API tools faq
paste
paladin316

Exes_bd3c8f41a2fc036bfe5f2f47518af5be_exe.json

paladin316
Jun 19th, 2019
2,187
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 165.01 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_bd3c8f41a2fc036bfe5f2f47518af5be.exe"
  7. [*] File Size: 747008
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. [*] SHA256: "b8a7d0d7dd9dbe7b04532557cf87d313e6dac6247599c72010ca462644490eb5"
  10. [*] MD5: "bd3c8f41a2fc036bfe5f2f47518af5be"
  11. [*] SHA1: "9675fd0c64a710c74cc8be8ae53ac5c2866c37b3"
  12. [*] SHA512: "1dc634b710544d9ca38bc7fc52eaf7144e0460e521028f62e5468bcfd490744aa240abcd8c7e15b4a6cbbd0600df4d89dd664a176eb733d18a8ae91eaa299b8a"
  13. [*] CRC32: "BF7B7516"
  14. [*] SSDEEP: "12288:luIy9lUmIdvEKaXNlEKFbnEHPHG2OR4TkXgiXPj7/w2g41Jf2DsG:luIyLUHdvEZXTEbG2TYQi/vVBG"
  15.  
  16. [*] Process Execution: [
  17. "Exes_bd3c8f41a2fc036bfe5f2f47518af5be.exe",
  18. "ilbskj.exe",
  19. "notepad.exe",
  20. "notepad.exe"
  21. ]
  22.  
  23. [*] Signatures Detected: [
  24. {
  25. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  26. "Details": [
  27. {
  28. "IP": "193.56.28.18:1991"
  29. }
  30. ]
  31. },
  32. {
  33. "Description": "Creates RWX memory",
  34. "Details": []
  35. },
  36. {
  37. "Description": "Reads data out of its own binary image",
  38. "Details": [
  39. {
  40. "self_read": "process: notepad.exe, pid: 1808, offset: 0x00000000, length: 0x0002be00"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "Drops a binary and executes it",
  46. "Details": [
  47. {
  48. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\ilbskj.exe"
  49. }
  50. ]
  51. },
  52. {
  53. "Description": "Performs some HTTP requests",
  54. "Details": [
  55. {
  56. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  57. },
  58. {
  59. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  60. },
  61. {
  62. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  63. },
  64. {
  65. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  66. },
  67. {
  68. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  69. },
  70. {
  71. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  72. },
  73. {
  74. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  75. },
  76. {
  77. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  78. },
  79. {
  80. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  81. },
  82. {
  83. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  84. },
  85. {
  86. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  87. },
  88. {
  89. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  90. },
  91. {
  92. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  93. },
  94. {
  95. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  96. },
  97. {
  98. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  99. },
  100. {
  101. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  102. },
  103. {
  104. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  105. },
  106. {
  107. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  108. },
  109. {
  110. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  111. },
  112. {
  113. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  114. },
  115. {
  116. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  117. },
  118. {
  119. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  120. },
  121. {
  122. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  123. },
  124. {
  125. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  126. },
  127. {
  128. "url": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes"
  129. }
  130. ]
  131. },
  132. {
  133. "Description": "Unconventionial language used in binary resources: Arabic (Egypt)",
  134. "Details": []
  135. },
  136. {
  137. "Description": "The binary likely contains encrypted or compressed data.",
  138. "Details": [
  139. {
  140. "section": "name: UPX1, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000a4400, virtual_size: 0x000a5000"
  141. }
  142. ]
  143. },
  144. {
  145. "Description": "The executable is compressed using UPX",
  146. "Details": [
  147. {
  148. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00105000"
  149. }
  150. ]
  151. },
  152. {
  153. "Description": "Executed a process and injected code into it, probably while unpacking",
  154. "Details": [
  155. {
  156. "Injection": "notepad.exe(1420) -> notepad.exe(1808)"
  157. }
  158. ]
  159. },
  160. {
  161. "Description": "Sniffs keystrokes",
  162. "Details": [
  163. {
  164. "SetWindowsHookExA": "Process: notepad.exe(1808)"
  165. }
  166. ]
  167. },
  168. {
  169. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  170. "Details": [
  171. {
  172. "Process": "notepad.exe tried to sleep 8274 seconds, actually delayed analysis time by 0 seconds"
  173. }
  174. ]
  175. },
  176. {
  177. "Description": "Installs itself for autorun at Windows startup",
  178. "Details": [
  179. {
  180. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ilbskj"
  181. },
  182. {
  183. "data": "C:\\Users\\user\\AppData\\Local\\ilbskj\\ilbskj.vbs"
  184. }
  185. ]
  186. },
  187. {
  188. "Description": "File has been identified by 39 Antiviruses on VirusTotal as malicious",
  189. "Details": [
  190. {
  191. "MicroWorld-eScan": "Trojan.GenericKD.32058966"
  192. },
  193. {
  194. "ALYac": "Trojan.GenericKD.32058966"
  195. },
  196. {
  197. "Malwarebytes": "Backdoor.Remcos"
  198. },
  199. {
  200. "K7AntiVirus": "Trojan ( 0055021a1 )"
  201. },
  202. {
  203. "Alibaba": "TrojanDropper:Win32/Buzus.b3dec3e3"
  204. },
  205. {
  206. "K7GW": "Trojan ( 0055021a1 )"
  207. },
  208. {
  209. "NANO-Antivirus": "Trojan.Win32.Buzus.frigeq"
  210. },
  211. {
  212. "Cyren": "W32/Trojan.DERN-4760"
  213. },
  214. {
  215. "ESET-NOD32": "Win32/TrojanDropper.Delf.OTN"
  216. },
  217. {
  218. "Paloalto": "generic.ml"
  219. },
  220. {
  221. "ClamAV": "Win.Dropper.Delf-6994075-0"
  222. },
  223. {
  224. "Kaspersky": "HEUR:Trojan.Win32.Buzus.gen"
  225. },
  226. {
  227. "BitDefender": "Trojan.GenericKD.32058966"
  228. },
  229. {
  230. "ViRobot": "Trojan.Win32.Z.Remcos.747008"
  231. },
  232. {
  233. "AegisLab": "Trojan.Win32.Buzus.4!c"
  234. },
  235. {
  236. "Rising": "Backdoor.Rescoms!8.B8A4 (CLOUD)"
  237. },
  238. {
  239. "Sophos": "Mal/Generic-S"
  240. },
  241. {
  242. "F-Secure": "Trojan.TR/Drop.Agent.osihs"
  243. },
  244. {
  245. "VIPRE": "Trojan.Win32.Generic.pak!cobra"
  246. },
  247. {
  248. "Invincea": "heuristic"
  249. },
  250. {
  251. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.bc"
  252. },
  253. {
  254. "Emsisoft": "Trojan.GenericKD.32058966 (B)"
  255. },
  256. {
  257. "Ikarus": "Trojan.Inject"
  258. },
  259. {
  260. "Antiy-AVL": "Trojan/Win32.Buzus"
  261. },
  262. {
  263. "Microsoft": "Trojan:Win32/Remcos.SE!MTB"
  264. },
  265. {
  266. "Arcabit": "Trojan.Generic.D1E92E56"
  267. },
  268. {
  269. "ZoneAlarm": "HEUR:Trojan.Win32.Buzus.gen"
  270. },
  271. {
  272. "GData": "Trojan.GenericKD.32058966"
  273. },
  274. {
  275. "McAfee": "RDN/Generic.hbg"
  276. },
  277. {
  278. "VBA32": "TScope.Trojan.Delf"
  279. },
  280. {
  281. "Panda": "Trj/CI.A"
  282. },
  283. {
  284. "Yandex": "Trojan.Buzus!UsSmBFfH2CQ"
  285. },
  286. {
  287. "SentinelOne": "DFI - Suspicious PE"
  288. },
  289. {
  290. "Fortinet": "W32/Injector.EFPU!tr"
  291. },
  292. {
  293. "Ad-Aware": "Trojan.GenericKD.32058966"
  294. },
  295. {
  296. "AVG": "FileRepMalware"
  297. },
  298. {
  299. "Avast": "FileRepMalware"
  300. },
  301. {
  302. "CrowdStrike": "win/malicious_confidence_60% (W)"
  303. },
  304. {
  305. "Qihoo-360": "Win32/Trojan.692"
  306. }
  307. ]
  308. },
  309. {
  310. "Description": "Anomalous binary characteristics",
  311. "Details": [
  312. {
  313. "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year"
  314. }
  315. ]
  316. }
  317. ]
  318.  
  319. [*] Started Service: []
  320.  
  321. [*] Executed Commands: [
  322. "C:\\Users\\user\\AppData\\Local\\Temp\\ilbskj.exe",
  323. "notepad.exe",
  324. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
  325. ]
  326.  
  327. [*] Mutexes: [
  328. "Remcos_Mutex_Inj",
  329. "Cisco-TM09MR"
  330. ]
  331.  
  332. [*] Modified Files: [
  333. "C:\\Users\\user\\AppData\\Local\\Temp\\ilbskj.bmp",
  334. "C:\\Users\\user\\AppData\\Local\\Temp\\ilbskj.exe",
  335. "C:\\Users\\user\\AppData\\Local\\ilbskj\\ilbskj.exe",
  336. "C:\\Users\\user\\AppData\\Local\\ilbskj\\ilbskj.bmp",
  337. "C:\\Users\\user\\AppData\\Local\\ilbskj\\ilbskj.vbs",
  338. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_230621.png",
  339. "C:\\Users\\user\\AppData\\Roaming\\remcos\\logs.dat",
  340. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_231121.png",
  341. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_231621.png",
  342. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_232141.png",
  343. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_232641.png",
  344. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_233141.png",
  345. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_233641.png",
  346. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_234141.png",
  347. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_234641.png",
  348. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_235142.png",
  349. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190618_235642.png",
  350. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_000142.png",
  351. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_000642.png",
  352. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_001142.png",
  353. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_001642.png",
  354. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_002142.png",
  355. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_002642.png",
  356. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_003142.png",
  357. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_003643.png",
  358. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_004143.png",
  359. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_004643.png",
  360. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_005143.png",
  361. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_005643.png",
  362. "C:\\Users\\user\\AppData\\Roaming\\Screenshots\\time_20190619_010143.png"
  363. ]
  364.  
  365. [*] Deleted Files: [
  366. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  367. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies",
  368. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  369. ]
  370.  
  371. [*] Modified Registry Keys: [
  372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ilbskj",
  373. "HKEY_CURRENT_USER\\Software\\Cisco-TM09MR\\",
  374. "HKEY_CURRENT_USER\\Software\\Cisco-TM09MR\\exepath",
  375. "HKEY_CURRENT_USER\\Software\\Cisco-TM09MR\\licence",
  376. "HKEY_CURRENT_USER\\Software\\Cisco-TM09MR\\FR"
  377. ]
  378.  
  379. [*] Deleted Registry Keys: []
  380.  
  381. [*] DNS Communications: []
  382.  
  383. [*] Domains: []
  384.  
  385. [*] Network Communication - ICMP: []
  386.  
