3.8
中危
53 个模型检测该样本为恶意！
重新分析
更多

3d3e3a651fac3adb4106b5f49204174ae961d2ee464e07c77ccea0bc3543583c

37a10688bcf44000e3d1b2a08100ef4c.exe

分析耗时

74s

最近分析

文件大小

261.0KB
静态报毒 动态报毒 100% AI SCORE=100 ATTRIBUTE BSCOPE CLASSIC CONFIDENCE CRYPMODNG CRYPTINJECT CXOK ENCPK FILECODER FILECRYPTER FILECRYPTOR GENERICRXLS HIGH CONFIDENCE HIGHCONFIDENCE LLHH MALICIOUS PE MALWARE@#1AXGLGELY2GCP OFRHB R + MAL R066C0DIK20 RAZY SCORE STATIC AI SUSGEN TROJANPWS UNSAFE URUASY ZBOT 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXLS-WT!37A10688BCF4 20201226 6.0.6.653
Alibaba Ransom:Win32/Crypmodng.145b7b0d 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201226 21.1.5827.0
Kingsoft 20201226 2017.9.26.565
Tencent Win32.Trojan.Filecoder.Llhh 20201226 1.0.0.1
静态指标
Command line console output was observed (11 个事件)
Time & API Arguments Status Return Repeated
1619345031.328363
WriteConsoleA
buffer: ThreadParam->szDiskName; : d:\enc_tests\
console_handle: 0x00000007
success 1 0
1619345031.328363
WriteConsoleA
buffer: startTime : 12087468
console_handle: 0x00000007
success 1 0
1619345031.344363
WriteConsoleA
buffer: d:\enc_tests\ -> WorkModeFindFiles : 0 files / 0 folders found (already (de?)crypted 0/0) (lf = )...
console_handle: 0x00000007
success 1 0
1619345031.375363
WriteConsoleA
buffer: d:\enc_tests\ FINDFILES time : 0:0:0:0.47
console_handle: 0x00000007
success 1 0
1619345031.375363
WriteConsoleA
buffer: d:\enc_tests\ FINDFILES RESULTS : dwDirectoriesCount = 0, dwFilesCount = 0 MB = 0 (FIND END)
console_handle: 0x00000007
success 1 0
1619345031.375363
WriteConsoleA
buffer: d SORTING time : 0:0:0:0.0
console_handle: 0x00000007
success 1 0
1619345031.375363
WriteConsoleA
buffer: d:\enc_tests\ DECRYPTFILES count : 0 (0 skipped), time : 0:0:0:0.0
console_handle: 0x00000007
success 1 0
1619345036.344363
WriteConsoleA
buffer: d:\enc_tests\ -> WorkModeDecryptFiles : 0 of 0 files decrypted +0 (0 MB)...
console_handle: 0x00000007
success 1 0
1619345041.344363
WriteConsoleA
buffer: d:\enc_tests\ -> WorkModeDecryptFiles : 0 of 0 files decrypted +0 (0 MB)...
console_handle: 0x00000007
success 1 0
1619345041.375363
WriteConsoleA
buffer: EncryptDisk(d:\enc_tests\) DONE
console_handle: 0x00000007
success 1 0
1619345046.344363
WriteConsoleA
buffer: d:\enc_tests\ -> WorkModeEnded
console_handle: 0x00000007
success 1 0
This executable has a PDB path (1 个事件)
pdb_path D:\code\ransomware_win\bin\decoder.pdb
行为判定
动态指标
Encryption keys have been identified in this analysis
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3625981971&cup2hreq=191d76bc5e92c3a8d5a21529d739c9558a4c32e54d2a0d2c46fac52eab27f6e2
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319134&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:3625981971&cup2hreq=191d76bc5e92c3a8d5a21529d739c9558a4c32e54d2a0d2c46fac52eab27f6e2
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3625981971&cup2hreq=191d76bc5e92c3a8d5a21529d739c9558a4c32e54d2a0d2c46fac52eab27f6e2
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 53 AntiVirus engines on VirusTotal as malicious (50 out of 53 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Razy.647127
FireEye Gen:Variant.Razy.647127
CAT-QuickHeal TrojanPWS.Zbot.Y
McAfee GenericRXLS-WT!37A10688BCF4
Cylance Unsafe
Zillya Trojan.Filecoder.Win32.14646
K7AntiVirus Trojan ( 005652471 )
Alibaba Ransom:Win32/Crypmodng.145b7b0d
K7GW Trojan ( 005652471 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Razy.D9DFD7
Cyren W32/Trojan.CXOK-0041
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky Trojan-Ransom.Win32.Crypmodng.cu
BitDefender Gen:Variant.Razy.647127
Paloalto generic.ml
AegisLab Trojan.Win32.Razy.4!c
Rising Ransom.Agent!1.C567 (CLASSIC)
Ad-Aware Gen:Variant.Razy.647127
Sophos Mal/Generic-R + Mal/EncPk-NS
Comodo Malware@#1axglgely2gcp
F-Secure Trojan.TR/FileCoder.ofrhb
VIPRE LooksLike.Win32.Uruasy.b!ag (v)
TrendMicro Ransom_Crypmodng.R066C0DIK20
McAfee-GW-Edition GenericRXLS-WT!37A10688BCF4
Emsisoft Gen:Variant.Razy.647127 (B)
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Crypmodng.o
Avira TR/FileCoder.ofrhb
Microsoft Trojan:Win32/CryptInject!ml
ZoneAlarm Trojan-Ransom.Win32.Crypmodng.cu
GData Gen:Variant.Razy.647127
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.RansomCrypt.C4156137
BitDefenderTheta AI:Packer.A4BADEC620
ALYac Trojan.Ransom.Filecoder
MAX malware (ai score=100)
VBA32 BScope.Trojan.Encoder
Malwarebytes Ransom.FileCryptor
ESET-NOD32 a variant of Win32/Filecoder.OBU
TrendMicro-HouseCall Ransom_Crypmodng.R066C0DIK20
Tencent Win32.Trojan.Filecoder.Llhh
Ikarus Trojan-Ransom.FileCrypter
eGambit Trojan.Generic
Fortinet W32/Crypmodng.CU!tr.ransom
MaxSecure Trojan.Malware.98461326.susgen
AVG Win32:Trojan-gen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-04-29 05:51:45

