Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

• Malicious Indicators 3

• Network Related
  • Found more than one unique User-Agent

    details

    Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
    Microsoft-CryptoAPI/6.1

    source

    Network Traffic

    relevance

    5/10

  • Malicious artifacts seen in the context of a contacted host

    details

    Found malicious artifacts related to "69.172.200.235" (ASN: 19324, Owner: Dosarrest Internet Security LTD): ...
    URL: http://test.com/ (AV positives: 1/65 scanned on 05/09/2017 08:17:02)
    URL: http://www.test.com/ (AV positives: 1/65 scanned on 05/09/2017 08:16:52)
    URL: https://www.test.com/ (AV positives: 1/65 scanned on 05/08/2017 07:28:19)
    URL: https://www.test.com/?test=123?test=123 (AV positives: 1/64 scanned on 05/04/2017 20:13:01)
    URL: http://test.com/xss.js (AV positives: 1/64 scanned on 05/02/2017 23:46:09)
    File SHA256: 3e7500e723f54ee6f1ddeaea6657e92526f175c7caa4467071ac2cadc60c9519 (AV positives: 46/61 scanned on 04/29/2017 16:04:10)
    File SHA256: 8b194919c2ef5c5c0558317e655a20a2afe78eff241f204007f5eec7a10094b2 (AV positives: 42/59 scanned on 04/24/2017 18:34:20)
    File SHA256: 8d3a35b75c6eff85de7154f7760a621061d5c0cbb58bea53e2a84a911a851bd8 (AV positives: 28/61 scanned on 03/26/2017 20:47:31)
    File SHA256: e5ef657586eaaf362d95e3d679b2a126366b2670fc9316f474974c2c27fa82fd (AV positives: 55/62 scanned on 03/22/2017 06:11:40)
    File SHA256: eb2cd28db3fa7b413e29a7043b2d2bbb80372f79ad50cba38038cfbc6fe3be10 (AV positives: 46/59 scanned on 03/05/2017 05:23:25)

    source

    Network Traffic

    relevance

    10/10

  • Multiple malicious artifacts seen in the context of different hosts

    details

    Found malicious artifacts related to "69.172.200.235" (ASN: 19324, Owner: Dosarrest Internet Security LTD): ...
    URL: http://test.com/ (AV positives: 1/65 scanned on 05/09/2017 08:17:02)
    URL: http://www.test.com/ (AV positives: 1/65 scanned on 05/09/2017 08:16:52)
    URL: https://www.test.com/ (AV positives: 1/65 scanned on 05/08/2017 07:28:19)
    URL: https://www.test.com/?test=123?test=123 (AV positives: 1/64 scanned on 05/04/2017 20:13:01)
    URL: http://test.com/xss.js (AV positives: 1/64 scanned on 05/02/2017 23:46:09)
    File SHA256: 3e7500e723f54ee6f1ddeaea6657e92526f175c7caa4467071ac2cadc60c9519 (AV positives: 46/61 scanned on 04/29/2017 16:04:10)
    File SHA256: 8b194919c2ef5c5c0558317e655a20a2afe78eff241f204007f5eec7a10094b2 (AV positives: 42/59 scanned on 04/24/2017 18:34:20)
    File SHA256: 8d3a35b75c6eff85de7154f7760a621061d5c0cbb58bea53e2a84a911a851bd8 (AV positives: 28/61 scanned on 03/26/2017 20:47:31)
    File SHA256: e5ef657586eaaf362d95e3d679b2a126366b2670fc9316f474974c2c27fa82fd (AV positives: 55/62 scanned on 03/22/2017 06:11:40)
    File SHA256: eb2cd28db3fa7b413e29a7043b2d2bbb80372f79ad50cba38038cfbc6fe3be10 (AV positives: 46/59 scanned on 03/05/2017 05:23:25)

    source

    Network Traffic

    relevance

    10/10

• Suspicious Indicators 2

• Network Related
  • Uses a User Agent typical for browsers, although no browser was ever launched

    details

    Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)