  387. [*] Network Communication - HTTP: [
  388. {
  389. "count": 1,
  390. "body": "",
  391. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  392. "user-agent": "Microsoft-CryptoAPI/6.1",
  393. "method": "GET",
  394. "host": "ocsp.digicert.com",
  395. "version": "1.1",
  396. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  397. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  398. "port": 80
  399. },
  400. {
  401. "count": 1,
  402. "body": "",
  403. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  404. "user-agent": "Microsoft-CryptoAPI/6.1",
  405. "method": "GET",
  406. "host": "ocsp.digicert.com",
  407. "version": "1.1",
  408. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  409. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  410. "port": 80
  411. },
  412. {
  413. "count": 1,
  414. "body": "",
  415. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  416. "user-agent": "Microsoft-CryptoAPI/6.1",
  417. "method": "GET",
  418. "host": "ocsp.digicert.com",
  419. "version": "1.1",
  420. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  421. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  422. "port": 80
  423. },
  424. {
  425. "count": 1,
  426. "body": "",
  427. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  428. "user-agent": "Microsoft-CryptoAPI/6.1",
  429. "method": "GET",
  430. "host": "ocsp.pki.goog",
  431. "version": "1.1",
  432. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  433. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  434. "port": 80
  435. },
  436. {
  437. "count": 1,
  438. "body": "",
  439. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  440. "user-agent": "Microsoft-CryptoAPI/6.1",
  441. "method": "GET",
  442. "host": "ocsp.digicert.com",
  443. "version": "1.1",
  444. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  445. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  446. "port": 80
  447. },
  448. {
  449. "count": 1,
  450. "body": "",
  451. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  452. "user-agent": "Microsoft-CryptoAPI/6.1",
  453. "method": "GET",
  454. "host": "crl.microsoft.com",
  455. "version": "1.1",
  456. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  457. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  458. "port": 80
  459. },
  460. {
  461. "count": 1,
  462. "body": "",
  463. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  464. "user-agent": "Microsoft-CryptoAPI/6.1",
  465. "method": "GET",
  466. "host": "ocsp.comodoca.com",
  467. "version": "1.1",
  468. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  469. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  470. "port": 80
  471. },
  472. {
  473. "count": 1,
  474. "body": "",
  475. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  476. "user-agent": "Microsoft-CryptoAPI/6.1",
  477. "method": "GET",
  478. "host": "ocsp.pki.goog",
  479. "version": "1.1",
  480. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  481. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  482. "port": 80
  483. },
  484. {
  485. "count": 1,
  486. "body": "",
  487. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  488. "user-agent": "Microsoft-CryptoAPI/6.1",
  489. "method": "GET",
  490. "host": "ocsp.digicert.com",
  491. "version": "1.1",
  492. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  493. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  494. "port": 80
  495. },
  496. {
  497. "count": 1,
  498. "body": "",
  499. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  500. "user-agent": "Microsoft-CryptoAPI/6.1",
  501. "method": "GET",
  502. "host": "www.download.windowsupdate.com",
  503. "version": "1.1",
  504. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  505. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  506. "port": 80
  507. },
  508. {
  509. "count": 1,
  510. "body": "",
  511. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  512. "user-agent": "Microsoft-CryptoAPI/6.1",
  513. "method": "GET",
  514. "host": "crl.microsoft.com",
  515. "version": "1.1",
  516. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  517. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  518. "port": 80
  519. },
  520. {
  521. "count": 1,
  522. "body": "",
  523. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  524. "user-agent": "Microsoft-CryptoAPI/6.1",
  525. "method": "GET",
  526. "host": "ocsp.digicert.com",
  527. "version": "1.1",
  528. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  529. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  530. "port": 80
  531. },
  532. {
  533. "count": 1,
  534. "body": "",
  535. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  536. "user-agent": "Microsoft-CryptoAPI/6.1",
  537. "method": "GET",
  538. "host": "ocsp.digicert.com",
  539. "version": "1.1",
  540. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  541. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  542. "port": 80
  543. },
  544. {
  545. "count": 1,
  546. "body": "",
  547. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  548. "user-agent": "Microsoft-CryptoAPI/6.1",
  549. "method": "GET",
  550. "host": "ocsp.digicert.com",
  551. "version": "1.1",
  552. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  553. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  554. "port": 80
  555. },
  556. {
  557. "count": 1,
  558. "body": "",
  559. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  560. "user-agent": "Microsoft-CryptoAPI/6.1",
  561. "method": "GET",
  562. "host": "ocsp.pki.goog",
  563. "version": "1.1",
  564. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  565. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  566. "port": 80
  567. },
  568. {
  569. "count": 1,
  570. "body": "",
  571. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  572. "user-agent": "Microsoft-CryptoAPI/6.1",
  573. "method": "GET",
  574. "host": "ocsp.pki.goog",
  575. "version": "1.1",
  576. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  577. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  578. "port": 80
  579. },
  580. {
  581. "count": 1,
  582. "body": "",
  583. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  584. "user-agent": "Microsoft-CryptoAPI/6.1",
  585. "method": "GET",
  586. "host": "ocsp.digicert.com",
  587. "version": "1.1",
  588. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  589. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  590. "port": 80
  591. },
  592. {
  593. "count": 1,
  594. "body": "",
  595. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  596. "user-agent": "Microsoft-CryptoAPI/6.1",
  597. "method": "GET",
  598. "host": "ocsp.pki.goog",
  599. "version": "1.1",
  600. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  601. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  602. "port": 80
  603. },
  604. {
  605. "count": 1,
  606. "body": "",
  607. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  608. "user-agent": "Microsoft-CryptoAPI/6.1",
  609. "method": "GET",
  610. "host": "ocsp.msocsp.com",
  611. "version": "1.1",
  612. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  613. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  614. "port": 80
  615. },
  616. {
  617. "count": 1,
  618. "body": "",
  619. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  620. "user-agent": "Microsoft-CryptoAPI/6.1",
  621. "method": "GET",
  622. "host": "ocsp.thawte.com",
  623. "version": "1.1",
  624. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  625. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  626. "port": 80
  627. },
  628. {
  629. "count": 1,
  630. "body": "",
  631. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  632. "user-agent": "Microsoft-CryptoAPI/6.1",
  633. "method": "GET",
  634. "host": "ocsp.usertrust.com",
  635. "version": "1.1",
  636. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  637. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  638. "port": 80
  639. },
  640. {
  641. "count": 1,
  642. "body": "",
  643. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  644. "user-agent": "Microsoft-CryptoAPI/6.1",
  645. "method": "GET",
  646. "host": "th.symcd.com",
  647. "version": "1.1",
  648. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  649. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  650. "port": 80
  651. },
  652. {
  653. "count": 1,
  654. "body": "",
  655. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  656. "user-agent": "Microsoft-CryptoAPI/6.1",
  657. "method": "GET",
  658. "host": "ocsp.digicert.com",
  659. "version": "1.1",
  660. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  661. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  662. "port": 80
  663. },
  664. {
  665. "count": 1,
  666. "body": "",
  667. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  668. "user-agent": "Microsoft-CryptoAPI/6.1",
  669. "method": "GET",
  670. "host": "ocsp.digicert.com",
  671. "version": "1.1",
  672. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  673. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  674. "port": 80
  675. },
  676. {
  677. "count": 1,
  678. "body": "",
  679. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  680. "user-agent": "Microsoft-CryptoAPI/6.1",
  681. "method": "GET",
  682. "host": "ocsp.pki.goog",
  683. "version": "1.1",
  684. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  685. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  686. "port": 80
  687. },
  688. {
  689. "count": 1,
  690. "body": "",
  691. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  692. "user-agent": "Microsoft-CryptoAPI/6.1",
  693. "method": "GET",
  694. "host": "crl.microsoft.com",
  695. "version": "1.1",
  696. "path": "/pki/crl/products/microsoftrootcert.crl",
  697. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  698. "port": 80
  699. },
  700. {
  701. "count": 1,
  702. "body": "",
  703. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  704. "user-agent": "Microsoft BITS/7.5",
  705. "method": "HEAD",
  706. "host": "redirector.gvt1.com",
  707. "version": "1.1",
  708. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  709. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  710. "port": 80
  711. },
  712. {
  713. "count": 1,
  714. "body": "",
  715. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  716. "user-agent": "Microsoft BITS/7.5",
  717. "method": "HEAD",
  718. "host": "r4---sn-tt1eln7l.gvt1.com",
  719. "version": "1.1",
  720. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  721. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  722. "port": 80
  723. },
  724. {
  725. "count": 1,
  726. "body": "",
  727. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  728. "user-agent": "Microsoft BITS/7.5",
  729. "method": "GET",
  730. "host": "r4---sn-tt1eln7l.gvt1.com",
  731. "version": "1.1",
  732. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  733. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-6917\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  734. "port": 80
  735. },
  736. {
  737. "count": 1,
  738. "body": "",
  739. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  740. "user-agent": "Microsoft BITS/7.5",
  741. "method": "GET",
  742. "host": "r4---sn-tt1eln7l.gvt1.com",
  743. "version": "1.1",
  744. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  745. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6918-16472\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  746. "port": 80
  747. },
  748. {
  749. "count": 1,
  750. "body": "",
  751. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  752. "user-agent": "Microsoft BITS/7.5",
  753. "method": "GET",
  754. "host": "r4---sn-tt1eln7l.gvt1.com",
  755. "version": "1.1",
  756. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  757. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=16473-28825\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  758. "port": 80
  759. },
  760. {
  761. "count": 1,
  762. "body": "",
  763. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  764. "user-agent": "Microsoft BITS/7.5",
  765. "method": "GET",
  766. "host": "r4---sn-tt1eln7l.gvt1.com",
  767. "version": "1.1",
  768. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  769. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=28826-43549\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  770. "port": 80
  771. },
  772. {
  773. "count": 1,
  774. "body": "",
  775. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  776. "user-agent": "Microsoft BITS/7.5",
  777. "method": "GET",
  778. "host": "r4---sn-tt1eln7l.gvt1.com",
  779. "version": "1.1",
  780. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  781. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=43550-64648\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  782. "port": 80
  783. },
  784. {
  785. "count": 1,
  786. "body": "",
  787. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  788. "user-agent": "Microsoft BITS/7.5",
  789. "method": "GET",
  790. "host": "r4---sn-tt1eln7l.gvt1.com",
  791. "version": "1.1",
  792. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  793. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=64649-108721\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  794. "port": 80
  795. },
  796. {
  797. "count": 1,
  798. "body": "",
  799. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  800. "user-agent": "Microsoft BITS/7.5",
  801. "method": "GET",
  802. "host": "r4---sn-tt1eln7l.gvt1.com",
  803. "version": "1.1",
  804. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  805. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=108722-199445\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  806. "port": 80
  807. },
  808. {
  809. "count": 1,
  810. "body": "",
  811. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  812. "user-agent": "Microsoft BITS/7.5",
  813. "method": "GET",
  814. "host": "r4---sn-tt1eln7l.gvt1.com",
  815. "version": "1.1",
  816. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  817. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=199446-320841\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  818. "port": 80
  819. },
  820. {
  821. "count": 1,
  822. "body": "",
  823. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  824. "user-agent": "Microsoft BITS/7.5",
  825. "method": "GET",
  826. "host": "r4---sn-tt1eln7l.gvt1.com",
  827. "version": "1.1",
  828. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  829. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=320842-523128\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  830. "port": 80
  831. },
  832. {
  833. "count": 1,
  834. "body": "",
  835. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  836. "user-agent": "Microsoft BITS/7.5",
  837. "method": "GET",
  838. "host": "r4---sn-tt1eln7l.gvt1.com",
  839. "version": "1.1",
  840. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  841. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=523129-732820\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  842. "port": 80
  843. },
  844. {
  845. "count": 1,
  846. "body": "",
  847. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  848. "user-agent": "Microsoft BITS/7.5",
  849. "method": "GET",
  850. "host": "r4---sn-tt1eln7l.gvt1.com",
  851. "version": "1.1",
  852. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  853. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=732821-866701\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  854. "port": 80
  855. },
  856. {
  857. "count": 1,
  858. "body": "",
  859. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  860. "user-agent": "Microsoft BITS/7.5",
  861. "method": "GET",
  862. "host": "r4---sn-tt1eln7l.gvt1.com",
  863. "version": "1.1",
  864. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  865. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=866702-1011247\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  866. "port": 80
  867. },
  868. {
  869. "count": 1,
  870. "body": "",
  871. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  872. "user-agent": "Microsoft BITS/7.5",
  873. "method": "GET",
  874. "host": "r4---sn-tt1eln7l.gvt1.com",
  875. "version": "1.1",
  876. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  877. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1011248-1152372\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  878. "port": 80
  879. },
  880. {
  881. "count": 1,
  882. "body": "",
  883. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  884. "user-agent": "Microsoft BITS/7.5",
  885. "method": "GET",
  886. "host": "r4---sn-tt1eln7l.gvt1.com",
  887. "version": "1.1",
  888. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  889. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1152373-1304900\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  890. "port": 80
  891. },
  892. {
  893. "count": 1,
  894. "body": "",
  895. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  896. "user-agent": "Microsoft BITS/7.5",
  897. "method": "GET",
  898. "host": "r4---sn-tt1eln7l.gvt1.com",
  899. "version": "1.1",
  900. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  901. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1304901-1554814\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  902. "port": 80
  903. },
  904. {
  905. "count": 1,
  906. "body": "",
  907. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  908. "user-agent": "Microsoft BITS/7.5",
  909. "method": "GET",
  910. "host": "r4---sn-tt1eln7l.gvt1.com",
  911. "version": "1.1",
  912. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  913. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1554815-1741132\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  914. "port": 80
  915. },
  916. {
  917. "count": 1,
  918. "body": "",
  919. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  920. "user-agent": "Microsoft BITS/7.5",
  921. "method": "GET",
  922. "host": "r4---sn-tt1eln7l.gvt1.com",
  923. "version": "1.1",
  924. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  925. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1741133-1921084\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  926. "port": 80
  927. },
  928. {
  929. "count": 1,
  930. "body": "",
  931. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  932. "user-agent": "Microsoft BITS/7.5",
  933. "method": "GET",
  934. "host": "r4---sn-tt1eln7l.gvt1.com",
  935. "version": "1.1",
  936. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  937. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1921085-2220104\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  938. "port": 80
  939. },
  940. {
  941. "count": 1,
  942. "body": "",
  943. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  944. "user-agent": "Microsoft BITS/7.5",
  945. "method": "GET",
  946. "host": "r4---sn-tt1eln7l.gvt1.com",
  947. "version": "1.1",
  948. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  949. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2220105-2523813\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  950. "port": 80
  951. },
  952. {
  953. "count": 1,
  954. "body": "",
  955. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  956. "user-agent": "Microsoft BITS/7.5",
  957. "method": "GET",
  958. "host": "r4---sn-tt1eln7l.gvt1.com",
  959. "version": "1.1",
  960. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  961. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2523814-2726675\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  962. "port": 80
  963. },
  964. {
  965. "count": 1,
  966. "body": "",
  967. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  968. "user-agent": "Microsoft BITS/7.5",
  969. "method": "GET",
  970. "host": "r4---sn-tt1eln7l.gvt1.com",
  971. "version": "1.1",
  972. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  973. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2726676-2879131\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  974. "port": 80
  975. },
  976. {
  977. "count": 1,
  978. "body": "",
  979. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  980. "user-agent": "Microsoft BITS/7.5",
  981. "method": "GET",
  982. "host": "r4---sn-tt1eln7l.gvt1.com",
  983. "version": "1.1",
  984. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  985. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2879132-3218245\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  986. "port": 80
  987. },
  988. {
  989. "count": 1,
  990. "body": "",
  991. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  992. "user-agent": "Microsoft BITS/7.5",
  993. "method": "GET",
  994. "host": "r4---sn-tt1eln7l.gvt1.com",
  995. "version": "1.1",
  996. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  997. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3218246-3498616\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  998. "port": 80
  999. },
  1000. {
  1001. "count": 1,
  1002. "body": "",
  1003. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1004. "user-agent": "Microsoft BITS/7.5",
  1005. "method": "GET",
  1006. "host": "r4---sn-tt1eln7l.gvt1.com",
  1007. "version": "1.1",
  1008. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1009. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3498617-3897261\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1010. "port": 80
  1011. },
  1012. {
  1013. "count": 1,
  1014. "body": "",
  1015. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1016. "user-agent": "Microsoft BITS/7.5",
  1017. "method": "GET",
  1018. "host": "r4---sn-tt1eln7l.gvt1.com",
  1019. "version": "1.1",
  1020. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1021. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3897262-4167078\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1022. "port": 80
  1023. },
  1024. {
  1025. "count": 1,
  1026. "body": "",
  1027. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1028. "user-agent": "Microsoft BITS/7.5",
  1029. "method": "GET",
  1030. "host": "r4---sn-tt1eln7l.gvt1.com",
  1031. "version": "1.1",
  1032. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1033. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=4167079-4373724\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1034. "port": 80
  1035. },
  1036. {
  1037. "count": 1,
  1038. "body": "",
  1039. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1040. "user-agent": "Microsoft BITS/7.5",
  1041. "method": "GET",
  1042. "host": "r4---sn-tt1eln7l.gvt1.com",
  1043. "version": "1.1",
  1044. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1045. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=4373725-4839159\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1046. "port": 80
  1047. },
  1048. {
  1049. "count": 1,
  1050. "body": "",
  1051. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1052. "user-agent": "Microsoft BITS/7.5",
  1053. "method": "GET",
  1054. "host": "r4---sn-tt1eln7l.gvt1.com",
  1055. "version": "1.1",
  1056. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1057. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=4839160-5311511\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1058. "port": 80
  1059. },
  1060. {
  1061. "count": 1,
  1062. "body": "",
  1063. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1064. "user-agent": "Microsoft BITS/7.5",
  1065. "method": "GET",
  1066. "host": "r4---sn-tt1eln7l.gvt1.com",
  1067. "version": "1.1",
  1068. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1069. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5311512-5728041\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1070. "port": 80
  1071. },
  1072. {
  1073. "count": 1,
  1074. "body": "",
  1075. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1076. "user-agent": "Microsoft BITS/7.5",
  1077. "method": "GET",
  1078. "host": "r4---sn-tt1eln7l.gvt1.com",
  1079. "version": "1.1",
  1080. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1081. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5728042-6075127\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1082. "port": 80
  1083. },
  1084. {
  1085. "count": 1,
  1086. "body": "",
  1087. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1088. "user-agent": "Microsoft BITS/7.5",
  1089. "method": "GET",
  1090. "host": "r4---sn-tt1eln7l.gvt1.com",
  1091. "version": "1.1",
  1092. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1093. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6075128-6659677\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1094. "port": 80
  1095. },
  1096. {
  1097. "count": 1,
  1098. "body": "",
  1099. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1100. "user-agent": "Microsoft BITS/7.5",
  1101. "method": "GET",
  1102. "host": "r4---sn-tt1eln7l.gvt1.com",
  1103. "version": "1.1",
  1104. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1105. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6659678-7228326\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1106. "port": 80
  1107. },
  1108. {
  1109. "count": 1,
  1110. "body": "",
  1111. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1112. "user-agent": "Microsoft BITS/7.5",
  1113. "method": "GET",
  1114. "host": "r4---sn-tt1eln7l.gvt1.com",
  1115. "version": "1.1",
  1116. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1117. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7228327-7827179\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1118. "port": 80
  1119. },
  1120. {
  1121. "count": 1,
  1122. "body": "",
  1123. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1124. "user-agent": "Microsoft BITS/7.5",
  1125. "method": "GET",
  1126. "host": "r4---sn-tt1eln7l.gvt1.com",
  1127. "version": "1.1",
  1128. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1129. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7827180-8256895\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1130. "port": 80
  1131. },
  1132. {
  1133. "count": 1,
  1134. "body": "",
  1135. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1136. "user-agent": "Microsoft BITS/7.5",
  1137. "method": "GET",
  1138. "host": "r4---sn-tt1eln7l.gvt1.com",
  1139. "version": "1.1",
  1140. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1141. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=8256896-8719805\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1142. "port": 80
  1143. },
  1144. {
  1145. "count": 1,
  1146. "body": "",
  1147. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1148. "user-agent": "Microsoft BITS/7.5",
  1149. "method": "GET",
  1150. "host": "r4---sn-tt1eln7l.gvt1.com",
  1151. "version": "1.1",
  1152. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1153. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=8719806-9577185\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1154. "port": 80
  1155. },
  1156. {
  1157. "count": 1,
  1158. "body": "",
  1159. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1160. "user-agent": "Microsoft BITS/7.5",
  1161. "method": "GET",
  1162. "host": "r4---sn-tt1eln7l.gvt1.com",
  1163. "version": "1.1",
  1164. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1165. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=9577186-10421543\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1166. "port": 80
  1167. },
  1168. {
  1169. "count": 1,
  1170. "body": "",
  1171. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1172. "user-agent": "Microsoft BITS/7.5",
  1173. "method": "GET",
  1174. "host": "r4---sn-tt1eln7l.gvt1.com",
  1175. "version": "1.1",
  1176. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1177. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=10421544-10974809\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1178. "port": 80
  1179. },
  1180. {
  1181. "count": 1,
  1182. "body": "",
  1183. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1184. "user-agent": "Microsoft BITS/7.5",
  1185. "method": "GET",
  1186. "host": "r4---sn-tt1eln7l.gvt1.com",
  1187. "version": "1.1",
  1188. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1189. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=10974810-11515737\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1190. "port": 80
  1191. },
  1192. {
  1193. "count": 1,
  1194. "body": "",
  1195. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1196. "user-agent": "Microsoft BITS/7.5",
  1197. "method": "GET",
  1198. "host": "r4---sn-tt1eln7l.gvt1.com",
  1199. "version": "1.1",
  1200. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1201. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=11515738-12125399\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1202. "port": 80
  1203. },
  1204. {
  1205. "count": 1,
  1206. "body": "",
  1207. "uri": "http://r4---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1208. "user-agent": "Microsoft BITS/7.5",
  1209. "method": "GET",
  1210. "host": "r4---sn-tt1eln7l.gvt1.com",
  1211. "version": "1.1",
  1212. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes",
  1213. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1560902601&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=12125400-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r4---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1214. "port": 80
  1215. }
  1216. ]
  1217.  
