API tools faq
paste
paladin316

RTF_ae08190c43d14b810630a87713a1d90b_doc.json

paladin316
Jun 21st, 2019
2,205
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.33 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Msoffice"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "RTF_ae08190c43d14b810630a87713a1d90b.doc"
  7. [*] File Size: 107205
  8. [*] File Type: "Rich Text Format data, unknown version"
  9. [*] SHA256: "9feb5ebf55cd19ad5ba1a871d665b7fa76a7f3fd9e6ccd3b05ff7eb22726fb3d"
  10. [*] MD5: "ae08190c43d14b810630a87713a1d90b"
  11. [*] SHA1: "4fd94289849d33f0de321013327c3d2c500f6d26"
  12. [*] SHA512: "7ceefbe236a74953f43ec3d9a90f9958dbcdbe48373971ea3ca092a660b335846c4f56bbbfeae4095962c4f684640aa8d5368d0f31e6f90db9a4d07f56f9d1df"
  13. [*] CRC32: "FC407C12"
  14. [*] SSDEEP: "1536:+ssGJiiYC8tM4BkBEx2kPwFlb7qJDUFVl5Rny+u3PE:+c0iYC8Tkr"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  23. "Details": [
  24. {
  25. "IP": "104.18.24.243:80"
  26. },
  27. {
  28. "IP": "52.109.2.18:443"
  29. }
  30. ]
  31. },
  32. {
  33. "Description": "Performs some HTTP requests",
  34. "Details": [
  35. {
  36. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  37. },
  38. {
  39. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D"
  40. },
  41. {
  42. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D"
  43. },
  44. {
  45. "url": "http://visiontecnologica.cl/adobemccss.jpg"
  46. },
  47. {
  48. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  49. },
  50. {
  51. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  52. },
  53. {
  54. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  55. },
  56. {
  57. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  58. },
  59. {
  60. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  61. },
  62. {
  63. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  64. },
  65. {
  66. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  67. },
  68. {
  69. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  70. },
  71. {
  72. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  73. },
  74. {
  75. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  76. },
  77. {
  78. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  79. },
  80. {
  81. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  82. },
  83. {
  84. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  85. },
  86. {
  87. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  88. },
  89. {
  90. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  91. },
  92. {
  93. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  94. },
  95. {
  96. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  97. },
  98. {
  99. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  100. },
  101. {
  102. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  103. }
  104. ]
  105. },
  106. {
  107. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  108. "Details": [
  109. {
  110. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0c\\xfd_\\x80\\xcdf\\x8f}\\xabnuv\\xd8\\xd1\\xe8^%za\\x93;\\xe3yy\\xf0o\\xff7e\\x96\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  111. },
  112. {