    source

    Network Traffic

    relevance

    10/10

• Unusual Characteristics
  • Imports suspicious APIs

    details

    GetFileAttributesA
    GetVersionExA
    GetModuleFileNameA
    LoadLibraryA
    GetCommandLineA
    GetProcAddress
    GetModuleHandleA
    WriteFile
    GetStartupInfoA
    TerminateProcess
    CreateProcessA
    VirtualAlloc

    source

    Static Parser

    relevance

    1/10

• Informative 6

• External Systems
  • Sample was identified as clean by Antivirus engines

    details

    0/61 Antivirus vendors marked sample as malicious (0% detection rate)

    source

    External System

    relevance

    10/10

• General
  • Contacts domains

    details

    "www.test.com"
    "ocsp.netsolssl.com"
    "crl.netsolssl.com"
    "stats.g.doubleclick.net"
    "fonts.googleapis.com"
    "www.googletagmanager.com"
    "www.google-analytics.com"
    "fonts.gstatic.com"

    source

    Network Traffic

    relevance

    1/10

  • Contacts server

    details

    "69.172.200.235:80"
    "69.172.200.235:443"
    "2.16.33.120:443"

    source

    Network Traffic

    relevance

    1/10

  • GETs files from a webserver

    details

    "GET / HTTP/1.1
    Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
    Accept-Language: en-us
    User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
    Accept-Encoding: gzip, deflate
    Host: www.test.com
    Connection: Keep-Alive"
    "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTaM15WuqpgzMcb2vjyKNO49Vo3CgQUUc7fVB23LFeraGFIAhrTsoXsQKoCEDee6%2Fy9H6fjn8WmaZue6LM%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: ocsp.netsolssl.com"
    "GET /NetworkSolutionsDVServerCA2.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.netsolssl.com"

    source

    Network Traffic

    relevance

    5/10

• Network Related
  • Found potential URL in binary/memory

    details

    Heuristic match: "command.com"
    Pattern match: "http://www.test.com"
    Pattern match: "www.test.com"
    Heuristic match: "ocsp.netsolssl.com"
    Heuristic match: "crl.netsolssl.com"

    source

    File/Memory

    relevance

    10/10

• Unusual Characteristics
  • Matched Compiler/Packer signature

    details

    "da.dll.bin" was detected as "Armadillo v1.xx - v2.xx"

    source

    Static Parser

    relevance

    10/10

File Sections

File Imports

• KERNEL32.dll

File Exports

DNS Requests

Domain	Address	Registrar	Country
crl.netsolssl.com	104.16.92.188	-	United States
stats.g.doubleclick.net	74.125.133.154	-	United States
fonts.googleapis.com	172.217.22.202	-	United States
www.test.com	69.172.200.235	-	United States
ocsp.netsolssl.com	178.255.83.1	-	United Kingdom
www.googletagmanager.com	172.217.22.200	-	United States
www.google-analytics.com	172.217.22.206	-	United States
fonts.gstatic.com	172.217.22.195	-	United States