  1218. [*] Network Communication - SMTP: []
  1219.  
  1220. [*] Network Communication - Hosts: []
  1221.  
  1222. [*] Network Communication - IRC: []
  1223.  
  1224. [*] Static Analysis: {
  1225. "pe": {
  1226. "peid_signatures": [
  1227. [
  1228. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  1229. ]
  1230. ],
  1231. "imports": [
  1232. {
  1233. "imports": [
  1234. {
  1235. "name": "LoadLibraryA",
  1236. "address": "0x5bcb74"
  1237. },
  1238. {
  1239. "name": "GetProcAddress",
  1240. "address": "0x5bcb78"
  1241. },
  1242. {
  1243. "name": "VirtualProtect",
  1244. "address": "0x5bcb7c"
  1245. },
  1246. {
  1247. "name": "ExitProcess",
  1248. "address": "0x5bcb80"
  1249. }
  1250. ],
  1251. "dll": "KERNEL32.DLL"
  1252. },
  1253. {
  1254. "imports": [
  1255. {
  1256. "name": "RegCloseKey",
  1257. "address": "0x5bcb88"
  1258. }
  1259. ],
  1260. "dll": "advapi32.dll"
  1261. },
  1262. {
  1263. "imports": [
  1264. {
  1265. "name": "ImageList_Add",
  1266. "address": "0x5bcb90"
  1267. }
  1268. ],
  1269. "dll": "comctl32.dll"
  1270. },
  1271. {
  1272. "imports": [
  1273. {
  1274. "name": "GetOpenFileNameA",
  1275. "address": "0x5bcb98"
  1276. }
  1277. ],
  1278. "dll": "comdlg32.dll"
  1279. },
  1280. {
  1281. "imports": [
  1282. {
  1283. "name": "SaveDC",
  1284. "address": "0x5bcba0"
  1285. }
  1286. ],
  1287. "dll": "gdi32.dll"
  1288. },
  1289. {
  1290. "imports": [
  1291. {
  1292. "name": "OleDraw",
  1293. "address": "0x5bcba8"
  1294. }
  1295. ],
  1296. "dll": "ole32.dll"
  1297. },
  1298. {
  1299. "imports": [
  1300. {
  1301. "name": "VariantCopy",
  1302. "address": "0x5bcbb0"
  1303. }
  1304. ],
  1305. "dll": "oleaut32.dll"
  1306. },
  1307. {
  1308. "imports": [
  1309. {
  1310. "name": "ShellExecuteA",
  1311. "address": "0x5bcbb8"
  1312. }
  1313. ],
  1314. "dll": "shell32.dll"
  1315. },
  1316. {
  1317. "imports": [
  1318. {
  1319. "name": "GetDC",
  1320. "address": "0x5bcbc0"
  1321. }
  1322. ],
  1323. "dll": "user32.dll"
  1324. },
  1325. {
  1326. "imports": [
  1327. {
  1328. "name": "VerQueryValueA",
  1329. "address": "0x5bcbc8"
  1330. }
  1331. ],
  1332. "dll": "version.dll"
  1333. },
  1334. {
  1335. "imports": [
  1336. {
  1337. "name": "OpenPrinterA",
  1338. "address": "0x5bcbd0"
  1339. }
  1340. ],
  1341. "dll": "winspool.drv"
  1342. }
  1343. ],
  1344. "digital_signers": null,
  1345. "exported_dll_name": null,
  1346. "actual_checksum": "0x000bd809",
  1347. "overlay": null,
  1348. "imagebase": "0x00400000",
  1349. "reported_checksum": "0x00000000",
  1350. "icon_hash": null,
  1351. "entrypoint": "0x005aa0f0",
  1352. "timestamp": "1992-06-19 22:22:17",
  1353. "osversion": "4.0",
  1354. "sections": [
  1355. {
  1356. "name": "UPX0",
  1357. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1358. "virtual_address": "0x00001000",
  1359. "size_of_data": "0x00000000",
  1360. "entropy": "0.00",
  1361. "raw_address": "0x00000400",
  1362. "virtual_size": "0x00105000",
  1363. "characteristics_raw": "0xe0000080"
  1364. },
  1365. {
  1366. "name": "UPX1",
  1367. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1368. "virtual_address": "0x00106000",
  1369. "size_of_data": "0x000a4400",
  1370. "entropy": "7.95",
  1371. "raw_address": "0x00000400",
  1372. "virtual_size": "0x000a5000",
  1373. "characteristics_raw": "0xe0000040"
  1374. },
  1375. {
  1376. "name": ".rsrc",
  1377. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  1378. "virtual_address": "0x001ab000",
  1379. "size_of_data": "0x00011e00",
  1380. "entropy": "5.11",
  1381. "raw_address": "0x000a4800",
  1382. "virtual_size": "0x00012000",
  1383. "characteristics_raw": "0xc0000040"
  1384. }
  1385. ],
  1386. "resources": [
  1387. {
  1388. "name": "RT_CURSOR",
  1389. "language": "LANG_NEUTRAL",
  1390. "filetype": null,
  1391. "sublanguage": "SUBLANG_NEUTRAL",
  1392. "entropy": "0.00",
  1393. "offset": "0x000e6978",
  1394. "size": "0x00000134"
  1395. },
  1396. {
  1397. "name": "RT_CURSOR",
  1398. "language": "LANG_NEUTRAL",
  1399. "filetype": null,
  1400. "sublanguage": "SUBLANG_NEUTRAL",
  1401. "entropy": "0.00",
  1402. "offset": "0x000e6978",
  1403. "size": "0x00000134"
  1404. },
  1405. {
  1406. "name": "RT_CURSOR",
  1407. "language": "LANG_NEUTRAL",
  1408. "filetype": null,
  1409. "sublanguage": "SUBLANG_NEUTRAL",
  1410. "entropy": "0.00",
  1411. "offset": "0x000e6978",
  1412. "size": "0x00000134"
  1413. },
  1414. {
  1415. "name": "RT_CURSOR",
  1416. "language": "LANG_NEUTRAL",
  1417. "filetype": null,
  1418. "sublanguage": "SUBLANG_NEUTRAL",
  1419. "entropy": "0.00",
  1420. "offset": "0x000e6978",
  1421. "size": "0x00000134"
  1422. },
  1423. {
  1424. "name": "RT_CURSOR",
  1425. "language": "LANG_NEUTRAL",
  1426. "filetype": null,
  1427. "sublanguage": "SUBLANG_NEUTRAL",
  1428. "entropy": "0.00",
  1429. "offset": "0x000e6978",
  1430. "size": "0x00000134"
  1431. },
  1432. {
  1433. "name": "RT_CURSOR",
  1434. "language": "LANG_NEUTRAL",
  1435. "filetype": null,
  1436. "sublanguage": "SUBLANG_NEUTRAL",
  1437. "entropy": "0.00",
  1438. "offset": "0x000e6978",
  1439. "size": "0x00000134"
  1440. },
  1441. {
  1442. "name": "RT_CURSOR",
  1443. "language": "LANG_NEUTRAL",
  1444. "filetype": null,
  1445. "sublanguage": "SUBLANG_NEUTRAL",
  1446. "entropy": "0.00",
  1447. "offset": "0x000e6978",
  1448. "size": "0x00000134"
  1449. },
  1450. {
  1451. "name": "RT_BITMAP",
  1452. "language": "LANG_ARABIC",
  1453. "filetype": null,
  1454. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1455. "entropy": "0.00",
  1456. "offset": "0x000e8a74",
  1457. "size": "0x000000e8"
  1458. },
  1459. {
  1460. "name": "RT_BITMAP",
  1461. "language": "LANG_ARABIC",
  1462. "filetype": null,
  1463. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1464. "entropy": "0.00",
  1465. "offset": "0x000e8a74",
  1466. "size": "0x000000e8"
  1467. },
  1468. {
  1469. "name": "RT_BITMAP",
  1470. "language": "LANG_ARABIC",
  1471. "filetype": null,
  1472. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1473. "entropy": "0.00",
  1474. "offset": "0x000e8a74",
  1475. "size": "0x000000e8"
  1476. },
  1477. {
  1478. "name": "RT_BITMAP",
  1479. "language": "LANG_ARABIC",
  1480. "filetype": null,
  1481. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1482. "entropy": "0.00",
  1483. "offset": "0x000e8a74",
  1484. "size": "0x000000e8"
  1485. },
  1486. {
  1487. "name": "RT_BITMAP",
  1488. "language": "LANG_ARABIC",
  1489. "filetype": null,
  1490. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1491. "entropy": "0.00",
  1492. "offset": "0x000e8a74",
  1493. "size": "0x000000e8"
  1494. },
  1495. {
  1496. "name": "RT_BITMAP",
  1497. "language": "LANG_ARABIC",
  1498. "filetype": null,
  1499. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1500. "entropy": "0.00",
  1501. "offset": "0x000e8a74",
  1502. "size": "0x000000e8"
  1503. },
  1504. {
  1505. "name": "RT_BITMAP",
  1506. "language": "LANG_ARABIC",
  1507. "filetype": null,
  1508. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1509. "entropy": "0.00",
  1510. "offset": "0x000e8a74",
  1511. "size": "0x000000e8"
  1512. },
  1513. {
  1514. "name": "RT_BITMAP",
  1515. "language": "LANG_ARABIC",
  1516. "filetype": null,
  1517. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1518. "entropy": "0.00",
  1519. "offset": "0x000e8a74",
  1520. "size": "0x000000e8"
  1521. },
  1522. {
  1523. "name": "RT_BITMAP",
  1524. "language": "LANG_ARABIC",
  1525. "filetype": null,
  1526. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1527. "entropy": "0.00",
  1528. "offset": "0x000e8a74",
  1529. "size": "0x000000e8"
  1530. },
  1531. {
  1532. "name": "RT_BITMAP",
  1533. "language": "LANG_ARABIC",
  1534. "filetype": null,
  1535. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1536. "entropy": "0.00",
  1537. "offset": "0x000e8a74",
  1538. "size": "0x000000e8"
  1539. },
  1540. {
  1541. "name": "RT_BITMAP",
  1542. "language": "LANG_ARABIC",
  1543. "filetype": null,
  1544. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1545. "entropy": "0.00",
  1546. "offset": "0x000e8a74",
  1547. "size": "0x000000e8"
  1548. },
  1549. {
  1550. "name": "RT_BITMAP",
  1551. "language": "LANG_ARABIC",
  1552. "filetype": null,
  1553. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1554. "entropy": "0.00",
  1555. "offset": "0x000e8a74",
  1556. "size": "0x000000e8"
  1557. },
  1558. {
  1559. "name": "RT_BITMAP",
  1560. "language": "LANG_ARABIC",
  1561. "filetype": null,
  1562. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1563. "entropy": "0.00",
  1564. "offset": "0x000e8a74",
  1565. "size": "0x000000e8"
  1566. },
  1567. {
  1568. "name": "RT_BITMAP",
  1569. "language": "LANG_ARABIC",
  1570. "filetype": null,
  1571. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1572. "entropy": "0.00",
  1573. "offset": "0x000e8a74",
  1574. "size": "0x000000e8"
  1575. },
  1576. {
  1577. "name": "RT_BITMAP",
  1578. "language": "LANG_ARABIC",
  1579. "filetype": null,
  1580. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1581. "entropy": "0.00",
  1582. "offset": "0x000e8a74",
  1583. "size": "0x000000e8"
  1584. },
  1585. {
  1586. "name": "RT_BITMAP",
  1587. "language": "LANG_ARABIC",
  1588. "filetype": null,
  1589. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1590. "entropy": "0.00",
  1591. "offset": "0x000e8a74",
  1592. "size": "0x000000e8"
  1593. },
  1594. {
  1595. "name": "RT_BITMAP",
  1596. "language": "LANG_ARABIC",
  1597. "filetype": null,
  1598. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1599. "entropy": "0.00",
  1600. "offset": "0x000e8a74",
  1601. "size": "0x000000e8"
  1602. },
  1603. {
  1604. "name": "RT_BITMAP",
  1605. "language": "LANG_ARABIC",
  1606. "filetype": null,
  1607. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1608. "entropy": "0.00",
  1609. "offset": "0x000e8a74",
  1610. "size": "0x000000e8"
  1611. },
  1612. {
  1613. "name": "RT_BITMAP",
  1614. "language": "LANG_ARABIC",
  1615. "filetype": null,
  1616. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1617. "entropy": "0.00",
  1618. "offset": "0x000e8a74",
  1619. "size": "0x000000e8"
  1620. },
  1621. {
  1622. "name": "RT_BITMAP",
  1623. "language": "LANG_ARABIC",
  1624. "filetype": null,
  1625. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1626. "entropy": "0.00",
  1627. "offset": "0x000e8a74",
  1628. "size": "0x000000e8"
  1629. },
  1630. {
  1631. "name": "RT_BITMAP",
  1632. "language": "LANG_ARABIC",
  1633. "filetype": null,
  1634. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1635. "entropy": "0.00",
  1636. "offset": "0x000e8a74",
  1637. "size": "0x000000e8"
  1638. },
  1639. {
  1640. "name": "RT_BITMAP",
  1641. "language": "LANG_ARABIC",
  1642. "filetype": null,
  1643. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1644. "entropy": "0.00",
  1645. "offset": "0x000e8a74",
  1646. "size": "0x000000e8"
  1647. },
  1648. {
  1649. "name": "RT_BITMAP",
  1650. "language": "LANG_ARABIC",
  1651. "filetype": null,
  1652. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1653. "entropy": "0.00",
  1654. "offset": "0x000e8a74",
  1655. "size": "0x000000e8"
  1656. },
  1657. {
  1658. "name": "RT_BITMAP",