  113. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00\\x13>/\\xd3\\xc5e\\x95c\\x14)\\xddh\\xbf,j\\xbf~\\xe0nj6\"0)\\xe6\\x19i\\xa3\\xa3\\x87\\x07\\x16\\x03\\xe5\\x18\\xd1\\x80\\x8f\\xebj\\x0e\\x9a3*\\x0e@\\x84\\x92\\xa7-\\x0fbz\\x02\\xe5\\xcex\\xb4*m\\xd17a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6\\xd6\\x1a\\xe9\\x15\\xd4of6gv\\xcc\\x8f\\x88\\x82\\xdfw#&\\xc0\\xd3\\xe2-\\xbf\\xc4t\\x9f\\x1a\\x8f\\xd1\\x9c\\x19\\<\\xb4\\x89\\xf9\\xfbe\\xdc\\x18i\\xab\\xe3\\xdd\\xb2ag"
  114. },
  115. {
  116. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  117. },
  118. {
  119. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb5q\\x81\\xbf \\xa99\\xdew\\x8d\\xca\\xean\\x99\\x90\\xf5\\xcdv\\xb6\\xbdp\\x1f\\x92\\xe7u\\x84\\xd6\\xb3\\xebt=\\x97j\\xd2\\x83\\xb2\\xd2\\x05v=\\xd3\\xc6&\\x1bs<$\\xee\\xa6\\xdc\\xd0\\xf8\\x8a\\x95\\xab\\xfc+\\x17j+mh>\\xf8\\xbax\\xe4\\xf1n\\x16\r\\x84\\xc0r\\xfd\\xdc!:\\x85=\\x08\\xf1\\xef\\xacq\\xba6u\\x85\\xff\\xae\\x8f\\x13\\xfb\\x9d}\\x9c\\xb0\\xac\\xe2^\\x86x\\x02sx\\x07)\\x12\\xd6:b\\xaf\\x0e\\xd3\\x06/z\\xddu\\xb0+\\x88\\xd8\\x9d\\xa1\\xd7\\xc4c\\x04\\xe9{mt\\x15?u\\xd1\\x15\\x94^it\\xda\\x02\\xb7n#\\x17\\xf5\\x182\\xb8\\xf8\\x8c\\x03\\xb4:\\x07\\xc3m.=\\xc5\\xca4ya\\x0b\\x81d\t\\x9e\\xbco\\xc1w0m\\x98\\x8a\\x06\\xd0\\xce\\xfd\\x10i`\\x15\\xe8@\\xec\\xbe\\xc5\\xb4(\\xe7\\xb5m\\xc8b\\x97\\x04\\xed\\xe1\\\\xfe\\xb3\\x15c\\xbc0\\xa7hg\\x8f\\xe78\\xa9\\xa9\\x17z\\xbd5\\x8c\\xeb\\xda\\xc5ez\\xe5\\x0c\\xec\"\\x95\\xb7.\\xc8`\\x81\\xb6\\x80]\\xe3\\x1e\\x062\\x07e\\xf0\\x06"
  120. },
  121. {
  122. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x9b\\xa7\\x1fe/d\\x02\\x98)\\xa8{\\x04\\x06\\x8b\\xe3\\x8d\\xeb]1\\x96q8\\x1475a}\\xe1)\n\\xe0y\\xeb\\xfdb\\xff\\x7f\\x13\\xdf\\x1fy\\x8c\\xca\\xfc\\xcbo\\x0c*\\xa9\\x1d\\x0c\\xe0]\\xdb\\xb2\\xb2o\\x89\\x9f\\x02\nlv\\xba;\\x088\\xb5c\\x1ct\\xfcui{\\x91\\xe8\\xa6\\xeb\\xc4\\xed\\xe3\\xafl\\x0b\\xcbc0\\xc8\\\\x0b\\x02\\xd6\\x055\\xa1\\x8e59a\\xf3\\xa3\\x1d\\xb2\\xf3\\xb9u\\xec\\x8d\t\"\\xa5q\\xcf\\xf3\\xa64`1\\xb8\\xd7;#\\xbdhsg\\x15\\xe9\\x01i\\x8a\\x8am\\xf8h\\xcd\\xa2\\x10\\x01r\\x13\neng\\x90q\\x9f\\x95\\xd4 \\x85\\xbb\t\\x1e\\x8e0\\xaf\\x97\\x1b\\x1e\\x02\\xb6f\\x0b\\xdf\\xa7\\xeb\\xc5\\x99\\xc0\\x1c\\xf8l\\x15\\x16f\\xd3\\xcb\\xefh\\xc9\\x98\\x9e\\xa3\\xd3|\\xfe\\xbbog\\x1e\\xa5\t\\x06\\x94<m{x$\\x143[ou\\xba\\xb0\\x93\\xe91\\xcee'\\_\\xc5y\\x12\\xe7\\xce\\x08\\xa0\\xbe6:\\xbd\t\\x91*z]\\xbcg\\x7fal\\xea\\xdbpj\\xc3\\xe8\r\\xbe\\xd0h\\x88\\xf1\\xb9"
  123. }
  124. ]
  125. },
  126. {
  127. "Description": "File has been identified by 27 Antiviruses on VirusTotal as malicious",
  128. "Details": [
  129. {
  130. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  131. },
  132. {
  133. "McAfee": "Exploit-CVE2017-11882.bq"
  134. },
  135. {
  136. "NANO-Antivirus": "Exploit.Rtf.Heuristic-rtf.dinbqn"
  137. },
  138. {
  139. "Symantec": "Exp.CVE-2017-11882!g2"
  140. },
  141. {
  142. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.C"
  143. },
  144. {
  145. "TrendMicro-HouseCall": "Possible_SMCVE201711882YY1"
  146. },
  147. {
  148. "Avast": "Win32:ShellCode [Expl]"
  149. },
  150. {
  151. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  152. },
  153. {
  154. "Tencent": "Office.Exploit.Generic.Lmui"
  155. },
  156. {
  157. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  158. },
  159. {
  160. "TrendMicro": "HEUR_RTFMALFORM"
  161. },
  162. {
  163. "McAfee-GW-Edition": "Exploit-CVE2017-11882.bq"
  164. },
