10.0
0-day
该样本未表现出任何异常！
重新分析
更多

3a1868ec7cc92af26b1b5db8dd31b94de7527431ca93ef76a9f92f9c9401ac96

3bb5846bc7823064161e0207e0a29ef3.exe

分析耗时

138s

最近分析

文件大小

448.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619422051.873124
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (8 个事件)
Time & API Arguments Status Return Repeated
1619422040.217124
CryptGenKey
crypto_handle: 0x00626778
algorithm_identifier: 0x0000660e ()
provider_handle: 0x00625cd0
flags: 1
key: fŒš¦{–€¢Š@6»Ñ˜
success 1 0
1619422051.889124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤òϾ֝직ï¸Â]Hg|¼Oñ\Èù Д–îÃón–ºöêw"3ó»X¹íò¹À+Çõ-È8ˆÑbp 3Åt_¥:{~§òyFv1Ùñ¸¡‚¬†3BÌf;C{D P¼
blob_type: 1
flags: 64
success 1 0
1619422081.311124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤S¡Û7˜ËNâA&’þ¾ñªÇ]†ÔÒ<¹J)J¤9GäNà;"¡ŸýŒí)©©©h}Ú"6ÍM‘}UJ+)"9ñ¥•üݼᑳ²NÆdoŽ't¨ƒRx©™º%=
blob_type: 1
flags: 64
success 1 0
1619422085.326124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤i§=Ë ©¼ Q‡oôÒãý¦d•m+*7g’ŠK@–½.ôÀïê¥5Š!#}çwÜíþÓ±gM3 dØÑ¢¾L©JiÆÖO—Ø-áSÌ^óßwË@Ä´tœÓ¾vÒ÷
blob_type: 1
flags: 64
success 1 0
1619422089.451124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤(§©ÓD®™!¾ÿ‰[mÌxðPÖEoPÇùl]&MûŸ¬´v8}õb•siŠ,ɟKUËáè,ÜjÏԘð‚æÂÅÞFV.ë­ ùl Ó4ñuôùŒW–Ÿ! jäOÐðÇ£,
blob_type: 1
flags: 64
success 1 0
1619422114.123124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤à!Û ¡¢ãÒ7+„^!ך”û·ªÚ@(Ðîu÷ÄLŸLÉ€òZ+†‡ö{I\µ0ßG«ì ÐŒ±x·¶jGùÏfÊ¥‰“¤¬/,eâZáÌJ“ü¼úí6ÙzúÆ
blob_type: 1
flags: 64
success 1 0
1619422137.483124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤AÙG_7]ØÀ5“¦V˜#m¢Ên™ú§)j:Uê$‡ódnÏ w¥s2±£¨yAN±üyÞìÊójR¾\êˆúѹã 2½è–N¬[àôxÆÜÁƒ…[a늽8ØZúBG
blob_type: 1
flags: 64
success 1 0
1619422141.733124
CryptExportKey
crypto_handle: 0x00626778
crypto_export_handle: 0x00625c90
buffer: f¤w^dâQtöÕ§\Å×¢7NAA/ƒÃw¥Ï>@˜C Ða¥7ôø©¹¥Ðœ¸®·]V¢B½Š2B§I˜æ½š+ÆKÖð²„ÀÁñ¯Idm ÉgLȤÕåÀ°8Nxì
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2889831459&cup2hreq=b42ec4d5f27bc4077fa4277ec45fdbe08d5d5e7af7f71907bd0ee499de5ea236
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2
Performs some HTTP requests (6 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393055&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:2889831459&cup2hreq=b42ec4d5f27bc4077fa4277ec45fdbe08d5d5e7af7f71907bd0ee499de5ea236
request POST https://update.googleapis.com/service/update2
Sends data using the HTTP POST Method (2 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2889831459&cup2hreq=b42ec4d5f27bc4077fa4277ec45fdbe08d5d5e7af7f71907bd0ee499de5ea236
request POST https://update.googleapis.com/service/update2
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619422033.232876
NtAllocateVirtualMemory
process_identifier: 3040
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00840000
success 0 0
1619421663.54777
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004070000
success 0 0
1619422039.811124
NtAllocateVirtualMemory
process_identifier: 1688
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01ed0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Foreign language identified in PE resource (33 个事件)
name RT_CURSOR language LANG_CHINESE offset 0x00072e80 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_CURSOR language LANG_CHINESE offset 0x00072e80 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000b4
name RT_BITMAP language LANG_CHINESE offset 0x00073858 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00073858 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00073858 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_BITMAP language LANG_CHINESE offset 0x00073858 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000144
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_ICON language LANG_CHINESE offset 0x00069a78 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000468
name RT_DIALOG language LANG_CHINESE offset 0x00073548 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000e2
name RT_DIALOG language LANG_CHINESE offset 0x00073548 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000e2
name RT_DIALOG language LANG_CHINESE offset 0x00073548 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x000000e2
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_STRING language LANG_CHINESE offset 0x000742c0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000024
name RT_RCDATA language LANG_CHINESE offset 0x00069f58 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00008544