Contacted Hosts

IP Address	Port/Protocol	Associated Process	Details
69.172.200.235 OSINT Associated Artifacts for 69.172.200.235 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://test.com/ Threat Level suspicious Positives 1/65 Scan Date 05/09/2017 08:17:02 Reference - http://test.com/ suspicious 1/65 05/09/2017 08:17:02 - Associated URL http://www.test.com/ Threat Level suspicious Positives 1/65 Scan Date 05/09/2017 08:16:52 Reference - http://www.test.com/ suspicious 1/65 05/09/2017 08:16:52 - Associated URL https://www.test.com/ Threat Level suspicious Positives 1/65 Scan Date 05/08/2017 07:28:19 Reference - https://www.test.com/ suspicious 1/65 05/08/2017 07:28:19 - Associated URL https://www.test.com/?test=123?test=123 Threat Level suspicious Positives 1/64 Scan Date 05/04/2017 20:13:01 Reference - https://www.test.com/?test=123?test=123 suspicious 1/64 05/04/2017 20:13:01 - Associated URL http://test.com/xss.js Threat Level suspicious Positives 1/64 Scan Date 05/02/2017 23:46:09 Reference - http://test.com/xss.js suspicious 1/64 05/02/2017 23:46:09 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 3e7500e723f54ee6f1ddeaea6657e92526f175c7caa4467071ac2cadc60c9519 Threat Level malicious Positives 46/61 Scan Date 04/29/2017 16:04:10 Reference VirusTotal 3e7500e723f54ee6f1ddeaea6657e92526f175c7caa4467071ac2cadc60c9519 malicious 46/61 04/29/2017 16:04:10 VirusTotal Associated SHA256 8b194919c2ef5c5c0558317e655a20a2afe78eff241f204007f5eec7a10094b2 Threat Level malicious Positives 42/59 Scan Date 04/24/2017 18:34:20 Reference VirusTotal 8b194919c2ef5c5c0558317e655a20a2afe78eff241f204007f5eec7a10094b2 malicious 42/59 04/24/2017 18:34:20 VirusTotal Associated SHA256 8d3a35b75c6eff85de7154f7760a621061d5c0cbb58bea53e2a84a911a851bd8 Threat Level malicious Positives 28/61 Scan Date 03/26/2017 20:47:31 Reference VirusTotal 8d3a35b75c6eff85de7154f7760a621061d5c0cbb58bea53e2a84a911a851bd8 malicious 28/61 03/26/2017 20:47:31 VirusTotal Associated SHA256 e5ef657586eaaf362d95e3d679b2a126366b2670fc9316f474974c2c27fa82fd Threat Level malicious Positives 55/62 Scan Date 03/22/2017 06:11:40 Reference VirusTotal e5ef657586eaaf362d95e3d679b2a126366b2670fc9316f474974c2c27fa82fd malicious 55/62 03/22/2017 06:11:40 VirusTotal Associated SHA256 eb2cd28db3fa7b413e29a7043b2d2bbb80372f79ad50cba38038cfbc6fe3be10 Threat Level malicious Positives 46/59 Scan Date 03/05/2017 05:23:25 Reference VirusTotal eb2cd28db3fa7b413e29a7043b2d2bbb80372f79ad50cba38038cfbc6fe3be10 malicious 46/59 03/05/2017 05:23:25 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain juvederm.com Threat Level - Positives - Last Resolved 04/16/2017 00:00:00 VirusTotal Report juvederm.com - - 04/16/2017 00:00:00 Report Domain www.cityxnights.com Threat Level - Positives - Last Resolved 09/04/2016 00:00:00 VirusTotal Report www.cityxnights.com - - 09/04/2016 00:00:00 Report Domain imgtty.pw Threat Level - Positives - Last Resolved 07/12/2016 00:00:00 VirusTotal Report imgtty.pw - - 07/12/2016 00:00:00 Report Domain googledocs.in Threat Level - Positives - Last Resolved 10/22/2015 00:00:00 VirusTotal Report googledocs.in - - 10/22/2015 00:00:00 Report Domain www.test.com Threat Level - Positives - Last Resolved 07/09/2015 00:00:00 VirusTotal Report www.test.com - - 07/09/2015 00:00:00 Report	80 TCP	iexplore.exe PID: 772	United States ASN: 19324 (Dosarrest Internet Security LTD)