  165. {
  166. "Sophos": "Troj/RtfExp-EP"
  167. },
  168. {
  169. "Cyren": "CVE-2017-11882.C.gen!Camelot"
  170. },
  171. {
  172. "Jiangmin": "heur:Exploit.ShellCode.Gen"
  173. },
  174. {
  175. "Avira": "EXP/CVE-2017-11882.miqmq"
  176. },
  177. {
  178. "MAX": "malware (ai score=100)"
  179. },
  180. {
  181. "Antiy-AVL": "Trojan[Exploit]/RTF.Obscure.Gen"
  182. },
  183. {
  184. "Microsoft": "Trojan:Script/Foretype.A!ml"
  185. },
  186. {
  187. "AegisLab": "Hacktool.MSOffice.Generic.3!c"
  188. },
  189. {
  190. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  191. },
  192. {
  193. "GData": "Script.Trojan.Agent.ESR25I"
  194. },
  195. {
  196. "AhnLab-V3": "RTF/Malform-A.Gen"
  197. },
  198. {
  199. "Zoner": "Probably RTFBadSpacing"
  200. },
  201. {
  202. "Rising": "Exploit.CVE-2017-11882!1.B924 (CLASSIC)"
  203. },
  204. {
  205. "AVG": "Win32:ShellCode [Expl]"
  206. },
  207. {
  208. "Qihoo-360": "virus.exp.21711882.d"
  209. }
  210. ]
  211. }
  212. ]
  213.  
  214. [*] Started Service: []
  215.  
  216. [*] Executed Commands: []
  217.  
  218. [*] Mutexes: [
  219. "CicLoadWinStaWinSta0",
  220. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  221. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  222. ]
  223.  
  224. [*] Modified Files: [
  225. "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_ae08190c43d14b810630a87713a1d90b.doc",
  226. "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_ae08190c43d14b810630a87713a1d90b.doc",
  227. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{52DEE202-2A0E-4204-B59C-C2BD16A88CF1}.tmp",
  228. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{697DE02D-335A-4BA0-B9F1-0D7992D02A8D}.tmp",
  229. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{8CB115F9-84E3-4BAE-B5BF-6A39A386D117}.tmp",
  230. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  231. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  232. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  233. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab31D4.tmp",
  234. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar31D5.tmp"
  235. ]
  236.  
  237. [*] Deleted Files: [
  238. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab31D4.tmp",
  239. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar31D5.tmp"
  240. ]
  241.  
  242. [*] Modified Registry Keys: [
  243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\)tk",
  244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  248. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  249. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles"
  250. ]
  251.  
  252. [*] Deleted Registry Keys: []
  253.  
  254. [*] DNS Communications: [
  255. {
  256. "type": "A",
  257. "request": "bit.ly",
  258. "answers": [
  259. {
  260. "data": "67.199.248.11",
  261. "type": "A"
  262. },
  263. {
  264. "data": "67.199.248.10",
  265. "type": "A"
  266. }
  267. ]
  268. },
  269. {
  270. "type": "A",
  271. "request": "visiontecnologica.cl",
  272. "answers": [
  273. {
  274. "data": "200.35.157.35",
  275. "type": "A"
  276. }
  277. ]
  278. },
  279. {
  280. "type": "A",
  281. "request": "Wealthybond.ddns.me",
  282. "answers": [
  283. {
  284. "data": "52.47.77.228",
  285. "type": "A"
  286. }
  287. ]
  288. }
  289. ]
  290.  