  1659. "language": "LANG_ARABIC",
  1660. "filetype": null,
  1661. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1662. "entropy": "0.00",
  1663. "offset": "0x000e8a74",
  1664. "size": "0x000000e8"
  1665. },
  1666. {
  1667. "name": "RT_BITMAP",
  1668. "language": "LANG_ARABIC",
  1669. "filetype": null,
  1670. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1671. "entropy": "0.00",
  1672. "offset": "0x000e8a74",
  1673. "size": "0x000000e8"
  1674. },
  1675. {
  1676. "name": "RT_BITMAP",
  1677. "language": "LANG_ARABIC",
  1678. "filetype": null,
  1679. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  1680. "entropy": "0.00",
  1681. "offset": "0x000e8a74",
  1682. "size": "0x000000e8"
  1683. },
  1684. {
  1685. "name": "RT_DIALOG",
  1686. "language": "LANG_NEUTRAL",
  1687. "filetype": null,
  1688. "sublanguage": "SUBLANG_NEUTRAL",
  1689. "entropy": "0.00",
  1690. "offset": "0x000f9384",
  1691. "size": "0x00000052"
  1692. },
  1693. {
  1694. "name": "RT_STRING",
  1695. "language": "LANG_NEUTRAL",
  1696. "filetype": null,
  1697. "sublanguage": "SUBLANG_NEUTRAL",
  1698. "entropy": "0.00",
  1699. "offset": "0x000fe724",
  1700. "size": "0x00000328"
  1701. },
  1702. {
  1703. "name": "RT_STRING",
  1704. "language": "LANG_NEUTRAL",
  1705. "filetype": null,
  1706. "sublanguage": "SUBLANG_NEUTRAL",
  1707. "entropy": "0.00",
  1708. "offset": "0x000fe724",
  1709. "size": "0x00000328"
  1710. },
  1711. {
  1712. "name": "RT_STRING",
  1713. "language": "LANG_NEUTRAL",
  1714. "filetype": null,
  1715. "sublanguage": "SUBLANG_NEUTRAL",
  1716. "entropy": "0.00",
  1717. "offset": "0x000fe724",
  1718. "size": "0x00000328"
  1719. },
  1720. {
  1721. "name": "RT_STRING",
  1722. "language": "LANG_NEUTRAL",
  1723. "filetype": null,
  1724. "sublanguage": "SUBLANG_NEUTRAL",
  1725. "entropy": "0.00",
  1726. "offset": "0x000fe724",
  1727. "size": "0x00000328"
  1728. },
  1729. {
  1730. "name": "RT_STRING",
  1731. "language": "LANG_NEUTRAL",
  1732. "filetype": null,
  1733. "sublanguage": "SUBLANG_NEUTRAL",
  1734. "entropy": "0.00",
  1735. "offset": "0x000fe724",
  1736. "size": "0x00000328"
  1737. },
  1738. {
  1739. "name": "RT_STRING",
  1740. "language": "LANG_NEUTRAL",
  1741. "filetype": null,
  1742. "sublanguage": "SUBLANG_NEUTRAL",
  1743. "entropy": "0.00",
  1744. "offset": "0x000fe724",
  1745. "size": "0x00000328"
  1746. },
  1747. {
  1748. "name": "RT_STRING",
  1749. "language": "LANG_NEUTRAL",
  1750. "filetype": null,
  1751. "sublanguage": "SUBLANG_NEUTRAL",
  1752. "entropy": "0.00",
  1753. "offset": "0x000fe724",
  1754. "size": "0x00000328"
  1755. },
  1756. {
  1757. "name": "RT_STRING",
  1758. "language": "LANG_NEUTRAL",
  1759. "filetype": null,
  1760. "sublanguage": "SUBLANG_NEUTRAL",
  1761. "entropy": "0.00",
  1762. "offset": "0x000fe724",
  1763. "size": "0x00000328"
  1764. },
  1765. {
  1766. "name": "RT_STRING",
  1767. "language": "LANG_NEUTRAL",
  1768. "filetype": null,
  1769. "sublanguage": "SUBLANG_NEUTRAL",
  1770. "entropy": "0.00",
  1771. "offset": "0x000fe724",
  1772. "size": "0x00000328"
  1773. },
  1774. {
  1775. "name": "RT_STRING",
  1776. "language": "LANG_NEUTRAL",
  1777. "filetype": null,
  1778. "sublanguage": "SUBLANG_NEUTRAL",
  1779. "entropy": "0.00",
  1780. "offset": "0x000fe724",
  1781. "size": "0x00000328"
  1782. },
  1783. {
  1784. "name": "RT_STRING",
  1785. "language": "LANG_NEUTRAL",
  1786. "filetype": null,
  1787. "sublanguage": "SUBLANG_NEUTRAL",
  1788. "entropy": "0.00",
  1789. "offset": "0x000fe724",
  1790. "size": "0x00000328"
  1791. },
  1792. {
  1793. "name": "RT_STRING",
  1794. "language": "LANG_NEUTRAL",
  1795. "filetype": null,
  1796. "sublanguage": "SUBLANG_NEUTRAL",
  1797. "entropy": "0.00",
  1798. "offset": "0x000fe724",
  1799. "size": "0x00000328"
  1800. },
  1801. {
  1802. "name": "RT_STRING",
  1803. "language": "LANG_NEUTRAL",
  1804. "filetype": null,
  1805. "sublanguage": "SUBLANG_NEUTRAL",
  1806. "entropy": "0.00",
  1807. "offset": "0x000fe724",
  1808. "size": "0x00000328"
  1809. },
  1810. {
  1811. "name": "RT_STRING",
  1812. "language": "LANG_NEUTRAL",
  1813. "filetype": null,
  1814. "sublanguage": "SUBLANG_NEUTRAL",
  1815. "entropy": "0.00",
  1816. "offset": "0x000fe724",
  1817. "size": "0x00000328"
  1818. },
  1819. {
  1820. "name": "RT_STRING",
  1821. "language": "LANG_NEUTRAL",
  1822. "filetype": null,
  1823. "sublanguage": "SUBLANG_NEUTRAL",
  1824. "entropy": "0.00",
  1825. "offset": "0x000fe724",
  1826. "size": "0x00000328"
  1827. },
  1828. {
  1829. "name": "RT_STRING",
  1830. "language": "LANG_NEUTRAL",
  1831. "filetype": null,
  1832. "sublanguage": "SUBLANG_NEUTRAL",
  1833. "entropy": "0.00",
  1834. "offset": "0x000fe724",
  1835. "size": "0x00000328"
  1836. },
  1837. {
  1838. "name": "RT_STRING",
  1839. "language": "LANG_NEUTRAL",
  1840. "filetype": null,
  1841. "sublanguage": "SUBLANG_NEUTRAL",
  1842. "entropy": "0.00",
  1843. "offset": "0x000fe724",
  1844. "size": "0x00000328"
  1845. },
  1846. {
  1847. "name": "RT_STRING",
  1848. "language": "LANG_NEUTRAL",
  1849. "filetype": null,
  1850. "sublanguage": "SUBLANG_NEUTRAL",
  1851. "entropy": "0.00",
  1852. "offset": "0x000fe724",
  1853. "size": "0x00000328"
  1854. },
  1855. {
  1856. "name": "RT_STRING",
  1857. "language": "LANG_NEUTRAL",
  1858. "filetype": null,
  1859. "sublanguage": "SUBLANG_NEUTRAL",
  1860. "entropy": "0.00",
  1861. "offset": "0x000fe724",
  1862. "size": "0x00000328"
  1863. },
  1864. {
  1865. "name": "RT_STRING",
  1866. "language": "LANG_NEUTRAL",
  1867. "filetype": null,
  1868. "sublanguage": "SUBLANG_NEUTRAL",
  1869. "entropy": "0.00",
  1870. "offset": "0x000fe724",
  1871. "size": "0x00000328"
  1872. },
  1873. {
  1874. "name": "RT_STRING",
  1875. "language": "LANG_NEUTRAL",
  1876. "filetype": null,
  1877. "sublanguage": "SUBLANG_NEUTRAL",
  1878. "entropy": "0.00",
  1879. "offset": "0x000fe724",
  1880. "size": "0x00000328"
  1881. },
  1882. {
  1883. "name": "RT_STRING",
  1884. "language": "LANG_NEUTRAL",
  1885. "filetype": null,
  1886. "sublanguage": "SUBLANG_NEUTRAL",
  1887. "entropy": "0.00",
  1888. "offset": "0x000fe724",
  1889. "size": "0x00000328"
  1890. },
  1891. {
  1892. "name": "RT_STRING",
  1893. "language": "LANG_NEUTRAL",
  1894. "filetype": null,
  1895. "sublanguage": "SUBLANG_NEUTRAL",
  1896. "entropy": "0.00",
  1897. "offset": "0x000fe724",
  1898. "size": "0x00000328"
  1899. },
  1900. {
  1901. "name": "RT_STRING",
  1902. "language": "LANG_NEUTRAL",
  1903. "filetype": null,
  1904. "sublanguage": "SUBLANG_NEUTRAL",
  1905. "entropy": "0.00",
  1906. "offset": "0x000fe724",
  1907. "size": "0x00000328"
  1908. },
  1909. {
  1910. "name": "RT_STRING",
  1911. "language": "LANG_NEUTRAL",
  1912. "filetype": null,
  1913. "sublanguage": "SUBLANG_NEUTRAL",
  1914. "entropy": "0.00",
  1915. "offset": "0x000fe724",
  1916. "size": "0x00000328"
  1917. },
  1918. {
  1919. "name": "RT_STRING",
  1920. "language": "LANG_NEUTRAL",
  1921. "filetype": null,
  1922. "sublanguage": "SUBLANG_NEUTRAL",
  1923. "entropy": "0.00",
  1924. "offset": "0x000fe724",
  1925. "size": "0x00000328"
  1926. },
  1927. {
  1928. "name": "RT_STRING",
  1929. "language": "LANG_NEUTRAL",
  1930. "filetype": null,
  1931. "sublanguage": "SUBLANG_NEUTRAL",
  1932. "entropy": "0.00",
  1933. "offset": "0x000fe724",
  1934. "size": "0x00000328"
  1935. },
  1936. {
  1937. "name": "RT_RCDATA",
  1938. "language": "LANG_NEUTRAL",
  1939. "filetype": null,
  1940. "sublanguage": "SUBLANG_NEUTRAL",
  1941. "entropy": "0.00",
  1942. "offset": "0x00139910",
  1943. "size": "0x00069acd"
  1944. },
  1945. {
  1946. "name": "RT_RCDATA",
  1947. "language": "LANG_NEUTRAL",
  1948. "filetype": null,
  1949. "sublanguage": "SUBLANG_NEUTRAL",
  1950. "entropy": "0.00",
  1951. "offset": "0x00139910",
  1952. "size": "0x00069acd"
  1953. },
  1954. {
  1955. "name": "RT_RCDATA",
  1956. "language": "LANG_NEUTRAL",
  1957. "filetype": null,
  1958. "sublanguage": "SUBLANG_NEUTRAL",
  1959. "entropy": "0.00",
  1960. "offset": "0x00139910",
  1961. "size": "0x00069acd"
  1962. },
  1963. {
  1964. "name": "RT_RCDATA",
  1965. "language": "LANG_NEUTRAL",
  1966. "filetype": null,
  1967. "sublanguage": "SUBLANG_NEUTRAL",
  1968. "entropy": "0.00",
  1969. "offset": "0x00139910",
  1970. "size": "0x00069acd"
  1971. },
  1972. {
  1973. "name": "RT_RCDATA",
  1974. "language": "LANG_NEUTRAL",
  1975. "filetype": null,
  1976. "sublanguage": "SUBLANG_NEUTRAL",
  1977. "entropy": "0.00",
  1978. "offset": "0x00139910",
  1979. "size": "0x00069acd"
  1980. }
  1981. ],
  1982. "dirents": [
  1983. {
  1984. "virtual_address": "0x00000000",
  1985. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  1986. "size": "0x00000000"
  1987. },
  1988. {
  1989. "virtual_address": "0x001bca84",
  1990. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  1991. "size": "0x0000029c"
  1992. },
  1993. {
  1994. "virtual_address": "0x001ab000",
  1995. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  1996. "size": "0x00011a84"
  1997. },
  1998. {
  1999. "virtual_address": "0x00000000",
  2000. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  2001. "size": "0x00000000"
  2002. },
  2003. {
  2004. "virtual_address": "0x00000000",
  2005. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  2006. "size": "0x00000000"
  2007. },
  2008. {
  2009. "virtual_address": "0x00000000",
  2010. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  2011. "size": "0x00000000"
  2012. },
  2013. {
  2014. "virtual_address": "0x00000000",
  2015. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  2016. "size": "0x00000000"
  2017. },
  2018. {
  2019. "virtual_address": "0x00000000",
  2020. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  2021. "size": "0x00000000"
  2022. },
  2023. {
  2024. "virtual_address": "0x00000000",
  2025. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  2026. "size": "0x00000000"
  2027. },
  2028. {
  2029. "virtual_address": "0x001aa2a0",
  2030. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  2031. "size": "0x00000018"
  2032. },
  2033. {
  2034. "virtual_address": "0x00000000",
  2035. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  2036. "size": "0x00000000"
  2037. },
  2038. {
  2039. "virtual_address": "0x00000000",
  2040. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  2041. "size": "0x00000000"
  2042. },
  2043. {
  2044. "virtual_address": "0x00000000",
  2045. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  2046. "size": "0x00000000"
  2047. },
  2048. {
  2049. "virtual_address": "0x00000000",
  2050. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  2051. "size": "0x00000000"
  2052. },
  2053. {
  2054. "virtual_address": "0x00000000",
  2055. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  2056. "size": "0x00000000"
  2057. },
  2058. {
  2059. "virtual_address": "0x00000000",
  2060. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  2061. "size": "0x00000000"
  2062. }
  2063. ],
  2064. "exports": [],
  2065. "guest_signers": {},
  2066. "imphash": "be80c76669cbf7df686368b57a7d5606",
  2067. "icon_fuzzy": null,
  2068. "icon": null,
  2069. "pdbpath": null,
  2070. "imported_dll_count": 11,
  2071. "versioninfo": []
  2072. }
  2073. }
  2074.  