69.172.200.235 OSINT Associated Artifacts for 69.172.200.235 Details Associated URL Threat Level Positives Scan Date Reference Associated URL http://test.com/ Threat Level suspicious Positives 1/65 Scan Date 05/09/2017 08:17:02 Reference - http://test.com/ suspicious 1/65 05/09/2017 08:17:02 - Associated URL http://www.test.com/ Threat Level suspicious Positives 1/65 Scan Date 05/09/2017 08:16:52 Reference - http://www.test.com/ suspicious 1/65 05/09/2017 08:16:52 - Associated URL https://www.test.com/ Threat Level suspicious Positives 1/65 Scan Date 05/08/2017 07:28:19 Reference - https://www.test.com/ suspicious 1/65 05/08/2017 07:28:19 - Associated URL https://www.test.com/?test=123?test=123 Threat Level suspicious Positives 1/64 Scan Date 05/04/2017 20:13:01 Reference - https://www.test.com/?test=123?test=123 suspicious 1/64 05/04/2017 20:13:01 - Associated URL http://test.com/xss.js Threat Level suspicious Positives 1/64 Scan Date 05/02/2017 23:46:09 Reference - http://test.com/xss.js suspicious 1/64 05/02/2017 23:46:09 - Details Associated SHA256 Threat Level Positives Scan Date Reference Associated SHA256 3e7500e723f54ee6f1ddeaea6657e92526f175c7caa4467071ac2cadc60c9519 Threat Level malicious Positives 46/61 Scan Date 04/29/2017 16:04:10 Reference VirusTotal 3e7500e723f54ee6f1ddeaea6657e92526f175c7caa4467071ac2cadc60c9519 malicious 46/61 04/29/2017 16:04:10 VirusTotal Associated SHA256 8b194919c2ef5c5c0558317e655a20a2afe78eff241f204007f5eec7a10094b2 Threat Level malicious Positives 42/59 Scan Date 04/24/2017 18:34:20 Reference VirusTotal 8b194919c2ef5c5c0558317e655a20a2afe78eff241f204007f5eec7a10094b2 malicious 42/59 04/24/2017 18:34:20 VirusTotal Associated SHA256 8d3a35b75c6eff85de7154f7760a621061d5c0cbb58bea53e2a84a911a851bd8 Threat Level malicious Positives 28/61 Scan Date 03/26/2017 20:47:31 Reference VirusTotal 8d3a35b75c6eff85de7154f7760a621061d5c0cbb58bea53e2a84a911a851bd8 malicious 28/61 03/26/2017 20:47:31 VirusTotal Associated SHA256 e5ef657586eaaf362d95e3d679b2a126366b2670fc9316f474974c2c27fa82fd Threat Level malicious Positives 55/62 Scan Date 03/22/2017 06:11:40 Reference VirusTotal e5ef657586eaaf362d95e3d679b2a126366b2670fc9316f474974c2c27fa82fd malicious 55/62 03/22/2017 06:11:40 VirusTotal Associated SHA256 eb2cd28db3fa7b413e29a7043b2d2bbb80372f79ad50cba38038cfbc6fe3be10 Threat Level malicious Positives 46/59 Scan Date 03/05/2017 05:23:25 Reference VirusTotal eb2cd28db3fa7b413e29a7043b2d2bbb80372f79ad50cba38038cfbc6fe3be10 malicious 46/59 03/05/2017 05:23:25 VirusTotal Details Domain Threat Level Positives Last Resolved Reference Domain juvederm.com Threat Level - Positives - Last Resolved 04/16/2017 00:00:00 VirusTotal Report juvederm.com - - 04/16/2017 00:00:00 Report Domain www.cityxnights.com Threat Level - Positives - Last Resolved 09/04/2016 00:00:00 VirusTotal Report www.cityxnights.com - - 09/04/2016 00:00:00 Report Domain imgtty.pw Threat Level - Positives - Last Resolved 07/12/2016 00:00:00 VirusTotal Report imgtty.pw - - 07/12/2016 00:00:00 Report Domain googledocs.in Threat Level - Positives - Last Resolved 10/22/2015 00:00:00 VirusTotal Report googledocs.in - - 10/22/2015 00:00:00 Report Domain www.test.com Threat Level - Positives - Last Resolved 07/09/2015 00:00:00 VirusTotal Report www.test.com - - 07/09/2015 00:00:00 Report	443 TCP	iexplore.exe PID: 772	United States ASN: 19324 (Dosarrest Internet Security LTD)
2.16.33.120	443 TCP	iexplore.exe PID: 2920	European Union