  291. [*] Domains: [
  292. {
  293. "ip": "67.199.248.11",
  294. "domain": "bit.ly"
  295. },
  296. {
  297. "ip": "52.47.77.228",
  298. "domain": "Wealthybond.ddns.me"
  299. },
  300. {
  301. "ip": "200.35.157.35",
  302. "domain": "visiontecnologica.cl"
  303. }
  304. ]
  305.  
  306. [*] Network Communication - ICMP: []
  307.  
  308. [*] Network Communication - HTTP: [
  309. {
  310. "count": 1,
  311. "body": "",
  312. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  313. "user-agent": "Microsoft-CryptoAPI/6.1",
  314. "method": "GET",
  315. "host": "ocsp.msocsp.com",
  316. "version": "1.1",
  317. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  318. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  319. "port": 80
  320. },
  321. {
  322. "count": 1,
  323. "body": "",
  324. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D",
  325. "user-agent": "Microsoft-CryptoAPI/6.1",
  326. "method": "GET",
  327. "host": "ocsp.digicert.com",
  328. "version": "1.1",
  329. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D",
  330. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  331. "port": 80
  332. },
  333. {
  334. "count": 1,
  335. "body": "",
  336. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D",
  337. "user-agent": "Microsoft-CryptoAPI/6.1",
  338. "method": "GET",
  339. "host": "ocsp.digicert.com",
  340. "version": "1.1",
  341. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D",
  342. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEA1kd7OezZYbS8QeYg%2BXrX4%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  343. "port": 80
  344. },
  345. {
  346. "count": 1,
  347. "body": "",
  348. "uri": "http://visiontecnologica.cl/adobemccss.jpg",
  349. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  350. "method": "GET",
  351. "host": "visiontecnologica.cl",
  352. "version": "1.1",
  353. "path": "/adobemccss.jpg",
  354. "data": "GET /adobemccss.jpg HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nConnection: Keep-Alive\r\nHost: visiontecnologica.cl\r\n\r\n",
  355. "port": 80
  356. },
  357. {
  358. "count": 2,
  359. "body": "",
  360. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  361. "user-agent": "Microsoft-CryptoAPI/6.1",
  362. "method": "GET",
  363. "host": "ocsp.pki.goog",
  364. "version": "1.1",
  365. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  366. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  367. "port": 80
  368. },
  369. {
  370. "count": 2,
  371. "body": "",
  372. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  373. "user-agent": "Microsoft-CryptoAPI/6.1",
  374. "method": "GET",
  375. "host": "ocsp.digicert.com",
  376. "version": "1.1",
  377. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  378. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  379. "port": 80
  380. },
  381. {
  382. "count": 1,
  383. "body": "",
  384. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  385. "user-agent": "Microsoft-CryptoAPI/6.1",
  386. "method": "GET",
  387. "host": "www.download.windowsupdate.com",
  388. "version": "1.1",
  389. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  390. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  391. "port": 80
  392. },
  393. {
  394. "count": 2,
  395. "body": "",
  396. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  397. "user-agent": "Microsoft-CryptoAPI/6.1",
  398. "method": "GET",
  399. "host": "crl.microsoft.com",
  400. "version": "1.1",
  401. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  402. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  403. "port": 80
  404. },
  405. {
  406. "count": 1,
  407. "body": "",
  408. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  409. "user-agent": "Microsoft-CryptoAPI/6.1",
  410. "method": "GET",
  411. "host": "ocsp.digicert.com",
  412. "version": "1.1",
  413. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  414. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  415. "port": 80
  416. },
  417. {
  418. "count": 1,
  419. "body": "",
  420. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  421. "user-agent": "Microsoft-CryptoAPI/6.1",
  422. "method": "GET",
  423. "host": "ocsp.digicert.com",
  424. "version": "1.1",
  425. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  426. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  427. "port": 80
  428. },
  429. {
  430. "count": 2,
  431. "body": "",
  432. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  433. "user-agent": "Microsoft-CryptoAPI/6.1",
  434. "method": "GET",
  435. "host": "ocsp.digicert.com",
  436. "version": "1.1",
  437. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  438. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  439. "port": 80
  440. },
  441. {
  442. "count": 1,
  443. "body": "",
  444. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  445. "user-agent": "Microsoft-CryptoAPI/6.1",
  446. "method": "GET",
  447. "host": "ocsp.pki.goog",
  448. "version": "1.1",
  449. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  450. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  451. "port": 80
  452. },
  453. {
  454. "count": 1,
  455. "body": "",
  456. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  457. "user-agent": "Microsoft-CryptoAPI/6.1",