name RT_GROUP_CURSOR language LANG_CHINESE offset 0x00072f38 filetype Lotus unknown worksheet or configuration, revision 0x2 sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
name RT_GROUP_ICON language LANG_CHINESE offset 0x00069ee0 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000076
name RT_VERSION language LANG_CHINESE offset 0x00072a48 filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000300
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619422034.075876
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3bb5846bc7823064161e0207e0a29ef3.exe
newfilepath: C:\Windows\SysWOW64\KBDUKX\api-ms-win-core-xstate-l1-1-0.exe
newfilepath_r: C:\Windows\SysWOW64\KBDUKX\api-ms-win-core-xstate-l1-1-0.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3bb5846bc7823064161e0207e0a29ef3.exe
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619422054.342124
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process api-ms-win-core-xstate-l1-1-0.exe
Repeatedly searches for a not-found process, you may want to run a web browser during analysis (6 个事件)
Time & API Arguments Status Return Repeated
1619422081.311124
Process32NextW
process_name: mscorsvw.exe
snapshot_handle: 0x000003ec
process_identifier: 1940
failed 0 0
1619422085.326124
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x000003ec
process_identifier: 2868
failed 0 0
1619422089.451124
Process32NextW
process_name: sppsvc.exe
snapshot_handle: 0x000003ec
process_identifier: 796
failed 0 0
1619422114.123124
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x000003ec
process_identifier: 3168
failed 0 0
1619422137.483124
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x000003ec
process_identifier: 3464
failed 0 0
1619422141.733124
Process32NextW
process_name: GoogleUpdate.exe
snapshot_handle: 0x000003ec
process_identifier: 3464
failed 0 0
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619422052.936124
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (8 个事件)
host 105.209.235.113
host 168.235.82.183
host 172.217.24.14
host 181.113.229.139
host 181.134.9.162
host 185.86.148.68
host 217.199.160.224
host 71.57.180.213
Installs itself for autorun at Windows startup (1 个事件)
service_name api-ms-win-core-xstate-l1-1-0 service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\KBDUKX\api-ms-win-core-xstate-l1-1-0.exe"
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1619422038.450876
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x0095ee70
display_name: api-ms-win-core-xstate-l1-1-0
error_control: 0
service_name: api-ms-win-core-xstate-l1-1-0
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\KBDUKX\api-ms-win-core-xstate-l1-1-0.exe"
filepath_r: "C:\Windows\SysWOW64\KBDUKX\api-ms-win-core-xstate-l1-1-0.exe"
service_manager_handle: 0x02b46410
desired_access: 2
service_type: 16
password:
success 9825904 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619422056.904124
RegSetValueExA
key_handle: 0x000003cc
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619422056.904124
RegSetValueExA
key_handle: 0x000003cc
value: €ÌâZ:×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619422056.904124
RegSetValueExA
key_handle: 0x000003cc
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619422056.904124
RegSetValueExW
key_handle: 0x000003cc
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619422056.904124
RegSetValueExA
key_handle: 0x000003e4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619422056.904124
RegSetValueExA
key_handle: 0x000003e4
value: €ÌâZ:×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619422056.904124
RegSetValueExA
key_handle: 0x000003e4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619422056.920124
RegSetValueExW
key_handle: 0x000003c8
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\KBDUKX\api-ms-win-core-xstate-l1-1-0.exe:Zone.Identifier
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 个事件)
dead_host 172.217.160.110:443
dead_host 217.199.160.224:8080
dead_host 192.168.56.101:49190
dead_host 181.113.229.139:443
dead_host 192.168.56.101:49192
dead_host 172.217.24.14:443
dead_host 192.168.56.101:49211
dead_host 71.57.180.213:80
dead_host 185.86.148.68:443
dead_host 181.134.9.162:80
dead_host 168.235.82.183:8080
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-15 02:46:41