Imports

Library SHLWAPI.dll:
• 0x438138 StrDupW
• 0x43813c StrCpyW
• 0x438140 StrCatW
• 0x438144 StrStrIA
• 0x438148 PathFindFileNameW
• 0x43814c PathFindExtensionW
• 0x438150 StrCpyNW
• 0x438154 StrCmpIW
• 0x438158 wvnsprintfA
Library ntdll.dll:
• 0x4381a8 NtClose
• 0x4381b4 _allshr
• 0x4381bc wcsstr
• 0x4381c4 _aulldiv
• 0x4381c8 RtlUnwind
• 0x4381cc memcmp
• 0x4381d0 NtCreateFile
• 0x4381d4 RtlTimeToTimeFields
• 0x4381d8 _wcslwr
• 0x4381dc _stricmp
• 0x4381e0 memset
• 0x4381e4 _aullshr
• 0x4381ec strstr
• 0x4381f0 _vsnprintf
• 0x4381f4 _alldiv
• 0x4381f8 _allmul
• 0x4381fc _allshl
• 0x438200 memcpy
Library KERNEL32.dll:
• 0x43801c SetFileAttributesW
• 0x438020 CopyFileW
• 0x438024 DeleteFileW
• 0x438028 MoveFileW
• 0x43802c ExitProcess
• 0x438030 WaitForSingleObject
• 0x438038 GetFileAttributesW
• 0x43803c ReadFile
• 0x438040 CreateFileW
• 0x438048 HeapFree
• 0x43804c HeapAlloc
• 0x438054 GetLocalTime
• 0x438058 GetComputerNameW
• 0x43805c GetSystemTime
• 0x438060 AttachConsole
• 0x438064 AllocConsole
• 0x43806c GlobalMemoryStatus
• 0x438070 LocalAlloc
• 0x438074 GetProcessHeap
• 0x438078 GetProcessTimes
• 0x438080 GetCurrentProcess
• 0x438084 GetCurrentProcessId
• 0x438088 GetCurrentThread
• 0x43808c GetCurrentThreadId
• 0x438090 GetThreadTimes
• 0x438094 GetLastError
• 0x438098 SetLastError
• 0x4380a8 GetTickCount
• 0x4380ac GetStartupInfoW
• 0x4380b4 LocalFree
• 0x4380b8 GetStdHandle
• 0x4380bc WriteFile
• 0x4380c0 FlushFileBuffers
• 0x4380c4 CloseHandle
• 0x4380c8 lstrlenA
• 0x4380d0 OutputDebugStringA
• 0x4380d4 CreateFileA
• 0x4380d8 CreateThread
• 0x4380dc ExitThread
• 0x4380e4 Sleep
• 0x4380e8 lstrcpyW
• 0x4380ec lstrcatW
• 0x4380f0 TlsAlloc
• 0x4380f8 GetProcAddress
• 0x4380fc GetFileSize
• 0x438100 GetFileSizeEx
• 0x438104 GetCommandLineA
• 0x438108 SetEndOfFile
• 0x43810c SetFilePointer
• 0x438110 SetFilePointerEx
• 0x438114 MapViewOfFile
• 0x438118 UnmapViewOfFile
• 0x43811c TlsGetValue
• 0x438120 TlsSetValue
• 0x438124 CreateFileMappingA
• 0x438128 CreateFileMappingW
• 0x43812c LoadLibraryA
• 0x438130 GetDriveTypeW
Library USER32.dll:
• 0x438160 wsprintfA
• 0x438164 MessageBoxA
• 0x438168 wsprintfW
• 0x43816c GetDesktopWindow
• 0x438170 GetCaretPos
• 0x438174 GetCursorPos
• 0x438178 GetQueueStatus
• 0x43817c GetInputState
• 0x438180 GetFocus
• 0x438184 GetActiveWindow
• 0x43818c GetMessagePos
• 0x438190 GetMessageTime
• 0x438194 GetClipboardOwner
• 0x438198 GetClipboardViewer
• 0x4381a0 GetCapture
Library ADVAPI32.dll:
• 0x438004 OpenProcessToken
• 0x438010 CryptReleaseContext
• 0x438014 CryptGenRandom

Exports

Ordinal Address Name
1 0x432af0 _ReflectiveLoader@4

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49183 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49184 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49182 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49181 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900

HTTP & HTTPS Requests

URI Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=19719-34568
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=145713-244466
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=1205336-1310831
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=7545-19718
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=54754-73723
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=244467-369027
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=631273-850533
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=34569-54753
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=7f3a837a81847e1d&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619319376&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-7544
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.