  458. "method": "GET",
  459. "host": "ocsp.pki.goog",
  460. "version": "1.1",
  461. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  462. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  463. "port": 80
  464. },
  465. {
  466. "count": 1,
  467. "body": "",
  468. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  469. "user-agent": "Microsoft-CryptoAPI/6.1",
  470. "method": "GET",
  471. "host": "ocsp.digicert.com",
  472. "version": "1.1",
  473. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  474. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  475. "port": 80
  476. },
  477. {
  478. "count": 1,
  479. "body": "",
  480. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  481. "user-agent": "Microsoft-CryptoAPI/6.1",
  482. "method": "GET",
  483. "host": "ocsp.pki.goog",
  484. "version": "1.1",
  485. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  486. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  487. "port": 80
  488. },
  489. {
  490. "count": 1,
  491. "body": "",
  492. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  493. "user-agent": "Microsoft-CryptoAPI/6.1",
  494. "method": "GET",
  495. "host": "ocsp.thawte.com",
  496. "version": "1.1",
  497. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  498. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  499. "port": 80
  500. },
  501. {
  502. "count": 1,
  503. "body": "",
  504. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  505. "user-agent": "Microsoft-CryptoAPI/6.1",
  506. "method": "GET",
  507. "host": "ocsp.usertrust.com",
  508. "version": "1.1",
  509. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  510. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  511. "port": 80
  512. },
  513. {
  514. "count": 1,
  515. "body": "",
  516. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  517. "user-agent": "Microsoft-CryptoAPI/6.1",
  518. "method": "GET",
  519. "host": "th.symcd.com",
  520. "version": "1.1",
  521. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  522. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  523. "port": 80
  524. },
  525. {
  526. "count": 1,
  527. "body": "",
  528. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  529. "user-agent": "Microsoft-CryptoAPI/6.1",
  530. "method": "GET",
  531. "host": "ocsp.digicert.com",
  532. "version": "1.1",
  533. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  534. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  535. "port": 80
  536. },
  537. {
  538. "count": 1,
  539. "body": "",
  540. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  541. "user-agent": "Microsoft-CryptoAPI/6.1",
  542. "method": "GET",
  543. "host": "ocsp.digicert.com",
  544. "version": "1.1",
  545. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  546. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  547. "port": 80
  548. },
  549. {
  550. "count": 1,
  551. "body": "",
  552. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  553. "user-agent": "Microsoft-CryptoAPI/6.1",
  554. "method": "GET",
  555. "host": "ocsp.pki.goog",
  556. "version": "1.1",
  557. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  558. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  559. "port": 80
  560. },
  561. {
  562. "count": 1,
  563. "body": "",
  564. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  565. "user-agent": "Microsoft-CryptoAPI/6.1",
  566. "method": "GET",
  567. "host": "crl.microsoft.com",
  568. "version": "1.1",
  569. "path": "/pki/crl/products/microsoftrootcert.crl",
  570. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  571. "port": 80
  572. },
  573. {
  574. "count": 1,
  575. "body": "",
  576. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  577. "user-agent": "Microsoft-CryptoAPI/6.1",
  578. "method": "GET",
  579. "host": "ocsp.digicert.com",
  580. "version": "1.1",
  581. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  582. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 91407\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 19 Jun 2019 10:50:29 GMT\r\nIf-None-Match: \"5d0a1375-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  583. "port": 80
  584. },
  585. {
  586. "count": 1,
  587. "body": "",
  588. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  589. "user-agent": "Microsoft-CryptoAPI/6.1",
  590. "method": "GET",
  591. "host": "ocsp.digicert.com",
  592. "version": "1.1",
  593. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  594. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 106387\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 19 Jun 2019 15:00:09 GMT\r\nIf-None-Match: \"5d0a4df9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  595. "port": 80
  596. },
  597. {
  598. "count": 1,
  599. "body": "",
  600. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  601. "user-agent": "Microsoft-CryptoAPI/6.1",
  602. "method": "GET",
  603. "host": "ocsp.digicert.com",
  604. "version": "1.1",
  605. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  606. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 125605\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 19 Jun 2019 18:30:28 GMT\r\nIf-None-Match: \"5d0a7f44-5e3\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  607. "port": 80
  608. }
  609. ]
  610.  