Imports

Library WS2_32.dll:
• 0x42f4e0 shutdown
• 0x42f4e4 WSAStartup
• 0x42f4e8 WSACleanup
• 0x42f4ec send
• 0x42f4f0 recv
• 0x42f4f4 closesocket
• 0x42f4fc WSACloseEvent
• 0x42f500 WSAEventSelect
• 0x42f504 WSACreateEvent
• 0x42f508 socket
• 0x42f50c inet_addr
• 0x42f514 connect
• 0x42f518 gethostbyaddr
• 0x42f51c htons
• 0x42f520 gethostbyname
Library KERNEL32.dll:
• 0x42f0bc FindClose
• 0x42f0c0 FindFirstFileA
• 0x42f0c8 GetFullPathNameA
• 0x42f0d4 GetTickCount
• 0x42f0d8 GetFileAttributesA
• 0x42f0dc GetFileSize
• 0x42f0e0 GetFileTime
• 0x42f0e4 RtlUnwind
• 0x42f0e8 CreateThread
• 0x42f0ec ExitThread
• 0x42f0f0 RaiseException
• 0x42f0f4 GetStartupInfoA
• 0x42f0f8 GetCommandLineA
• 0x42f0fc HeapAlloc
• 0x42f100 HeapFree
• 0x42f104 TerminateProcess
• 0x42f108 HeapReAlloc
• 0x42f10c HeapSize
• 0x42f110 GetACP
• 0x42f120 LCMapStringA
• 0x42f124 LCMapStringW
• 0x42f138 GetStdHandle
• 0x42f13c GetFileType
• 0x42f140 HeapDestroy
• 0x42f144 HeapCreate
• 0x42f148 VirtualFree
• 0x42f14c VirtualAlloc
• 0x42f150 GetStringTypeA
• 0x42f154 GetStringTypeW
• 0x42f158 IsBadCodePtr
• 0x42f15c SetStdHandle
• 0x42f160 CompareStringA
• 0x42f164 CompareStringW
• 0x42f16c GetProfileStringA
• 0x42f170 InterlockedExchange
• 0x42f174 ResetEvent
• 0x42f178 CreateEventA
• 0x42f17c CloseHandle
• 0x42f180 WaitForSingleObject
• 0x42f184 SetEvent
• 0x42f188 lstrlenA
• 0x42f18c Sleep
• 0x42f190 ExitProcess
• 0x42f19c WideCharToMultiByte
• 0x42f1a0 MultiByteToWideChar
• 0x42f1a4 LocalFree
• 0x42f1a8 FormatMessageA
• 0x42f1ac SetEndOfFile
• 0x42f1b0 UnlockFile
• 0x42f1b4 LockFile
• 0x42f1b8 FlushFileBuffers
• 0x42f1bc SetFilePointer
• 0x42f1c0 WriteFile
• 0x42f1c4 ReadFile
• 0x42f1c8 CreateFileA
• 0x42f1cc GetCurrentProcess
• 0x42f1d0 DuplicateHandle
• 0x42f1d4 SetErrorMode
• 0x42f1d8 GetOEMCP
• 0x42f1dc GetCPInfo
• 0x42f1e0 GetThreadLocale
• 0x42f1e4 SizeofResource
• 0x42f1e8 IsBadWritePtr
• 0x42f1ec IsBadReadPtr
• 0x42f1f0 GetCurrentThreadId
• 0x42f1f4 GetCurrentThread
• 0x42f1f8 lstrcmpiA
• 0x42f1fc lstrcmpA
• 0x42f200 GlobalDeleteAtom
• 0x42f208 GlobalFlags
• 0x42f20c TlsGetValue
• 0x42f210 LocalReAlloc
• 0x42f214 TlsSetValue
• 0x42f218 GlobalReAlloc
• 0x42f21c TlsFree
• 0x42f220 GlobalHandle
• 0x42f224 TlsAlloc
• 0x42f228 LocalAlloc
• 0x42f22c GetProcessVersion
• 0x42f230 lstrcpynA
• 0x42f234 GetLastError
• 0x42f248 MulDiv
• 0x42f24c SetLastError
• 0x42f250 LoadLibraryA
• 0x42f254 FreeLibrary
• 0x42f258 GetVersion
• 0x42f25c lstrcatA
• 0x42f260 GlobalAlloc
• 0x42f264 GlobalGetAtomNameA
• 0x42f268 GlobalAddAtomA
• 0x42f26c GlobalFindAtomA
• 0x42f270 lstrcpyA
• 0x42f274 GetModuleHandleA
• 0x42f278 GetProcAddress
• 0x42f27c GlobalUnlock
• 0x42f280 GlobalFree
• 0x42f284 LockResource
• 0x42f288 FindResourceA
• 0x42f28c LoadResource
• 0x42f290 GetModuleFileNameA
• 0x42f294 GlobalLock
• 0x42f298 SetHandleCount
Library USER32.dll:
• 0x42f2d0 GrayStringA