HTTP Traffic

     0 : 0A 00 27 00 00 00 0A 00 27 15 99 9E 08 00 45 00 [..'.....'.....E.]
    10 : 02 20 00 A4 40 00 80 06 F0 E5 C0 A8 38 0E 45 AC [. ..@.......8.E.]
    20 : C8 EB C5 04 00 50 FE A5 AE 13 96 F5 C7 FD 50 18 [.....P........P.]
    30 : FA F0 01 E3 00 00 47 45 54 20 2F 20 48 54 54 50 [......GET / HTTP]
    40 : 2F 31 2E 31 0D 0A 41 63 63 65 70 74 3A 20 69 6D [/1.1..Accept: im]
    50 : 61 67 65 2F 6A 70 65 67 2C 20 61 70 70 6C 69 63 [age/jpeg, applic]
    60 : 61 74 69 6F 6E 2F 78 2D 6D 73 2D 61 70 70 6C 69 [ation/x-ms-appli]
    70 : 63 61 74 69 6F 6E 2C 20 69 6D 61 67 65 2F 67 69 [cation, image/gi]
    80 : 66 2C 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 [f, application/x]
    90 : 61 6D 6C 2B 78 6D 6C 2C 20 69 6D 61 67 65 2F 70 [aml+xml, image/p]
    A0 : 6A 70 65 67 2C 20 61 70 70 6C 69 63 61 74 69 6F [jpeg, applicatio]
    B0 : 6E 2F 78 2D 6D 73 2D 78 62 61 70 2C 20 61 70 70 [n/x-ms-xbap, app]
    C0 : 6C 69 63 61 74 69 6F 6E 2F 76 6E 64 2E 6D 73 2D [lication/vnd.ms-]
    D0 : 65 78 63 65 6C 2C 20 61 70 70 6C 69 63 61 74 69 [excel, applicati]
    E0 : 6F 6E 2F 76 6E 64 2E 6D 73 2D 70 6F 77 65 72 70 [on/vnd.ms-powerp]
    F0 : 6F 69 6E 74 2C 20 61 70 70 6C 69 63 61 74 69 6F [oint, applicatio]
   100 : 6E 2F 6D 73 77 6F 72 64 2C 20 2A 2F 2A 0D 0A 41 [n/msword, */*..A]
   110 : 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 [ccept-Language: ]
   120 : 65 6E 2D 75 73 0D 0A 55 73 65 72 2D 41 67 65 6E [en-us..User-Agen]
   130 : 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 [t: Mozilla/4.0 (]
   140 : 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 [compatible; MSIE]
   150 : 20 38 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 [ 8.0; Windows NT]
   160 : 20 36 2E 31 3B 20 54 72 69 64 65 6E 74 2F 34 2E [ 6.1; Trident/4.]
   170 : 30 3B 20 53 4C 43 43 32 3B 20 2E 4E 45 54 20 43 [0; SLCC2; .NET C]
   180 : 4C 52 20 32 2E 30 2E 35 30 37 32 37 3B 20 2E 4E [LR 2.0.50727; .N]
   190 : 45 54 20 43 4C 52 20 33 2E 35 2E 33 30 37 32 39 [ET CLR 3.5.30729]
   1A0 : 3B 20 2E 4E 45 54 20 43 4C 52 20 33 2E 30 2E 33 [; .NET CLR 3.0.3]
   1B0 : 30 37 32 39 3B 20 4D 65 64 69 61 20 43 65 6E 74 [0729; Media Cent]
   1C0 : 65 72 20 50 43 20 36 2E 30 3B 20 2E 4E 45 54 34 [er PC 6.0; .NET4]
   1D0 : 2E 30 43 3B 20 2E 4E 45 54 34 2E 30 45 29 0D 0A [.0C; .NET4.0E)..]
   1E0 : 41 63 63 65 70 74 2D 45 6E 63 6F 64 69 6E 67 3A [Accept-Encoding:]
   1F0 : 20 67 7A 69 70 2C 20 64 65 66 6C 61 74 65 0D 0A [ gzip, deflate..]
   200 : 48 6F 73 74 3A 20 77 77 77 2E 74 65 73 74 2E 63 [Host: www.test.c]
   210 : 6F 6D 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 [om..Connection: ]
   220 : 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 0D 0A [Keep-Alive....]