  611. [*] Network Communication - SMTP: []
  612.  
  613. [*] Network Communication - Hosts: []
  614.  
  615. [*] Network Communication - IRC: []
  616.  
  617. [*] Static Analysis: {}
  618.  
  619. [*] Resolved APIs: [
  620. "mso.dll.#1443",
  621. "mso.dll.#9214",
  622. "mso.dll.#199",
  623. "mso.dll.#1073",
  624. "mso.dll.#4255",
  625. "mso.dll.#3459",
  626. "mso.dll.#1262",
  627. "mso.dll.#5709",
  628. "mso.dll.#7353",
  629. "mso.dll.#5228",
  630. "mso.dll.#2155",
  631. "mso.dll.#7762",
  632. "mso.dll.#1283",
  633. "mso.dll.#2024",
  634. "mso.dll.#5274",
  635. "mso.dll.#3195",
  636. "mso.dll.#6221",
  637. "mso.dll.#469",
  638. "mso.dll.#7974",
  639. "mso.dll.#2609",
  640. "mso.dll.#8499",
  641. "mso.dll.#1725",
  642. "user32.dll.RegisterWindowMessageW",
  643. "mso.dll.#4314",
  644. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  645. "mso.dll.#6484",
  646. "mso.dll.#9871",
  647. "mso.dll.#4743",
  648. "mso.dll.#5452",
  649. "mso.dll.#2088",
  650. "mso.dll.#9175",
  651. "mso.dll.#5315",
  652. "mso.dll.#8140",
  653. "user32.dll.IsWindowEnabled",
  654. "ole32.dll.CoGetCallState",
  655. "ole32.dll.CoGetActivationState",
  656. "advapi32.dll.RegisterWaitChainCOMCallback",
  657. "bcryptprimitives.dll.GetHashInterface",
  658. "cryptnet.dll.CertDllVerifyRevocation",
  659. "sechost.dll.ConvertSidToStringSidW",
  660. "profapi.dll.#104",
  661. "sensapi.dll.IsNetworkAlive",
  662. "rpcrt4.dll.RpcBindingFromStringBindingW",
  663. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  664. "rpcrt4.dll.NdrClientCall2",
  665. "winhttp.dll.WinHttpOpen",
  666. "winhttp.dll.WinHttpSetTimeouts",
  667. "winhttp.dll.WinHttpSetOption",
  668. "winhttp.dll.WinHttpCrackUrl",
  669. "winhttp.dll.WinHttpConnect",
  670. "winhttp.dll.WinHttpOpenRequest",
  671. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  672. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  673. "winhttp.dll.WinHttpTimeFromSystemTime",
  674. "winhttp.dll.WinHttpSendRequest",
  675. "user32.dll.IsHungAppWindow",
  676. "winhttp.dll.WinHttpReceiveResponse",
  677. "winhttp.dll.WinHttpQueryHeaders",
  678. "shlwapi.dll.StrStrIW",
  679. "winhttp.dll.WinHttpQueryDataAvailable",
  680. "winhttp.dll.WinHttpReadData",
  681. "winhttp.dll.WinHttpCloseHandle",
  682. "cryptnet.dll.I_CryptNetGetConnectivity",
  683. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  684. "setupapi.dll.SetupIterateCabinetW",
  685. "kernel32.dll.RegOpenKeyExW",
  686. "kernel32.dll.RegCloseKey",
  687. "cabinet.dll.#20",
  688. "cabinet.dll.#22",
  689. "devrtl.dll.DevRtlGetThreadLogToken",
  690. "cryptsp.dll.CryptSetHashParam",
  691. "sechost.dll.OpenSCManagerW",
  692. "sechost.dll.OpenServiceW",
  693. "sechost.dll.QueryServiceConfigA",
