  1212. ],
  1213. "dll": "WININET.dll"
  1214. },
  1215. {
  1216. "imports": [
  1217. {
  1218. "name": "GetClipCursor",
  1219. "address": "0xa018064"
  1220. },
  1221. {
  1222. "name": "GetSubMenu",
  1223. "address": "0xa018068"
  1224. },
  1225. {
  1226. "name": "LockWindowUpdate",
  1227. "address": "0xa01806c"
  1228. },
  1229. {
  1230. "name": "DestroyCursor",
  1231. "address": "0xa018070"
  1232. },
  1233. {
  1234. "name": "GetClipboardSequenceNumber",
  1235. "address": "0xa018074"
  1236. },
  1237. {
  1238. "name": "SendDlgItemMessageA",
  1239. "address": "0xa018078"
  1240. },
  1241. {
  1242. "name": "ToAsciiEx",
  1243. "address": "0xa01807c"
  1244. },
  1245. {
  1246. "name": "EndPaint",
  1247. "address": "0xa018080"
  1248. },
  1249. {
  1250. "name": "ChangeMenuW",
  1251. "address": "0xa018084"
  1252. }
  1253. ],
  1254. "dll": "USER32.dll"
  1255. },
  1256. {
  1257. "imports": [
  1258. {
  1259. "name": "NetShareEnum",
  1260. "address": "0xa018048"
  1261. }
  1262. ],
  1263. "dll": "NETAPI32.dll"
  1264. },
  1265. {
  1266. "imports": [
  1267. {
  1268. "name": "RegQueryValueExA",
  1269. "address": "0xa018000"
  1270. },
  1271. {
  1272. "name": "RegOpenKeyW",
  1273. "address": "0xa018004"
  1274. },
  1275. {
  1276. "name": "GetSecurityDescriptorDacl",
  1277. "address": "0xa018008"
  1278. }
  1279. ],
  1280. "dll": "ADVAPI32.dll"
  1281. },
  1282. {
  1283. "imports": [
  1284. {
  1285. "name": "RoundRect",
  1286. "address": "0xa018010"
  1287. },
  1288. {
  1289. "name": "GetRandomRgn",
  1290. "address": "0xa018014"
  1291. }
  1292. ],
  1293. "dll": "GDI32.dll"
  1294. }
  1295. ],
  1296. "digital_signers": null,
  1297. "exported_dll_name": null,
  1298. "actual_checksum": "0x00035b52",
  1299. "overlay": null,
  1300. "imagebase": "0x0a000000",
  1301. "reported_checksum": "0x00000000",
  1302. "icon_hash": null,
  1303. "entrypoint": "0x0a001f60",
  1304. "timestamp": "2019-06-13 13:14:03",
  1305. "osversion": "5.0",
  1306. "sections": [
  1307. {
  1308. "name": ".text",
  1309. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  1310. "virtual_address": "0x00001000",
  1311. "size_of_data": "0x00003000",
  1312. "entropy": "5.02",
  1313. "raw_address": "0x00001000",
  1314. "virtual_size": "0x000021ae",
  1315. "characteristics_raw": "0x60000020"
  1316. },
  1317. {
  1318. "name": ".data",
  1319. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1320. "virtual_address": "0x00004000",
  1321. "size_of_data": "0x00014000",
  1322. "entropy": "5.09",
  1323. "raw_address": "0x00004000",
  1324. "virtual_size": "0x00013fd1",
  1325. "characteristics_raw": "0xc0000040"
  1326. },
  1327. {
  1328. "name": ".idata",
  1329. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1330. "virtual_address": "0x00018000",
  1331. "size_of_data": "0x00008000",
  1332. "entropy": "7.84",
  1333. "raw_address": "0x00018000",
  1334. "virtual_size": "0x00007d99",
  1335. "characteristics_raw": "0x40000040"
  1336. },
  1337. {
  1338. "name": ".rdata0",
  1339. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1340. "virtual_address": "0x00020000",
  1341. "size_of_data": "0x00010000",
  1342. "entropy": "7.82",
  1343. "raw_address": "0x00020000",
  1344. "virtual_size": "0x0000f097",
  1345. "characteristics_raw": "0xc0000040"
  1346. },
  1347. {
  1348. "name": ".rsrc",
  1349. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  1350. "virtual_address": "0x00030000",
  1351. "size_of_data": "0x00001000",
  1352. "entropy": "0.97",
  1353. "raw_address": "0x00030000",
  1354. "virtual_size": "0x000003a0",
  1355. "characteristics_raw": "0x40000040"
  1356. },
  1357. {
  1358. "name": ".reloc",
  1359. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ",
  1360. "virtual_address": "0x00031000",
  1361. "size_of_data": "0x00001000",
  1362. "entropy": "0.59",
  1363. "raw_address": "0x00031000",
  1364. "virtual_size": "0x000000f8",
  1365. "characteristics_raw": "0x42000040"
  1366. }
  1367. ],
  1368. "resources": [],
  1369. "dirents": [
  1370. {
  1371. "virtual_address": "0x00000000",
  1372. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1373. "size": "0x00000000"
  1374. },
  1375. {
  1376. "virtual_address": "0x0001f664",
  1377. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1378. "size": "0x000000dc"
  1379. },
  1380. {
  1381. "virtual_address": "0x00030000",
  1382. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1383. "size": "0x000003a0"
  1384. },
  1385. {
  1386. "virtual_address": "0x00000000",
  1387. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  1388. "size": "0x00000000"
  1389. },
  1390. {
  1391. "virtual_address": "0x00000000",
  1392. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  1393. "size": "0x00000000"
  1394. },
  1395. {
  1396. "virtual_address": "0x00031000",
  1397. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  1398. "size": "0x000000f8"
  1399. },
  1400. {
  1401. "virtual_address": "0x0001f420",
  1402. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  1403. "size": "0x00000038"
  1404. },
  1405. {
  1406. "virtual_address": "0x00000000",
  1407. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  1408. "size": "0x00000000"
  1409. },
  1410. {
  1411. "virtual_address": "0x00000000",
  1412. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  1413. "size": "0x00000000"
  1414. },
  1415. {
  1416. "virtual_address": "0x00000000",
  1417. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  1418. "size": "0x00000000"
  1419. },
  1420. {
  1421. "virtual_address": "0x00000000",
  1422. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  1423. "size": "0x00000000"
  1424. },
  1425. {
  1426. "virtual_address": "0x00000000",
  1427. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  1428. "size": "0x00000000"
  1429. },
  1430. {
  1431. "virtual_address": "0x00018000",
  1432. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  1433. "size": "0x0000009c"
  1434. },
  1435. {
  1436. "virtual_address": "0x00000000",
  1437. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  1438. "size": "0x00000000"
  1439. },
  1440. {
  1441. "virtual_address": "0x00000000",
  1442. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  1443. "size": "0x00000000"
  1444. },
  1445. {
  1446. "virtual_address": "0x00000000",
  1447. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  1448. "size": "0x00000000"
  1449. }
  1450. ],
  1451. "exports": [],
  1452. "guest_signers": {},
  1453. "imphash": "1696b7fd0f4c3a18dafe6f9660993e15",
  1454. "icon_fuzzy": null,
  1455. "icon": null,
  1456. "pdbpath": null,
  1457. "imported_dll_count": 10,
  1458. "versioninfo": []
  1459. }
  1460. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!