     0 : 0A 00 27 00 00 00 0A 00 27 15 99 9E 08 00 45 00 [..'.....'.....E.]
    10 : 01 12 00 DD 40 00 80 06 FA 51 C0 A8 38 0E B2 FF [....@....Q..8...]
    20 : 53 01 C5 08 00 50 DE E6 C0 58 40 1B F3 FB 50 18 [S....P...X@...P.]
    30 : 01 00 CE 37 00 00 47 45 54 20 2F 4D 46 45 77 54 [...7..GET /MFEwT]
    40 : 7A 42 4E 4D 45 73 77 53 54 41 4A 42 67 55 72 44 [zBNMEswSTAJBgUrD]
    50 : 67 4D 43 47 67 55 41 42 42 54 61 4D 31 35 57 75 [gMCGgUABBTaM15Wu]
    60 : 71 70 67 7A 4D 63 62 32 76 6A 79 4B 4E 4F 34 39 [qpgzMcb2vjyKNO49]
    70 : 56 6F 33 43 67 51 55 55 63 37 66 56 42 32 33 4C [Vo3CgQUUc7fVB23L]
    80 : 46 65 72 61 47 46 49 41 68 72 54 73 6F 58 73 51 [FeraGFIAhrTsoXsQ]
    90 : 4B 6F 43 45 44 65 65 36 25 32 46 79 39 48 36 66 [KoCEDee6%2Fy9H6f]
    A0 : 6A 6E 38 57 6D 61 5A 75 65 36 4C 4D 25 33 44 20 [jn8WmaZue6LM%3D ]
    B0 : 48 54 54 50 2F 31 2E 31 0D 0A 43 6F 6E 6E 65 63 [HTTP/1.1..Connec]
    C0 : 74 69 6F 6E 3A 20 4B 65 65 70 2D 41 6C 69 76 65 [tion: Keep-Alive]
    D0 : 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 55 [..Accept: */*..U]
    E0 : 73 65 72 2D 41 67 65 6E 74 3A 20 4D 69 63 72 6F [ser-Agent: Micro]
    F0 : 73 6F 66 74 2D 43 72 79 70 74 6F 41 50 49 2F 36 [soft-CryptoAPI/6]
   100 : 2E 31 0D 0A 48 6F 73 74 3A 20 6F 63 73 70 2E 6E [.1..Host: ocsp.n]
   110 : 65 74 73 6F 6C 73 73 6C 2E 63 6F 6D 0D 0A 0D 0A [etsolssl.com....]

     0 : 0A 00 27 00 00 00 0A 00 27 15 99 9E 08 00 45 00 [..'.....'.....E.]
    10 : 00 BC 00 EA 40 00 80 06 3B CF C0 A8 38 0E 68 10 [....@...;...8.h.]
    20 : 5C BC C5 09 00 50 E4 B8 DB B4 8B 9D A2 D6 50 18 [\....P........P.]
    30 : 01 00 52 60 00 00 47 45 54 20 2F 4E 65 74 77 6F [..R`..GET /Netwo]
    40 : 72 6B 53 6F 6C 75 74 69 6F 6E 73 44 56 53 65 72 [rkSolutionsDVSer]
    50 : 76 65 72 43 41 32 2E 63 72 6C 20 48 54 54 50 2F [verCA2.crl HTTP/]
    60 : 31 2E 31 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A [1.1..Connection:]
    70 : 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 41 63 63 [ Keep-Alive..Acc]
    80 : 65 70 74 3A 20 2A 2F 2A 0D 0A 55 73 65 72 2D 41 [ept: */*..User-A]
    90 : 67 65 6E 74 3A 20 4D 69 63 72 6F 73 6F 66 74 2D [gent: Microsoft-]
    A0 : 43 72 79 70 74 6F 41 50 49 2F 36 2E 31 0D 0A 48 [CryptoAPI/6.1..H]
    B0 : 6F 73 74 3A 20 63 72 6C 2E 6E 65 74 73 6F 6C 73 [ost: crl.netsols]
    C0 : 73 6C 2E 63 6F 6D 0D 0A 0D 0A [sl.com....]

Memory Forensics