  694. "sechost.dll.QueryServiceStatus",
  695. "sechost.dll.CloseServiceHandle",
  696. "rpcrt4.dll.RpcStringBindingComposeA",
  697. "rpcrt4.dll.RpcBindingFromStringBindingA",
  698. "rpcrt4.dll.RpcEpResolveBinding",
  699. "sechost.dll.LookupAccountSidLocalW",
  700. "rpcrt4.dll.RpcStringFreeA",
  701. "rpcrt4.dll.RpcBindingFree",
  702. "webservices.dll.WsResetHeap",
  703. "webservices.dll.WsCloseServiceProxy",
  704. "ws2_32.dll.#3",
  705. "webservices.dll.WsFreeServiceProxy",
  706. "ncrypt.dll.SslDecrementProviderReferenceCount",
  707. "ncrypt.dll.SslFreeObject",
  708. "user32.dll.RegisterPowerSettingNotification",
  709. "powrprof.dll.PowerSettingRegisterNotification",
  710. "user32.dll.GetWindowThreadProcessId",
  711. "user32.dll.GetWindowTextW",
  712. "mso.dll.#7589",
  713. "mso.dll.#5071",
  714. "mso.dll.#3633",
  715. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  716. "gdi32.dll.GetTextExtentPointA",
  717. "user32.dll.MessageBeep",
  718. "advapi32.dll.RegisterEventSourceW",
  719. "advapi32.dll.ReportEventW",
  720. "advapi32.dll.DeregisterEventSource",
  721. "gdi32.dll.GetViewportExtEx",
  722. "gdi32.dll.GetWindowExtEx",
  723. "gdi32.dll.GetMapMode",
  724. "gdi32.dll.GetTextAlign",
  725. "gdi32.dll.GetLayout",
  726. "user32.dll.IntersectRect",
  727. "user32.dll.InflateRect",
  728. "mso.dll.#1455",
  729. "mso.dll.#8735",
  730. "user32.dll.SetCursor",
  731. "user32.dll.EnableWindow",
  732. "user32.dll.GetCapture",
  733. "dwmapi.dll.DwmIsCompositionEnabled",
  734. "kernel32.dll.WerRegisterMemoryBlock",
  735. "dwrite.dll.DWriteCreateFactory",
  736. "gdi32.dll.CreateDIBSection",
  737. "gdi32.dll.CreateCompatibleDC",
  738. "gdi32.dll.GetViewportOrgEx",
  739. "gdi32.dll.SetViewportOrgEx",
  740. "gdi32.dll.GetCurrentObject",
  741. "gdi32.dll.BitBlt",
  742. "gdi32.dll.DeleteDC",
  743. "gdi32.dll.GetClipBox",
  744. "gdi32.dll.StretchDIBits",
  745. "riched20.dll.REExtendedRegisterClass",
  746. "user32.dll.GetWindowLongW",
  747. "user32.dll.GetSysColor",
  748. "user32.dll.SetWindowLongW",
  749. "user32.dll.RegisterWindowMessageA",
  750. "user32.dll.RegisterClipboardFormatW",
  751. "user32.dll.GetSystemMetrics",
  752. "user32.dll.GetDoubleClickTime",
  753. "user32.dll.SetCaretBlinkTime",
  754. "user32.dll.SystemParametersInfoW",
  755. "user32.dll.GetKeyboardLayoutList",
  756. "mso.dll._MsoGetFidUspDll@0",
  757. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  758. "usp10.dll.ScriptGetProperties",
  759. "usp10.dll.ScriptItemize",
  760. "user32.dll.LoadCursorW",
  761. "user32.dll.IsWindowVisible",
  762. "user32.dll.GetKeyboardLayout",
  763. "user32.dll.PostMessageW",
  764. "user32.dll.DefWindowProcW",
  765. "uxtheme.dll.IsThemeActive",