• 0x42f2d4 DestroyMenu
• 0x42f2d8 LoadCursorA
• 0x42f2dc GetSysColorBrush
• 0x42f2e0 GetDesktopWindow
• 0x42f2e4 GetClassNameA
• 0x42f2e8 PtInRect
• 0x42f2ec CharNextA
• 0x42f2f4 SetRect
• 0x42f2f8 GetNextDlgGroupItem
• 0x42f2fc MessageBeep
• 0x42f300 InvalidateRect
• 0x42f304 CharUpperA
• 0x42f308 InflateRect
• 0x42f310 PostThreadMessageA
• 0x42f314 GetDC
• 0x42f318 ClientToScreen
• 0x42f31c LoadStringA
• 0x42f320 wvsprintfA
• 0x42f324 ShowWindow
• 0x42f328 MoveWindow
• 0x42f32c SetWindowTextA
• 0x42f330 IsDialogMessageA
• 0x42f334 UpdateWindow
• 0x42f338 SendDlgItemMessageA
• 0x42f33c MapWindowPoints
• 0x42f340 GetSysColor
• 0x42f344 SetFocus
• 0x42f348 AdjustWindowRectEx
• 0x42f34c ScreenToClient
• 0x42f350 CopyRect
• 0x42f354 DrawTextA
• 0x42f358 GetTopWindow
• 0x42f35c IsChild
• 0x42f360 GetCapture
• 0x42f364 WinHelpA
• 0x42f368 wsprintfA
• 0x42f36c GetClassInfoA
• 0x42f370 RegisterClassA
• 0x42f374 GetMenu
• 0x42f378 GetMenuItemCount
• 0x42f37c GetSubMenu
• 0x42f380 GetMenuItemID
• 0x42f388 GetWindowTextA
• 0x42f38c GetDlgCtrlID
• 0x42f390 DefWindowProcA
• 0x42f394 CreateWindowExA
• 0x42f398 GetClassLongA
• 0x42f39c UnhookWindowsHookEx
• 0x42f3a0 GetPropA
• 0x42f3a4 CallWindowProcA
• 0x42f3a8 RemovePropA
• 0x42f3ac GetMessageTime
• 0x42f3b0 GetMessagePos
• 0x42f3b4 GetForegroundWindow
• 0x42f3b8 SetForegroundWindow
• 0x42f3bc SetWindowLongA
• 0x42f3c4 OffsetRect
• 0x42f3c8 IntersectRect
• 0x42f3d0 GetWindowPlacement
• 0x42f3d4 GetWindowRect
• 0x42f3d8 MapDialogRect
• 0x42f3dc SetWindowPos
• 0x42f3e0 GetWindow
• 0x42f3e8 EndDialog
• 0x42f3ec SetActiveWindow
• 0x42f3f0 IsWindow
• 0x42f3f8 DestroyWindow
• 0x42f3fc GetDlgItem
• 0x42f404 LoadBitmapA
• 0x42f408 GetMenuState
• 0x42f40c ModifyMenuA
• 0x42f410 SetMenuItemBitmaps
• 0x42f414 CheckMenuItem
• 0x42f418 EnableMenuItem
• 0x42f41c GetFocus
• 0x42f420 GetNextDlgTabItem
• 0x42f424 GetActiveWindow
• 0x42f428 GetKeyState
• 0x42f42c CallNextHookEx
• 0x42f430 ValidateRect
• 0x42f434 IsWindowVisible
• 0x42f438 GetCursorPos
• 0x42f43c SetWindowsHookExA
• 0x42f440 GetParent
• 0x42f444 GetLastActivePopup
• 0x42f448 IsWindowEnabled
• 0x42f44c GetWindowLongA
• 0x42f450 MessageBoxA
• 0x42f454 SetCursor
• 0x42f458 TabbedTextOutA
• 0x42f45c EndPaint
• 0x42f460 BeginPaint
• 0x42f464 GetWindowDC
• 0x42f468 ReleaseDC
• 0x42f46c PostMessageA
• 0x42f470 LoadIconA
• 0x42f474 EnableWindow
• 0x42f478 GetClientRect
• 0x42f47c IsIconic
• 0x42f480 GetSystemMenu
• 0x42f484 SendMessageA
• 0x42f488 AppendMenuA
• 0x42f48c DrawIcon
• 0x42f490 PostQuitMessage
• 0x42f494 GetSystemMetrics
• 0x42f498 GetMessageA
• 0x42f49c TranslateMessage
• 0x42f4a0 PeekMessageA
• 0x42f4a4 DispatchMessageA
• 0x42f4ac IsWindowUnicode
• 0x42f4b0 DefDlgProcA
• 0x42f4b4 DrawFocusRect
• 0x42f4b8 ExcludeUpdateRgn
• 0x42f4bc ShowCaret
• 0x42f4c0 HideCaret
• 0x42f4c4 UnregisterClassA
• 0x42f4c8 SetPropA
Library GDI32.dll:
• 0x42f01c SetBkMode