  2075. [*] Resolved APIs: [
  2076. "kernel32.dll.Sleep",
  2077. "kernel32.dll.MulDiv",
  2078. "kernel32.dll.lstrcpyA",
  2079. "kernel32.dll.WriteFile",
  2080. "kernel32.dll.WaitForSingleObject",
  2081. "kernel32.dll.VirtualQuery",
  2082. "kernel32.dll.VirtualAlloc",
  2083. "kernel32.dll.SizeofResource",
  2084. "kernel32.dll.SetThreadLocale",
  2085. "kernel32.dll.SetFilePointer",
  2086. "kernel32.dll.SetEvent",
  2087. "kernel32.dll.SetErrorMode",
  2088. "kernel32.dll.SetEndOfFile",
  2089. "kernel32.dll.SearchPathA",
  2090. "kernel32.dll.ResetEvent",
  2091. "kernel32.dll.ReleaseMutex",
  2092. "kernel32.dll.ReadFile",
  2093. "kernel32.dll.OpenFileMappingA",
  2094. "kernel32.dll.MultiByteToWideChar",
  2095. "kernel32.dll.MoveFileA",
  2096. "kernel32.dll.LockResource",
  2097. "kernel32.dll.LoadResource",
  2098. "kernel32.dll.LoadLibraryA",
  2099. "kernel32.dll.LeaveCriticalSection",
  2100. "kernel32.dll.IsDBCSLeadByte",
  2101. "kernel32.dll.InitializeCriticalSection",
  2102. "kernel32.dll.GlobalUnlock",
  2103. "kernel32.dll.GlobalSize",
  2104. "kernel32.dll.GlobalReAlloc",
  2105. "kernel32.dll.GlobalHandle",
  2106. "kernel32.dll.GlobalLock",
  2107. "kernel32.dll.GlobalFree",
  2108. "kernel32.dll.GlobalFindAtomA",
  2109. "kernel32.dll.GlobalDeleteAtom",
  2110. "kernel32.dll.GlobalAlloc",
  2111. "kernel32.dll.GlobalAddAtomA",
  2112. "kernel32.dll.GetVersionExA",
  2113. "kernel32.dll.GetVersion",
  2114. "kernel32.dll.GetUserDefaultLCID",
  2115. "kernel32.dll.GetTickCount",
  2116. "kernel32.dll.GetThreadLocale",
  2117. "kernel32.dll.GetTempPathA",
  2118. "kernel32.dll.GetSystemInfo",
  2119. "kernel32.dll.GetStringTypeExA",
  2120. "kernel32.dll.GetStdHandle",
  2121. "kernel32.dll.GetProfileStringA",
  2122. "kernel32.dll.GetProcAddress",
  2123. "kernel32.dll.GetModuleHandleA",
  2124. "kernel32.dll.GetModuleFileNameA",
  2125. "kernel32.dll.GetLocaleInfoA",
  2126. "kernel32.dll.GetLocalTime",
  2127. "kernel32.dll.GetLastError",
  2128. "kernel32.dll.GetFullPathNameA",
  2129. "kernel32.dll.GetDiskFreeSpaceA",
  2130. "kernel32.dll.GetDateFormatA",
  2131. "kernel32.dll.GetCurrentThreadId",
  2132. "kernel32.dll.GetCurrentProcessId",
  2133. "kernel32.dll.GetCurrentDirectoryA",
  2134. "kernel32.dll.GetComputerNameA",
  2135. "kernel32.dll.GetCPInfo",
  2136. "kernel32.dll.GetACP",
  2137. "kernel32.dll.FreeResource",
  2138. "kernel32.dll.InterlockedIncrement",
  2139. "kernel32.dll.InterlockedExchange",
  2140. "kernel32.dll.InterlockedDecrement",
  2141. "kernel32.dll.FreeLibrary",
  2142. "kernel32.dll.FormatMessageA",
  2143. "kernel32.dll.FindResourceA",
  2144. "kernel32.dll.FindFirstFileA",
  2145. "kernel32.dll.FindClose",
  2146. "kernel32.dll.FileTimeToLocalFileTime",
  2147. "kernel32.dll.FileTimeToDosDateTime",
  2148. "kernel32.dll.FatalAppExitA",
  2149. "kernel32.dll.ExitProcess",
  2150. "kernel32.dll.EnumCalendarInfoA",
  2151. "kernel32.dll.EnterCriticalSection",
  2152. "kernel32.dll.DeleteFileA",
  2153. "kernel32.dll.DeleteCriticalSection",
  2154. "kernel32.dll.CreateThread",
  2155. "kernel32.dll.CreateProcessA",
  2156. "kernel32.dll.CreateMutexA",
  2157. "kernel32.dll.CreateFileA",
  2158. "kernel32.dll.CreateEventA",
  2159. "kernel32.dll.CompareStringA",
  2160. "kernel32.dll.CloseHandle",
  2161. "kernel32.dll.TlsSetValue",
  2162. "kernel32.dll.TlsGetValue",
  2163. "kernel32.dll.LocalAlloc",
  2164. "kernel32.dll.VirtualFree",
  2165. "kernel32.dll.LocalFree",
  2166. "kernel32.dll.WideCharToMultiByte",
  2167. "kernel32.dll.SetCurrentDirectoryA",
  2168. "kernel32.dll.lstrlenA",
  2169. "kernel32.dll.lstrcpynA",
  2170. "kernel32.dll.LoadLibraryExA",
  2171. "kernel32.dll.GetStartupInfoA",
  2172. "kernel32.dll.GetCommandLineA",
  2173. "kernel32.dll.UnhandledExceptionFilter",
  2174. "kernel32.dll.RtlUnwind",
  2175. "kernel32.dll.RaiseException",
  2176. "kernel32.dll.GetFileSize",
  2177. "kernel32.dll.GetFileType",
  2178. "advapi32.dll.RegQueryValueExA",
  2179. "advapi32.dll.RegOpenKeyExA",
  2180. "advapi32.dll.RegCloseKey",
  2181. "comctl32.dll.ImageList_SetIconSize",
  2182. "comctl32.dll.ImageList_GetIconSize",
  2183. "comctl32.dll.ImageList_Write",
  2184. "comctl32.dll.ImageList_Read",
  2185. "comctl32.dll.ImageList_GetDragImage",
  2186. "comctl32.dll.ImageList_DragShowNolock",
  2187. "comctl32.dll.ImageList_SetDragCursorImage",
  2188. "comctl32.dll.ImageList_DragMove",
  2189. "comctl32.dll.ImageList_DragLeave",
  2190. "comctl32.dll.ImageList_DragEnter",
  2191. "comctl32.dll.ImageList_EndDrag",
  2192. "comctl32.dll.ImageList_BeginDrag",
  2193. "comctl32.dll.ImageList_Remove",
  2194. "comctl32.dll.ImageList_DrawEx",
  2195. "comctl32.dll.ImageList_Replace",
  2196. "comctl32.dll.ImageList_Draw",
  2197. "comctl32.dll.ImageList_GetBkColor",
  2198. "comctl32.dll.ImageList_SetBkColor",
  2199. "comctl32.dll.ImageList_ReplaceIcon",
  2200. "comctl32.dll.ImageList_Add",
  2201. "comctl32.dll.ImageList_SetImageCount",
  2202. "comctl32.dll.ImageList_GetImageCount",
  2203. "comctl32.dll.ImageList_Destroy",
  2204. "comctl32.dll.ImageList_Create",
  2205. "comctl32.dll.InitCommonControls",
  2206. "comdlg32.dll.GetOpenFileNameA",
  2207. "gdi32.dll.UnrealizeObject",
  2208. "gdi32.dll.TextOutA",
  2209. "gdi32.dll.StretchBlt",
  2210. "gdi32.dll.StartPage",
  2211. "gdi32.dll.StartDocA",
  2212. "gdi32.dll.SetWindowOrgEx",
  2213. "gdi32.dll.SetWindowExtEx",
  2214. "gdi32.dll.SetWinMetaFileBits",
  2215. "gdi32.dll.SetViewportOrgEx",
  2216. "gdi32.dll.SetViewportExtEx",
  2217. "gdi32.dll.SetTextColor",
  2218. "gdi32.dll.SetStretchBltMode",
  2219. "gdi32.dll.SetROP2",
  2220. "gdi32.dll.SetPixel",
  2221. "gdi32.dll.SetMapMode",
  2222. "gdi32.dll.SetEnhMetaFileBits",
  2223. "gdi32.dll.SetDIBColorTable",
  2224. "gdi32.dll.SetBrushOrgEx",
  2225. "gdi32.dll.SetBkMode",
  2226. "gdi32.dll.SetBkColor",
  2227. "gdi32.dll.SetAbortProc",
  2228. "gdi32.dll.SelectPalette",
  2229. "gdi32.dll.SelectObject",
  2230. "gdi32.dll.SelectClipRgn",
  2231. "gdi32.dll.SaveDC",
  2232. "gdi32.dll.RestoreDC",
  2233. "gdi32.dll.Rectangle",
  2234. "gdi32.dll.RectVisible",
  2235. "gdi32.dll.RealizePalette",
  2236. "gdi32.dll.Polyline",
  2237. "gdi32.dll.PolyPolyline",
  2238. "gdi32.dll.PlayEnhMetaFile",
  2239. "gdi32.dll.PatBlt",
  2240. "gdi32.dll.MoveToEx",
  2241. "gdi32.dll.MaskBlt",
  2242. "gdi32.dll.LineTo",
  2243. "gdi32.dll.IntersectClipRect",
  2244. "gdi32.dll.GetWindowOrgEx",
  2245. "gdi32.dll.GetWinMetaFileBits",
  2246. "gdi32.dll.GetTextMetricsA",
  2247. "gdi32.dll.GetTextExtentPointA",
  2248. "gdi32.dll.GetTextExtentPoint32A",
  2249. "gdi32.dll.GetSystemPaletteEntries",
  2250. "gdi32.dll.GetStockObject",
  2251. "gdi32.dll.GetPolyFillMode",
  2252. "gdi32.dll.GetPixel",
  2253. "gdi32.dll.GetPaletteEntries",
  2254. "gdi32.dll.GetObjectA",
  2255. "gdi32.dll.GetNearestColor",
  2256. "gdi32.dll.GetMapMode",
  2257. "gdi32.dll.GetEnhMetaFilePaletteEntries",
  2258. "gdi32.dll.GetEnhMetaFileHeader",
  2259. "gdi32.dll.GetEnhMetaFileDescriptionA",
  2260. "gdi32.dll.GetEnhMetaFileBits",
  2261. "gdi32.dll.GetDeviceCaps",
  2262. "gdi32.dll.GetDIBits",
  2263. "gdi32.dll.GetDIBColorTable",
  2264. "gdi32.dll.GetDCOrgEx",
  2265. "gdi32.dll.GetDCPenColor",
  2266. "gdi32.dll.GetDCBrushColor",
  2267. "gdi32.dll.GetCurrentPositionEx",
  2268. "gdi32.dll.GetClipBox",
  2269. "gdi32.dll.GetBrushOrgEx",
  2270. "gdi32.dll.GetBitmapBits",
  2271. "gdi32.dll.ExtTextOutA",
  2272. "gdi32.dll.ExtCreatePen",
  2273. "gdi32.dll.ExcludeClipRect",
  2274. "gdi32.dll.EndPage",
  2275. "gdi32.dll.EndDoc",
  2276. "gdi32.dll.DeleteObject",
  2277. "gdi32.dll.DeleteEnhMetaFile",
  2278. "gdi32.dll.DeleteDC",
  2279. "gdi32.dll.CreateSolidBrush",
  2280. "gdi32.dll.CreatePenIndirect",
  2281. "gdi32.dll.CreatePalette",
  2282. "gdi32.dll.CreateICA",
  2283. "gdi32.dll.CreateHalftonePalette",
  2284. "gdi32.dll.CreateFontIndirectA",
  2285. "gdi32.dll.CreateEnhMetaFileA",
  2286. "gdi32.dll.CreateDIBitmap",
  2287. "gdi32.dll.CreateDIBSection",
  2288. "gdi32.dll.CreateDCA",
  2289. "gdi32.dll.CreateCompatibleDC",
  2290. "gdi32.dll.CreateCompatibleBitmap",
  2291. "gdi32.dll.CreateBrushIndirect",
  2292. "gdi32.dll.CreateBitmap",
  2293. "gdi32.dll.CopyEnhMetaFileA",
  2294. "gdi32.dll.CloseEnhMetaFile",
  2295. "gdi32.dll.BitBlt",
  2296. "ole32.dll.CreateStreamOnHGlobal",
  2297. "ole32.dll.IsAccelerator",
  2298. "ole32.dll.OleDraw",
  2299. "ole32.dll.OleSetMenuDescriptor",
  2300. "ole32.dll.CoTaskMemFree",
  2301. "ole32.dll.ProgIDFromCLSID",
  2302. "ole32.dll.StringFromCLSID",
  2303. "ole32.dll.CoCreateInstance",
  2304. "ole32.dll.CoGetClassObject",
  2305. "ole32.dll.CoUninitialize",
  2306. "ole32.dll.CoInitialize",
  2307. "ole32.dll.IsEqualGUID",
  2308. "oleaut32.dll.SafeArrayPtrOfIndex",
  2309. "oleaut32.dll.SafeArrayPutElement",
  2310. "oleaut32.dll.SafeArrayGetElement",
  2311. "oleaut32.dll.SafeArrayUnaccessData",
  2312. "oleaut32.dll.SafeArrayAccessData",
  2313. "oleaut32.dll.SafeArrayGetUBound",
  2314. "oleaut32.dll.SafeArrayGetLBound",
  2315. "oleaut32.dll.SafeArrayCreate",
  2316. "oleaut32.dll.VariantChangeType",
  2317. "oleaut32.dll.VariantCopyInd",
  2318. "oleaut32.dll.VariantCopy",
  2319. "oleaut32.dll.VariantClear",
  2320. "oleaut32.dll.VariantInit",
  2321. "oleaut32.dll.GetErrorInfo",
  2322. "oleaut32.dll.GetActiveObject",
  2323. "oleaut32.dll.SysFreeString",
  2324. "oleaut32.dll.SysReAllocStringLen",
  2325. "oleaut32.dll.SysAllocStringLen",
  2326. "shell32.dll.ShellExecuteA",
  2327. "user32.dll.CreateWindowExA",
  2328. "user32.dll.WindowFromPoint",
  2329. "user32.dll.WinHelpA",
  2330. "user32.dll.WaitMessage",
  2331. "user32.dll.ValidateRect",
  2332. "user32.dll.UpdateWindow",
  2333. "user32.dll.UnregisterClassA",
  2334. "user32.dll.UnionRect",
  2335. "user32.dll.UnhookWindowsHookEx",
  2336. "user32.dll.TranslateMessage",
  2337. "user32.dll.TranslateMDISysAccel",
  2338. "user32.dll.TrackPopupMenu",
  2339. "user32.dll.SystemParametersInfoA",
  2340. "user32.dll.ShowWindow",
  2341. "user32.dll.ShowScrollBar",
  2342. "user32.dll.ShowOwnedPopups",
  2343. "user32.dll.ShowCursor",
  2344. "user32.dll.SetWindowsHookExA",
  2345. "user32.dll.SetWindowTextA",
  2346. "user32.dll.SetWindowPos",
  2347. "user32.dll.SetWindowPlacement",
  2348. "user32.dll.SetWindowLongA",
  2349. "user32.dll.SetTimer",
  2350. "user32.dll.SetScrollRange",
  2351. "user32.dll.SetScrollPos",
  2352. "user32.dll.SetScrollInfo",
  2353. "user32.dll.SetRect",
  2354. "user32.dll.SetPropA",
  2355. "user32.dll.SetParent",
  2356. "user32.dll.SetMenuItemInfoA",
  2357. "user32.dll.SetMenu",
  2358. "user32.dll.SetKeyboardState",
  2359. "user32.dll.SetForegroundWindow",
  2360. "user32.dll.SetFocus",
  2361. "user32.dll.SetCursor",
  2362. "user32.dll.SetClipboardData",
  2363. "user32.dll.SetClassLongA",
  2364. "user32.dll.SetCapture",
  2365. "user32.dll.SetActiveWindow",
  2366. "user32.dll.SendMessageA",
  2367. "user32.dll.ScrollWindowEx",
  2368. "user32.dll.ScrollWindow",
  2369. "user32.dll.ScreenToClient",
  2370. "user32.dll.RemovePropA",
  2371. "user32.dll.RemoveMenu",
  2372. "user32.dll.ReleaseDC",
  2373. "user32.dll.ReleaseCapture",
  2374. "user32.dll.RegisterWindowMessageA",
  2375. "user32.dll.RegisterClipboardFormatA",
  2376. "user32.dll.RegisterClassA",
  2377. "user32.dll.RedrawWindow",
  2378. "user32.dll.PtInRect",
  2379. "user32.dll.PostQuitMessage",
  2380. "user32.dll.PostMessageA",
  2381. "user32.dll.PeekMessageA",
  2382. "user32.dll.OpenClipboard",
  2383. "user32.dll.OffsetRect",
  2384. "user32.dll.OemToCharBuffA",
  2385. "user32.dll.OemToCharA",
  2386. "user32.dll.MessageBoxA",
  2387. "user32.dll.MessageBeep",
  2388. "user32.dll.MapWindowPoints",
  2389. "user32.dll.MapVirtualKeyA",
  2390. "user32.dll.LoadStringA",