  766. "uxtheme.dll.IsAppThemed",
  767. "uxtheme.dll.OpenThemeData",
  768. "user32.dll.GetDC",
  769. "user32.dll.GetClientRect",
  770. "user32.dll.ReleaseDC",
  771. "user32.dll.SetScrollRange",
  772. "user32.dll.IsIconic",
  773. "user32.dll.GetParent",
  774. "usp10.dll.ScriptGetCMap",
  775. "user32.dll.InvalidateRect",
  776. "user32.dll.HideCaret",
  777. "user32.dll.ShowCaret",
  778. "user32.dll.IsWindowUnicode",
  779. "user32.dll.SendMessageW",
  780. "user32.dll.NotifyWinEvent",
  781. "user32.dll.GetWindowTextLengthW",
  782. "msctf.dll.SetInputScope",
  783. "user32.dll.UpdateWindow",
  784. "user32.dll.GetWindowRgn",
  785. "gdi32.dll.CreateCompatibleBitmap",
  786. "gdi32.dll.SaveDC",
  787. "gdi32.dll.SetPixel",
  788. "gdi32.dll.GetPixel",
  789. "gdi32.dll.RestoreDC",
  790. "imm32.dll.ImmAssociateContext",
  791. "user32.dll.GetForegroundWindow",
  792. "mso.dll.#2378",
  793. "user32.dll.EnumChildWindows",
  794. "user32.dll.GetClassNameA",
  795. "user32.dll.GetWindow",
  796. "user32.dll.IsWindowRedirectedForPrint",
  797. "gdi32.dll.CreateRectRgnIndirect",
  798. "user32.dll.GetUpdateRgn",
  799. "gdi32.dll.GetRgnBox",
  800. "user32.dll.ValidateRect",
  801. "user32.dll.GetUpdateRect",
  802. "user32.dll.BeginPaint",
  803. "user32.dll.EndPaint",
  804. "gdi32.dll.SetWindowOrgEx",
  805. "user32.dll.FillRect",
  806. "user32.dll.DialogBoxIndirectParamW",
  807. "comctl32.dll.RegisterClassNameW",
  808. "uxtheme.dll.EnableThemeDialogTexture",
  809. "uxtheme.dll.GetThemeBool",
  810. "user32.dll.GetDlgItem",
  811. "user32.dll.SetWindowTextW",
  812. "user32.dll.SetFocus",
  813. "gdi32.dll.GdiIsMetaPrintDC",
  814. "mso.dll.#6900",
  815. "user32.dll.CallNextHookEx",
  816. "uxtheme.dll.BufferedPaintInit",
  817. "uxtheme.dll.BufferedPaintRenderAnimation",
  818. "uxtheme.dll.GetThemeTransitionDuration",
  819. "uxtheme.dll.BeginBufferedAnimation",
  820. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  821. "uxtheme.dll.DrawThemeParentBackground",
  822. "uxtheme.dll.DrawThemeBackground",
  823. "uxtheme.dll.GetThemeBackgroundContentRect",
  824. "uxtheme.dll.DrawThemeText",
  825. "uxtheme.dll.EndBufferedAnimation",
  826. "user32.dll.GetDlgCtrlID",
  827. "gdi32.dll.SetBkMode",
  828. "gdi32.dll.SetTextColor",
  829. "gdi32.dll.ExtTextOutW",
  830. "ole32.dll.CoCreateInstance",
  831. "user32.dll.GetFocus",
  832. "mso.dll.#7531",
  833. "user32.dll.EnumWindows",
  834. "user32.dll.SetForegroundWindow",
  835. "ole32.dll.CoTaskMemFree",
  836. "ole32.dll.CoTaskMemAlloc",
  837. "ole32.dll.CoInitializeEx",
  838. "ole32.dll.CoUninitialize",
  839. "user32.dll.GetLastInputInfo",
  840. "ws2_32.dll.#116",
  841. "cabinet.dll.#23"
  842. ]
  843.  
  844. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!