• 0x42f020 SetMapMode
• 0x42f024 SetViewportOrgEx
• 0x42f028 OffsetViewportOrgEx
• 0x42f02c SetViewportExtEx
• 0x42f030 ScaleViewportExtEx
• 0x42f034 SetWindowExtEx
• 0x42f038 ScaleWindowExtEx
• 0x42f03c IntersectClipRect
• 0x42f040 DeleteObject
• 0x42f044 GetStockObject
• 0x42f048 GetDeviceCaps
• 0x42f04c GetViewportExtEx
• 0x42f050 GetWindowExtEx
• 0x42f054 CreateSolidBrush
• 0x42f058 PtVisible
• 0x42f05c RectVisible
• 0x42f060 TextOutA
• 0x42f064 ExtTextOutA
• 0x42f068 Escape
• 0x42f06c GetTextColor
• 0x42f070 GetBkColor
• 0x42f074 DPtoLP
• 0x42f078 LPtoDP
• 0x42f07c GetMapMode
• 0x42f080 PatBlt
• 0x42f084 SelectObject
• 0x42f088 RestoreDC
• 0x42f08c SaveDC
• 0x42f090 DeleteDC
• 0x42f094 GetObjectA
• 0x42f098 SetBkColor
• 0x42f09c SetTextColor
• 0x42f0a0 GetClipBox
• 0x42f0a4 GetTextExtentPointA
• 0x42f0a8 BitBlt
• 0x42f0ac CreateCompatibleDC
• 0x42f0b0 CreateDIBitmap
• 0x42f0b4 CreateBitmap
Library comdlg32.dll:
• 0x42f528 GetFileTitleA
Library WINSPOOL.DRV:
• 0x42f4d0 DocumentPropertiesA
• 0x42f4d4 ClosePrinter
• 0x42f4d8 OpenPrinterA
Library ADVAPI32.dll:
• 0x42f000 RegCloseKey
• 0x42f004 RegSetValueExA
• 0x42f008 RegOpenKeyExA
• 0x42f00c RegCreateKeyExA
Library COMCTL32.dll:
• 0x42f014
Library oledlg.dll:
• 0x42f570
Library ole32.dll:
• 0x42f530 CoTaskMemFree
• 0x42f53c OleInitialize
• 0x42f540 CoGetClassObject
• 0x42f544 CLSIDFromString
• 0x42f548 CoTaskMemAlloc
• 0x42f54c OleUninitialize
• 0x42f554 CLSIDFromProgID
• 0x42f55c OleFlushClipboard
• 0x42f560 CoRevokeClassObject
Library OLEPRO32.DLL:
• 0x42f2c8
Library OLEAUT32.dll:
• 0x42f2a4 SysStringLen
• 0x42f2a8 SysAllocString
• 0x42f2ac VariantChangeType
• 0x42f2b0 VariantCopy
• 0x42f2b8 VariantClear
• 0x42f2bc SysAllocStringLen
• 0x42f2c0 SysFreeString

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49202 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49203 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49210 203.208.41.34 update.googleapis.com 443
192.168.56.101 49201 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49198 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 62144 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=756432-1310831
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=19382-34460
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393055&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393055&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6986
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=119744-210484
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=75607-119743
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=55223-75606
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=35c1c92a98b299d6&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619392815&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=210485-394708
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.