  2391. "user32.dll.LoadKeyboardLayoutA",
  2392. "user32.dll.LoadIconA",
  2393. "user32.dll.LoadCursorA",
  2394. "user32.dll.LoadBitmapA",
  2395. "user32.dll.KillTimer",
  2396. "user32.dll.IsZoomed",
  2397. "user32.dll.IsWindowVisible",
  2398. "user32.dll.IsWindowEnabled",
  2399. "user32.dll.IsWindow",
  2400. "user32.dll.IsRectEmpty",
  2401. "user32.dll.IsIconic",
  2402. "user32.dll.IsDialogMessageA",
  2403. "user32.dll.IsChild",
  2404. "user32.dll.IsCharAlphaNumericA",
  2405. "user32.dll.IsCharAlphaA",
  2406. "user32.dll.InvalidateRect",
  2407. "user32.dll.IntersectRect",
  2408. "user32.dll.InsertMenuItemA",
  2409. "user32.dll.InsertMenuA",
  2410. "user32.dll.InflateRect",
  2411. "user32.dll.GetWindowThreadProcessId",
  2412. "user32.dll.GetWindowTextA",
  2413. "user32.dll.GetWindowRect",
  2414. "user32.dll.GetWindowPlacement",
  2415. "user32.dll.GetWindowLongA",
  2416. "user32.dll.GetWindowDC",
  2417. "user32.dll.GetTopWindow",
  2418. "user32.dll.GetSystemMetrics",
  2419. "user32.dll.GetSystemMenu",
  2420. "user32.dll.GetSysColorBrush",
  2421. "user32.dll.GetSysColor",
  2422. "user32.dll.GetSubMenu",
  2423. "user32.dll.GetScrollRange",
  2424. "user32.dll.GetScrollPos",
  2425. "user32.dll.GetScrollInfo",
  2426. "user32.dll.GetPropA",
  2427. "user32.dll.GetParent",
  2428. "user32.dll.GetWindow",
  2429. "user32.dll.GetMessageTime",
  2430. "user32.dll.GetMenuStringA",
  2431. "user32.dll.GetMenuState",
  2432. "user32.dll.GetMenuItemInfoA",
  2433. "user32.dll.GetMenuItemID",
  2434. "user32.dll.GetMenuItemCount",
  2435. "user32.dll.GetMenu",
  2436. "user32.dll.GetLastActivePopup",
  2437. "user32.dll.GetKeyboardState",
  2438. "user32.dll.GetKeyboardLayoutNameA",
  2439. "user32.dll.GetKeyboardLayoutList",
  2440. "user32.dll.GetKeyboardLayout",
  2441. "user32.dll.GetKeyState",
  2442. "user32.dll.GetKeyNameTextA",
  2443. "user32.dll.GetIconInfo",
  2444. "user32.dll.GetForegroundWindow",
  2445. "user32.dll.GetFocus",
  2446. "user32.dll.GetDoubleClickTime",
  2447. "user32.dll.GetDlgItem",
  2448. "user32.dll.GetDesktopWindow",
  2449. "user32.dll.GetDCEx",
  2450. "user32.dll.GetDC",
  2451. "user32.dll.GetCursorPos",
  2452. "user32.dll.GetCursor",
  2453. "user32.dll.GetClipboardData",
  2454. "user32.dll.GetClientRect",
  2455. "user32.dll.GetClassNameA",
  2456. "user32.dll.GetClassInfoA",
  2457. "user32.dll.GetCaretPos",
  2458. "user32.dll.GetCapture",
  2459. "user32.dll.GetActiveWindow",
  2460. "user32.dll.FrameRect",
  2461. "user32.dll.FindWindowA",
  2462. "user32.dll.FillRect",
  2463. "user32.dll.EqualRect",
  2464. "user32.dll.EnumWindows",
  2465. "user32.dll.EnumThreadWindows",
  2466. "user32.dll.EnumClipboardFormats",
  2467. "user32.dll.EndPaint",
  2468. "user32.dll.EnableWindow",
  2469. "user32.dll.EnableScrollBar",
  2470. "user32.dll.EnableMenuItem",
  2471. "user32.dll.EmptyClipboard",
  2472. "user32.dll.DrawTextA",
  2473. "user32.dll.DrawMenuBar",
  2474. "user32.dll.DrawIconEx",
  2475. "user32.dll.DrawIcon",
  2476. "user32.dll.DrawFrameControl",
  2477. "user32.dll.DrawFocusRect",
  2478. "user32.dll.DrawEdge",
  2479. "user32.dll.DispatchMessageA",
  2480. "user32.dll.DestroyWindow",
  2481. "user32.dll.DestroyMenu",
  2482. "user32.dll.DestroyIcon",
  2483. "user32.dll.DestroyCursor",
  2484. "user32.dll.DeleteMenu",
  2485. "user32.dll.DefWindowProcA",
  2486. "user32.dll.DefMDIChildProcA",
  2487. "user32.dll.DefFrameProcA",
  2488. "user32.dll.CreatePopupMenu",
  2489. "user32.dll.CreateMenu",
  2490. "user32.dll.CreateIcon",
  2491. "user32.dll.CloseClipboard",
  2492. "user32.dll.ClientToScreen",
  2493. "user32.dll.CheckMenuItem",
  2494. "user32.dll.CallWindowProcA",
  2495. "user32.dll.CallNextHookEx",
  2496. "user32.dll.BeginPaint",
  2497. "user32.dll.CharPrevA",
  2498. "user32.dll.CharNextA",
  2499. "user32.dll.CharLowerBuffA",
  2500. "user32.dll.CharLowerA",
  2501. "user32.dll.CharUpperBuffA",
  2502. "user32.dll.CharToOemBuffA",
  2503. "user32.dll.CharToOemA",
  2504. "user32.dll.AdjustWindowRectEx",
  2505. "user32.dll.ActivateKeyboardLayout",
  2506. "user32.dll.GetKeyboardType",
  2507. "version.dll.VerQueryValueA",
  2508. "version.dll.GetFileVersionInfoSizeA",
  2509. "version.dll.GetFileVersionInfoA",
  2510. "winspool.drv.OpenPrinterA",
  2511. "winspool.drv.EnumPrintersA",
  2512. "winspool.drv.DocumentPropertiesA",
  2513. "winspool.drv.ClosePrinter",
  2514. "kernel32.dll.GetDiskFreeSpaceExA",
  2515. "oleaut32.dll.VariantChangeTypeEx",
  2516. "oleaut32.dll.VarNeg",
  2517. "oleaut32.dll.VarNot",
  2518. "oleaut32.dll.VarAdd",
  2519. "oleaut32.dll.VarSub",
  2520. "oleaut32.dll.VarMul",
  2521. "oleaut32.dll.VarDiv",
  2522. "oleaut32.dll.VarIdiv",
  2523. "oleaut32.dll.VarMod",
  2524. "oleaut32.dll.VarAnd",
  2525. "oleaut32.dll.VarOr",
  2526. "oleaut32.dll.VarXor",
  2527. "oleaut32.dll.VarCmp",
  2528. "oleaut32.dll.VarI4FromStr",
  2529. "oleaut32.dll.VarR4FromStr",
  2530. "oleaut32.dll.VarR8FromStr",
  2531. "oleaut32.dll.VarDateFromStr",
  2532. "oleaut32.dll.VarCyFromStr",
  2533. "oleaut32.dll.VarBoolFromStr",
  2534. "oleaut32.dll.VarBstrFromCy",
  2535. "oleaut32.dll.VarBstrFromDate",
  2536. "oleaut32.dll.VarBstrFromBool",
  2537. "user32.dll.GetMonitorInfoA",
  2538. "user32.dll.EnumDisplayMonitors",
  2539. "dwmapi.dll.DwmIsCompositionEnabled",
  2540. "gdi32.dll.GetLayout",
  2541. "gdi32.dll.GdiRealizationInfo",
  2542. "gdi32.dll.FontIsLinked",
  2543. "advapi32.dll.RegOpenKeyExW",
  2544. "advapi32.dll.RegQueryInfoKeyW",
  2545. "gdi32.dll.GetTextFaceAliasW",
  2546. "advapi32.dll.RegEnumValueW",
  2547. "advapi32.dll.RegQueryValueExW",
  2548. "gdi32.dll.GetFontAssocStatus",
  2549. "advapi32.dll.RegEnumKeyExW",
  2550. "gdi32.dll.GdiIsMetaPrintDC",
  2551. "user32.dll.AnimateWindow",
  2552. "comctl32.dll.InitializeFlatSB",
  2553. "comctl32.dll.UninitializeFlatSB",
  2554. "comctl32.dll.FlatSB_GetScrollProp",
  2555. "comctl32.dll.FlatSB_SetScrollProp",
  2556. "comctl32.dll.FlatSB_EnableScrollBar",
  2557. "comctl32.dll.FlatSB_ShowScrollBar",
  2558. "comctl32.dll.FlatSB_GetScrollRange",
  2559. "comctl32.dll.FlatSB_GetScrollInfo",
  2560. "comctl32.dll.FlatSB_GetScrollPos",
  2561. "comctl32.dll.FlatSB_SetScrollPos",
  2562. "comctl32.dll.FlatSB_SetScrollInfo",
  2563. "comctl32.dll.FlatSB_SetScrollRange",
  2564. "user32.dll.SetLayeredWindowAttributes",
  2565. "ole32.dll.CoCreateInstanceEx",
  2566. "ole32.dll.CoInitializeEx",
  2567. "ole32.dll.CoAddRefServerProcess",
  2568. "ole32.dll.CoReleaseServerProcess",
  2569. "ole32.dll.CoResumeClassObjects",
  2570. "ole32.dll.CoSuspendClassObjects",
  2571. "kernel32.dll.SortGetHandle",
  2572. "kernel32.dll.SortCloseHandle",
  2573. "olepro32.dll.OleCreatePropertyFrame",
  2574. "olepro32.dll.OleCreateFontIndirect",
  2575. "olepro32.dll.OleCreatePictureIndirect",
  2576. "olepro32.dll.OleLoadPicture",
  2577. "cryptbase.dll.SystemFunction036",
  2578. "uxtheme.dll.OpenThemeData",
  2579. "uxtheme.dll.CloseThemeData",
  2580. "uxtheme.dll.DrawThemeBackground",
  2581. "uxtheme.dll.DrawThemeText",
  2582. "uxtheme.dll.GetThemeBackgroundContentRect",
  2583. "uxtheme.dll.GetThemePartSize",
  2584. "uxtheme.dll.GetThemeTextExtent",
  2585. "uxtheme.dll.GetThemeTextMetrics",
  2586. "uxtheme.dll.GetThemeBackgroundRegion",
  2587. "uxtheme.dll.HitTestThemeBackground",
  2588. "uxtheme.dll.DrawThemeEdge",
  2589. "uxtheme.dll.DrawThemeIcon",
  2590. "uxtheme.dll.IsThemePartDefined",
  2591. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  2592. "uxtheme.dll.GetThemeColor",
  2593. "uxtheme.dll.GetThemeMetric",
  2594. "uxtheme.dll.GetThemeString",
  2595. "uxtheme.dll.GetThemeBool",
  2596. "uxtheme.dll.GetThemeInt",
  2597. "uxtheme.dll.GetThemeEnumValue",
  2598. "uxtheme.dll.GetThemePosition",
  2599. "uxtheme.dll.GetThemeFont",
  2600. "uxtheme.dll.GetThemeRect",
  2601. "uxtheme.dll.GetThemeMargins",
  2602. "uxtheme.dll.GetThemeIntList",
  2603. "uxtheme.dll.GetThemePropertyOrigin",
  2604. "uxtheme.dll.SetWindowTheme",
  2605. "uxtheme.dll.GetThemeFilename",
  2606. "uxtheme.dll.GetThemeSysColor",
  2607. "uxtheme.dll.GetThemeSysColorBrush",
  2608. "uxtheme.dll.GetThemeSysBool",
  2609. "uxtheme.dll.GetThemeSysSize",
  2610. "uxtheme.dll.GetThemeSysFont",
  2611. "uxtheme.dll.GetThemeSysString",
  2612. "uxtheme.dll.GetThemeSysInt",
  2613. "uxtheme.dll.IsThemeActive",
  2614. "uxtheme.dll.IsAppThemed",
  2615. "uxtheme.dll.GetWindowTheme",
  2616. "uxtheme.dll.EnableThemeDialogTexture",
  2617. "uxtheme.dll.IsThemeDialogTextureEnabled",
  2618. "uxtheme.dll.GetThemeAppProperties",
  2619. "uxtheme.dll.SetThemeAppProperties",
  2620. "uxtheme.dll.GetCurrentThemeName",
  2621. "uxtheme.dll.GetThemeDocumentationProperty",
  2622. "uxtheme.dll.DrawThemeParentBackground",
  2623. "uxtheme.dll.EnableTheming",
  2624. "gdi32.dll.GetTextExtentExPointWPri",
  2625. "comctl32.dll.InitCommonControlsEx",
  2626. "lpk.dll.LpkEditControl",
  2627. "comctl32.dll.HIMAGELIST_QueryInterface",
  2628. "comctl32.dll.DrawShadowText",
  2629. "comctl32.dll.DrawSizeBox",
  2630. "comctl32.dll.DrawScrollBar",
  2631. "comctl32.dll.SizeBoxHwnd",
  2632. "comctl32.dll.ScrollBar_MouseMove",
  2633. "comctl32.dll.ScrollBar_Menu",
  2634. "comctl32.dll.HandleScrollCmd",
  2635. "comctl32.dll.DetachScrollBars",
  2636. "comctl32.dll.AttachScrollBars",
  2637. "comctl32.dll.CCSetScrollInfo",
  2638. "comctl32.dll.CCGetScrollInfo",
  2639. "comctl32.dll.CCEnableScrollBar",
  2640. "comctl32.dll.QuerySystemGestureStatus",
  2641. "uxtheme.dll.#49",
  2642. "user32.dll.NotifyWinEvent",
  2643. "kernel32.dll.ExitThread",
  2644. "kernel32.dll.CreateToolhelp32Snapshot",
  2645. "kernel32.dll.Heap32ListFirst",
  2646. "kernel32.dll.Heap32ListNext",
  2647. "kernel32.dll.Heap32First",
  2648. "kernel32.dll.Heap32Next",
  2649. "kernel32.dll.Toolhelp32ReadProcessMemory",
  2650. "kernel32.dll.Process32First",
  2651. "kernel32.dll.Process32Next",
  2652. "kernel32.dll.Process32FirstW",
  2653. "kernel32.dll.Process32NextW",
  2654. "kernel32.dll.Thread32First",
  2655. "kernel32.dll.Thread32Next",
  2656. "kernel32.dll.Module32First",
  2657. "kernel32.dll.Module32Next",
  2658. "kernel32.dll.Module32FirstW",
  2659. "kernel32.dll.Module32NextW",
  2660. "kernel32.dll.TlsFree",
  2661. "kernel32.dll.TlsAlloc",
  2662. "advapi32.dll.RegSetValueExA",
  2663. "advapi32.dll.RegFlushKey",
  2664. "advapi32.dll.RegCreateKeyExA",
  2665. "kernel32.dll.GetModuleFileNameW",
  2666. "kernel32.dll.CreateDirectoryA",
  2667. "gdi32.dll.GetBkColor",
  2668. "user32.dll.CallWindowProcW",
  2669. "shfolder.dll.SHGetFolderPathA",
  2670. "ntdll.dll.NtUnmapViewOfSection",
  2671. "kernel32.dll.CreateProcessW",
  2672. "kernel32.dll.GetThreadContext",
  2673. "kernel32.dll.ReadProcessMemory",
  2674. "kernel32.dll.VirtualAllocEx",
  2675. "kernel32.dll.WriteProcessMemory",
  2676. "kernel32.dll.SetThreadContext",
  2677. "kernel32.dll.ResumeThread",
  2678. "kernel32.dll.TerminateProcess",
  2679. "kernel32.dll.RtlMoveMemory",
  2680. "user32.dll.GetCursorInfo",
  2681. "user32.dll.GetLastInputInfo",
  2682. "kernel32.dll.GetConsoleWindow",
  2683. "psapi.dll.GetModuleFileNameExA",
  2684. "psapi.dll.GetModuleFileNameExW",
  2685. "kernel32.dll.GlobalMemoryStatusEx",
  2686. "kernel32.dll.IsWow64Process",
  2687. "kernel32.dll.GetComputerNameExW",
  2688. "shell32.dll.IsUserAnAdmin",
  2689. "kernel32.dll.SetProcessDEPPolicy",
  2690. "kernel32.dll.IsProcessorFeaturePresent",
  2691. "user32.dll.GetWindowInfo",
  2692. "user32.dll.GetAncestor",
  2693. "user32.dll.EnumDisplayDevicesA",
  2694. "gdi32.dll.ExtTextOutW",
  2695. "shlwapi.dll.#12",
  2696. "windowscodecs.dll.DllGetClassObject",
  2697. "kernel32.dll.WerRegisterMemoryBlock",
  2698. "oleaut32.dll.#8",
  2699. "oleaut32.dll.#9",
  2700. "oleaut32.dll.#10"
  2701. ]
  2702.  
  2703. [*] Static Analysis: {
  2704. "pe": {
  2705. "peid_signatures": [
  2706. [
  2707. "UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser"
  2708. ]
  2709. ],
  2710. "imports": [
  2711. {
  2712. "imports": [
  2713. {
  2714. "name": "LoadLibraryA",
  2715. "address": "0x5bcb74"
  2716. },
  2717. {
  2718. "name": "GetProcAddress",
  2719. "address": "0x5bcb78"
  2720. },
  2721. {
  2722. "name": "VirtualProtect",
  2723. "address": "0x5bcb7c"
  2724. },
  2725. {
  2726. "name": "ExitProcess",
  2727. "address": "0x5bcb80"
  2728. }
  2729. ],
  2730. "dll": "KERNEL32.DLL"
  2731. },
  2732. {
  2733. "imports": [
  2734. {
  2735. "name": "RegCloseKey",
  2736. "address": "0x5bcb88"
  2737. }
  2738. ],
  2739. "dll": "advapi32.dll"
  2740. },
  2741. {
  2742. "imports": [
  2743. {
  2744. "name": "ImageList_Add",
  2745. "address": "0x5bcb90"
  2746. }
  2747. ],
  2748. "dll": "comctl32.dll"
  2749. },
  2750. {
  2751. "imports": [
  2752. {
  2753. "name": "GetOpenFileNameA",
  2754. "address": "0x5bcb98"
  2755. }
  2756. ],
  2757. "dll": "comdlg32.dll"
  2758. },
  2759. {
  2760. "imports": [
  2761. {
  2762. "name": "SaveDC",
  2763. "address": "0x5bcba0"
  2764. }
  2765. ],
  2766. "dll": "gdi32.dll"
  2767. },
  2768. {
  2769. "imports": [
  2770. {
  2771. "name": "OleDraw",
  2772. "address": "0x5bcba8"
  2773. }
  2774. ],
  2775. "dll": "ole32.dll"
  2776. },
  2777. {
  2778. "imports": [
  2779. {
  2780. "name": "VariantCopy",
  2781. "address": "0x5bcbb0"
  2782. }
  2783. ],
  2784. "dll": "oleaut32.dll"
  2785. },
  2786. {
  2787. "imports": [
  2788. {
  2789. "name": "ShellExecuteA",
  2790. "address": "0x5bcbb8"
  2791. }
  2792. ],
  2793. "dll": "shell32.dll"
  2794. },
  2795. {
  2796. "imports": [
  2797. {
  2798. "name": "GetDC",
  2799. "address": "0x5bcbc0"
  2800. }
  2801. ],
  2802. "dll": "user32.dll"
  2803. },
  2804. {
  2805. "imports": [
  2806. {
  2807. "name": "VerQueryValueA",
  2808. "address": "0x5bcbc8"
  2809. }
  2810. ],
  2811. "dll": "version.dll"
  2812. },
  2813. {
  2814. "imports": [
  2815. {
  2816. "name": "OpenPrinterA",
  2817. "address": "0x5bcbd0"
  2818. }
  2819. ],
  2820. "dll": "winspool.drv"
  2821. }
  2822. ],
  2823. "digital_signers": null,
  2824. "exported_dll_name": null,
  2825. "actual_checksum": "0x000bd809",
  2826. "overlay": null,
  2827. "imagebase": "0x00400000",
  2828. "reported_checksum": "0x00000000",
  2829. "icon_hash": null,
  2830. "entrypoint": "0x005aa0f0",
  2831. "timestamp": "1992-06-19 22:22:17",
  2832. "osversion": "4.0",
  2833. "sections": [
  2834. {
  2835. "name": "UPX0",
  2836. "characteristics": "IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2837. "virtual_address": "0x00001000",
  2838. "size_of_data": "0x00000000",
  2839. "entropy": "0.00",
  2840. "raw_address": "0x00000400",
  2841. "virtual_size": "0x00105000",
  2842. "characteristics_raw": "0xe0000080"
  2843. },
  2844. {
  2845. "name": "UPX1",
  2846. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2847. "virtual_address": "0x00106000",
  2848. "size_of_data": "0x000a4400",
  2849. "entropy": "7.95",
  2850. "raw_address": "0x00000400",
  2851. "virtual_size": "0x000a5000",
  2852. "characteristics_raw": "0xe0000040"
  2853. },
  2854. {
  2855. "name": ".rsrc",
  2856. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  2857. "virtual_address": "0x001ab000",
  2858. "size_of_data": "0x00011e00",
  2859. "entropy": "5.11",
  2860. "raw_address": "0x000a4800",
  2861. "virtual_size": "0x00012000",
  2862. "characteristics_raw": "0xc0000040"
  2863. }
  2864. ],
  2865. "resources": [
  2866. {
  2867. "name": "RT_CURSOR",
  2868. "language": "LANG_NEUTRAL",
  2869. "filetype": null,
  2870. "sublanguage": "SUBLANG_NEUTRAL",
  2871. "entropy": "0.00",
  2872. "offset": "0x000e6978",
  2873. "size": "0x00000134"
  2874. },
  2875. {
  2876. "name": "RT_CURSOR",
  2877. "language": "LANG_NEUTRAL",
  2878. "filetype": null,
  2879. "sublanguage": "SUBLANG_NEUTRAL",
  2880. "entropy": "0.00",
  2881. "offset": "0x000e6978",
  2882. "size": "0x00000134"
  2883. },
  2884. {
  2885. "name": "RT_CURSOR",
  2886. "language": "LANG_NEUTRAL",
  2887. "filetype": null,
  2888. "sublanguage": "SUBLANG_NEUTRAL",
  2889. "entropy": "0.00",
  2890. "offset": "0x000e6978",
  2891. "size": "0x00000134"
  2892. },
  2893. {
  2894. "name": "RT_CURSOR",
  2895. "language": "LANG_NEUTRAL",
  2896. "filetype": null,
  2897. "sublanguage": "SUBLANG_NEUTRAL",
  2898. "entropy": "0.00",
  2899. "offset": "0x000e6978",
  2900. "size": "0x00000134"
  2901. },
  2902. {
  2903. "name": "RT_CURSOR",
  2904. "language": "LANG_NEUTRAL",
  2905. "filetype": null,
  2906. "sublanguage": "SUBLANG_NEUTRAL",
  2907. "entropy": "0.00",
  2908. "offset": "0x000e6978",
  2909. "size": "0x00000134"
  2910. },
  2911. {
  2912. "name": "RT_CURSOR",
  2913. "language": "LANG_NEUTRAL",
  2914. "filetype": null,
  2915. "sublanguage": "SUBLANG_NEUTRAL",
  2916. "entropy": "0.00",
  2917. "offset": "0x000e6978",
  2918. "size": "0x00000134"
  2919. },
  2920. {
  2921. "name": "RT_CURSOR",
  2922. "language": "LANG_NEUTRAL",
  2923. "filetype": null,
  2924. "sublanguage": "SUBLANG_NEUTRAL",
  2925. "entropy": "0.00",
  2926. "offset": "0x000e6978",
  2927. "size": "0x00000134"
  2928. },
  2929. {
  2930. "name": "RT_BITMAP",
  2931. "language": "LANG_ARABIC",
  2932. "filetype": null,
  2933. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2934. "entropy": "0.00",
  2935. "offset": "0x000e8a74",
  2936. "size": "0x000000e8"
  2937. },
  2938. {
  2939. "name": "RT_BITMAP",
  2940. "language": "LANG_ARABIC",
  2941. "filetype": null,
  2942. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2943. "entropy": "0.00",
  2944. "offset": "0x000e8a74",
  2945. "size": "0x000000e8"
  2946. },
  2947. {
  2948. "name": "RT_BITMAP",
  2949. "language": "LANG_ARABIC",
  2950. "filetype": null,
  2951. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2952. "entropy": "0.00",
  2953. "offset": "0x000e8a74",
  2954. "size": "0x000000e8"
  2955. },
  2956. {
  2957. "name": "RT_BITMAP",
  2958. "language": "LANG_ARABIC",
  2959. "filetype": null,
  2960. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2961. "entropy": "0.00",
  2962. "offset": "0x000e8a74",
  2963. "size": "0x000000e8"
  2964. },
  2965. {
  2966. "name": "RT_BITMAP",
  2967. "language": "LANG_ARABIC",
  2968. "filetype": null,
  2969. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2970. "entropy": "0.00",
  2971. "offset": "0x000e8a74",
  2972. "size": "0x000000e8"
  2973. },
  2974. {
  2975. "name": "RT_BITMAP",
  2976. "language": "LANG_ARABIC",
  2977. "filetype": null,
  2978. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2979. "entropy": "0.00",
  2980. "offset": "0x000e8a74",
  2981. "size": "0x000000e8"
  2982. },
  2983. {
  2984. "name": "RT_BITMAP",
  2985. "language": "LANG_ARABIC",
  2986. "filetype": null,
  2987. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2988. "entropy": "0.00",
  2989. "offset": "0x000e8a74",
  2990. "size": "0x000000e8"
  2991. },
  2992. {
  2993. "name": "RT_BITMAP",
  2994. "language": "LANG_ARABIC",
  2995. "filetype": null,
  2996. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  2997. "entropy": "0.00",
  2998. "offset": "0x000e8a74",
  2999. "size": "0x000000e8"
  3000. },
  3001. {
  3002. "name": "RT_BITMAP",
  3003. "language": "LANG_ARABIC",
  3004. "filetype": null,
  3005. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3006. "entropy": "0.00",
  3007. "offset": "0x000e8a74",
  3008. "size": "0x000000e8"
  3009. },
  3010. {
  3011. "name": "RT_BITMAP",
  3012. "language": "LANG_ARABIC",
  3013. "filetype": null,
  3014. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3015. "entropy": "0.00",
  3016. "offset": "0x000e8a74",
  3017. "size": "0x000000e8"
  3018. },
  3019. {
  3020. "name": "RT_BITMAP",
  3021. "language": "LANG_ARABIC",
  3022. "filetype": null,
  3023. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3024. "entropy": "0.00",
  3025. "offset": "0x000e8a74",
  3026. "size": "0x000000e8"
  3027. },
  3028. {
  3029. "name": "RT_BITMAP",
  3030. "language": "LANG_ARABIC",
  3031. "filetype": null,
  3032. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3033. "entropy": "0.00",
  3034. "offset": "0x000e8a74",
  3035. "size": "0x000000e8"
  3036. },
  3037. {
  3038. "name": "RT_BITMAP",
  3039. "language": "LANG_ARABIC",
  3040. "filetype": null,
  3041. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3042. "entropy": "0.00",
  3043. "offset": "0x000e8a74",
  3044. "size": "0x000000e8"
  3045. },
  3046. {
  3047. "name": "RT_BITMAP",
  3048. "language": "LANG_ARABIC",
  3049. "filetype": null,
  3050. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3051. "entropy": "0.00",
  3052. "offset": "0x000e8a74",
  3053. "size": "0x000000e8"
  3054. },
  3055. {
  3056. "name": "RT_BITMAP",
  3057. "language": "LANG_ARABIC",
  3058. "filetype": null,
  3059. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3060. "entropy": "0.00",
  3061. "offset": "0x000e8a74",
  3062. "size": "0x000000e8"
  3063. },
  3064. {
  3065. "name": "RT_BITMAP",
  3066. "language": "LANG_ARABIC",
  3067. "filetype": null,
  3068. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3069. "entropy": "0.00",
  3070. "offset": "0x000e8a74",
  3071. "size": "0x000000e8"
  3072. },
  3073. {
  3074. "name": "RT_BITMAP",
  3075. "language": "LANG_ARABIC",
  3076. "filetype": null,
  3077. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3078. "entropy": "0.00",
  3079. "offset": "0x000e8a74",
  3080. "size": "0x000000e8"
  3081. },
  3082. {
  3083. "name": "RT_BITMAP",
  3084. "language": "LANG_ARABIC",
  3085. "filetype": null,
  3086. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3087. "entropy": "0.00",
  3088. "offset": "0x000e8a74",
  3089. "size": "0x000000e8"
  3090. },
  3091. {
  3092. "name": "RT_BITMAP",
  3093. "language": "LANG_ARABIC",
  3094. "filetype": null,
  3095. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3096. "entropy": "0.00",
  3097. "offset": "0x000e8a74",
  3098. "size": "0x000000e8"
  3099. },
  3100. {
  3101. "name": "RT_BITMAP",
  3102. "language": "LANG_ARABIC",
  3103. "filetype": null,
  3104. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3105. "entropy": "0.00",
  3106. "offset": "0x000e8a74",
  3107. "size": "0x000000e8"
  3108. },
  3109. {
  3110. "name": "RT_BITMAP",
  3111. "language": "LANG_ARABIC",
  3112. "filetype": null,
  3113. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3114. "entropy": "0.00",
  3115. "offset": "0x000e8a74",
  3116. "size": "0x000000e8"
  3117. },
  3118. {
  3119. "name": "RT_BITMAP",
  3120. "language": "LANG_ARABIC",
  3121. "filetype": null,
  3122. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3123. "entropy": "0.00",
  3124. "offset": "0x000e8a74",
  3125. "size": "0x000000e8"
  3126. },
  3127. {
  3128. "name": "RT_BITMAP",
  3129. "language": "LANG_ARABIC",
  3130. "filetype": null,
  3131. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3132. "entropy": "0.00",
  3133. "offset": "0x000e8a74",
  3134. "size": "0x000000e8"
  3135. },
  3136. {
  3137. "name": "RT_BITMAP",
  3138. "language": "LANG_ARABIC",
  3139. "filetype": null,
  3140. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3141. "entropy": "0.00",
  3142. "offset": "0x000e8a74",
  3143. "size": "0x000000e8"
  3144. },
  3145. {
  3146. "name": "RT_BITMAP",
  3147. "language": "LANG_ARABIC",
  3148. "filetype": null,
  3149. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3150. "entropy": "0.00",
  3151. "offset": "0x000e8a74",
  3152. "size": "0x000000e8"
  3153. },
  3154. {
  3155. "name": "RT_BITMAP",
  3156. "language": "LANG_ARABIC",
  3157. "filetype": null,
  3158. "sublanguage": "SUBLANG_ARABIC_EGYPT",
  3159. "entropy": "0.00",
  3160. "offset": "0x000e8a74",
  3161. "size": "0x000000e8"
  3162. },
  3163. {
  3164. "name": "RT_DIALOG",
  3165. "language": "LANG_NEUTRAL",
  3166. "filetype": null,
  3167. "sublanguage": "SUBLANG_NEUTRAL",
  3168. "entropy": "0.00",
  3169. "offset": "0x000f9384",
  3170. "size": "0x00000052"
  3171. },
  3172. {
  3173. "name": "RT_STRING",
  3174. "language": "LANG_NEUTRAL",
  3175. "filetype": null,
  3176. "sublanguage": "SUBLANG_NEUTRAL",
  3177. "entropy": "0.00",
  3178. "offset": "0x000fe724",
  3179. "size": "0x00000328"
  3180. },
  3181. {
  3182. "name": "RT_STRING",
  3183. "language": "LANG_NEUTRAL",
  3184. "filetype": null,
  3185. "sublanguage": "SUBLANG_NEUTRAL",
  3186. "entropy": "0.00",
  3187. "offset": "0x000fe724",
  3188. "size": "0x00000328"
  3189. },
  3190. {
  3191. "name": "RT_STRING",
  3192. "language": "LANG_NEUTRAL",
  3193. "filetype": null,
  3194. "sublanguage": "SUBLANG_NEUTRAL",
  3195. "entropy": "0.00",
  3196. "offset": "0x000fe724",
  3197. "size": "0x00000328"
  3198. },
  3199. {
  3200. "name": "RT_STRING",
  3201. "language": "LANG_NEUTRAL",
  3202. "filetype": null,
  3203. "sublanguage": "SUBLANG_NEUTRAL",
  3204. "entropy": "0.00",
  3205. "offset": "0x000fe724",
  3206. "size": "0x00000328"
  3207. },
  3208. {
  3209. "name": "RT_STRING",
  3210. "language": "LANG_NEUTRAL",
  3211. "filetype": null,
  3212. "sublanguage": "SUBLANG_NEUTRAL",
  3213. "entropy": "0.00",
  3214. "offset": "0x000fe724",
  3215. "size": "0x00000328"
  3216. },
  3217. {
  3218. "name": "RT_STRING",
  3219. "language": "LANG_NEUTRAL",
  3220. "filetype": null,
  3221. "sublanguage": "SUBLANG_NEUTRAL",
  3222. "entropy": "0.00",
  3223. "offset": "0x000fe724",
  3224. "size": "0x00000328"
  3225. },
  3226. {
  3227. "name": "RT_STRING",
  3228. "language": "LANG_NEUTRAL",
  3229. "filetype": null,
  3230. "sublanguage": "SUBLANG_NEUTRAL",
  3231. "entropy": "0.00",
  3232. "offset": "0x000fe724",
  3233. "size": "0x00000328"
  3234. },
  3235. {
  3236. "name": "RT_STRING",
  3237. "language": "LANG_NEUTRAL",
  3238. "filetype": null,
  3239. "sublanguage": "SUBLANG_NEUTRAL",
  3240. "entropy": "0.00",
  3241. "offset": "0x000fe724",
  3242. "size": "0x00000328"
  3243. },
  3244. {
  3245. "name": "RT_STRING",
  3246. "language": "LANG_NEUTRAL",
  3247. "filetype": null,
  3248. "sublanguage": "SUBLANG_NEUTRAL",
  3249. "entropy": "0.00",
  3250. "offset": "0x000fe724",
  3251. "size": "0x00000328"
  3252. },
  3253. {
  3254. "name": "RT_STRING",
  3255. "language": "LANG_NEUTRAL",
  3256. "filetype": null,
  3257. "sublanguage": "SUBLANG_NEUTRAL",
  3258. "entropy": "0.00",
  3259. "offset": "0x000fe724",
  3260. "size": "0x00000328"
  3261. },
  3262. {
  3263. "name": "RT_STRING",
  3264. "language": "LANG_NEUTRAL",
  3265. "filetype": null,
  3266. "sublanguage": "SUBLANG_NEUTRAL",
  3267. "entropy": "0.00",
  3268. "offset": "0x000fe724",
  3269. "size": "0x00000328"
  3270. },
  3271. {
  3272. "name": "RT_STRING",
  3273. "language": "LANG_NEUTRAL",
  3274. "filetype": null,
  3275. "sublanguage": "SUBLANG_NEUTRAL",
  3276. "entropy": "0.00",
  3277. "offset": "0x000fe724",
  3278. "size": "0x00000328"
  3279. },
  3280. {
  3281. "name": "RT_STRING",
  3282. "language": "LANG_NEUTRAL",
  3283. "filetype": null,
  3284. "sublanguage": "SUBLANG_NEUTRAL",
  3285. "entropy": "0.00",
  3286. "offset": "0x000fe724",
  3287. "size": "0x00000328"
  3288. },
  3289. {
  3290. "name": "RT_STRING",
  3291. "language": "LANG_NEUTRAL",
  3292. "filetype": null,
  3293. "sublanguage": "SUBLANG_NEUTRAL",
  3294. "entropy": "0.00",
  3295. "offset": "0x000fe724",
  3296. "size": "0x00000328"
  3297. },
  3298. {
  3299. "name": "RT_STRING",
  3300. "language": "LANG_NEUTRAL",
  3301. "filetype": null,
  3302. "sublanguage": "SUBLANG_NEUTRAL",
  3303. "entropy": "0.00",
  3304. "offset": "0x000fe724",
  3305. "size": "0x00000328"
  3306. },
  3307. {
  3308. "name": "RT_STRING",
  3309. "language": "LANG_NEUTRAL",
  3310. "filetype": null,
  3311. "sublanguage": "SUBLANG_NEUTRAL",
  3312. "entropy": "0.00",
  3313. "offset": "0x000fe724",
  3314. "size": "0x00000328"
  3315. },
  3316. {
  3317. "name": "RT_STRING",
  3318. "language": "LANG_NEUTRAL",
  3319. "filetype": null,
  3320. "sublanguage": "SUBLANG_NEUTRAL",
  3321. "entropy": "0.00",
  3322. "offset": "0x000fe724",
  3323. "size": "0x00000328"
  3324. },
  3325. {
  3326. "name": "RT_STRING",
  3327. "language": "LANG_NEUTRAL",
  3328. "filetype": null,
  3329. "sublanguage": "SUBLANG_NEUTRAL",
  3330. "entropy": "0.00",
  3331. "offset": "0x000fe724",
  3332. "size": "0x00000328"
  3333. },
  3334. {
  3335. "name": "RT_STRING",
  3336. "language": "LANG_NEUTRAL",
  3337. "filetype": null,
  3338. "sublanguage": "SUBLANG_NEUTRAL",
  3339. "entropy": "0.00",
  3340. "offset": "0x000fe724",
  3341. "size": "0x00000328"
  3342. },
  3343. {
  3344. "name": "RT_STRING",
  3345. "language": "LANG_NEUTRAL",
  3346. "filetype": null,
  3347. "sublanguage": "SUBLANG_NEUTRAL",
  3348. "entropy": "0.00",
  3349. "offset": "0x000fe724",
  3350. "size": "0x00000328"
  3351. },
  3352. {
  3353. "name": "RT_STRING",
  3354. "language": "LANG_NEUTRAL",
  3355. "filetype": null,
  3356. "sublanguage": "SUBLANG_NEUTRAL",
  3357. "entropy": "0.00",
  3358. "offset": "0x000fe724",
  3359. "size": "0x00000328"
  3360. },
  3361. {
  3362. "name": "RT_STRING",
  3363. "language": "LANG_NEUTRAL",
  3364. "filetype": null,
  3365. "sublanguage": "SUBLANG_NEUTRAL",
  3366. "entropy": "0.00",
  3367. "offset": "0x000fe724",
  3368. "size": "0x00000328"
  3369. },
  3370. {
  3371. "name": "RT_STRING",
  3372. "language": "LANG_NEUTRAL",
  3373. "filetype": null,
  3374. "sublanguage": "SUBLANG_NEUTRAL",
  3375. "entropy": "0.00",
  3376. "offset": "0x000fe724",
  3377. "size": "0x00000328"
  3378. },
  3379. {
  3380. "name": "RT_STRING",
  3381. "language": "LANG_NEUTRAL",
  3382. "filetype": null,
  3383. "sublanguage": "SUBLANG_NEUTRAL",
  3384. "entropy": "0.00",
  3385. "offset": "0x000fe724",
  3386. "size": "0x00000328"
  3387. },
  3388. {
  3389. "name": "RT_STRING",
  3390. "language": "LANG_NEUTRAL",
  3391. "filetype": null,
  3392. "sublanguage": "SUBLANG_NEUTRAL",
  3393. "entropy": "0.00",
  3394. "offset": "0x000fe724",
  3395. "size": "0x00000328"
  3396. },
  3397. {
  3398. "name": "RT_STRING",
  3399. "language": "LANG_NEUTRAL",
  3400. "filetype": null,
  3401. "sublanguage": "SUBLANG_NEUTRAL",
  3402. "entropy": "0.00",
  3403. "offset": "0x000fe724",
  3404. "size": "0x00000328"
  3405. },
  3406. {
  3407. "name": "RT_STRING",
  3408. "language": "LANG_NEUTRAL",
  3409. "filetype": null,
  3410. "sublanguage": "SUBLANG_NEUTRAL",
  3411. "entropy": "0.00",
  3412. "offset": "0x000fe724",
  3413. "size": "0x00000328"
  3414. },
  3415. {
  3416. "name": "RT_RCDATA",
  3417. "language": "LANG_NEUTRAL",
  3418. "filetype": null,
  3419. "sublanguage": "SUBLANG_NEUTRAL",
  3420. "entropy": "0.00",
  3421. "offset": "0x00139910",
  3422. "size": "0x00069acd"
  3423. },
  3424. {
  3425. "name": "RT_RCDATA",
  3426. "language": "LANG_NEUTRAL",
  3427. "filetype": null,
  3428. "sublanguage": "SUBLANG_NEUTRAL",
  3429. "entropy": "0.00",
  3430. "offset": "0x00139910",
  3431. "size": "0x00069acd"
  3432. },
  3433. {
  3434. "name": "RT_RCDATA",
  3435. "language": "LANG_NEUTRAL",
  3436. "filetype": null,
  3437. "sublanguage": "SUBLANG_NEUTRAL",
  3438. "entropy": "0.00",
  3439. "offset": "0x00139910",
  3440. "size": "0x00069acd"
  3441. },
  3442. {
  3443. "name": "RT_RCDATA",
  3444. "language": "LANG_NEUTRAL",
  3445. "filetype": null,
  3446. "sublanguage": "SUBLANG_NEUTRAL",
  3447. "entropy": "0.00",
  3448. "offset": "0x00139910",
  3449. "size": "0x00069acd"
  3450. },
  3451. {
  3452. "name": "RT_RCDATA",
  3453. "language": "LANG_NEUTRAL",
  3454. "filetype": null,
  3455. "sublanguage": "SUBLANG_NEUTRAL",
  3456. "entropy": "0.00",
  3457. "offset": "0x00139910",
  3458. "size": "0x00069acd"
  3459. }
  3460. ],
  3461. "dirents": [
  3462. {
  3463. "virtual_address": "0x00000000",
  3464. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  3465. "size": "0x00000000"
  3466. },
  3467. {
  3468. "virtual_address": "0x001bca84",
  3469. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  3470. "size": "0x0000029c"
  3471. },
  3472. {
  3473. "virtual_address": "0x001ab000",
  3474. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  3475. "size": "0x00011a84"
  3476. },
  3477. {
  3478. "virtual_address": "0x00000000",
  3479. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  3480. "size": "0x00000000"
  3481. },
  3482. {
  3483. "virtual_address": "0x00000000",
  3484. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  3485. "size": "0x00000000"
  3486. },
  3487. {
  3488. "virtual_address": "0x00000000",
  3489. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  3490. "size": "0x00000000"
  3491. },
  3492. {
  3493. "virtual_address": "0x00000000",
  3494. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  3495. "size": "0x00000000"
  3496. },
  3497. {
  3498. "virtual_address": "0x00000000",
  3499. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  3500. "size": "0x00000000"
  3501. },
  3502. {
  3503. "virtual_address": "0x00000000",
  3504. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  3505. "size": "0x00000000"
  3506. },
  3507. {
  3508. "virtual_address": "0x001aa2a0",
  3509. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  3510. "size": "0x00000018"
  3511. },
  3512. {
  3513. "virtual_address": "0x00000000",
  3514. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  3515. "size": "0x00000000"
  3516. },
  3517. {
  3518. "virtual_address": "0x00000000",
  3519. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  3520. "size": "0x00000000"
  3521. },
  3522. {
  3523. "virtual_address": "0x00000000",
  3524. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  3525. "size": "0x00000000"
  3526. },
  3527. {
  3528. "virtual_address": "0x00000000",
  3529. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  3530. "size": "0x00000000"
  3531. },
  3532. {
  3533. "virtual_address": "0x00000000",
  3534. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  3535. "size": "0x00000000"
  3536. },
  3537. {
  3538. "virtual_address": "0x00000000",
  3539. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  3540. "size": "0x00000000"
  3541. }
  3542. ],
  3543. "exports": [],
  3544. "guest_signers": {},
  3545. "imphash": "be80c76669cbf7df686368b57a7d5606",
  3546. "icon_fuzzy": null,
  3547. "icon": null,
  3548. "pdbpath": null,
  3549. "imported_dll_count": 11,
  3550. "versioninfo": []
  3551. }
  3552. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!