12.2
0-day
57 个模型检测该样本为恶意！
重新分析
更多

142e76fa2492093c39b6f305a409fc9383e68d9d6c30fde6ef0669cacf4c9626

4db6b3ecbc15b5cf74fa250de1de52bb.exe

分析耗时

117s

最近分析

文件大小

688.0KB
静态报毒 动态报毒 AI SCORE=87 ATTRIBUTE CLASSIC DOWNLOADER34 ELDORADO EMOTET EPAZ GENCIRC GENETIC GENKRYPTIK HFFH HIGH CONFIDENCE HIGHCONFIDENCE HPCHZV JOHNNIE KCLOUD KRYPTIK MALWARE@#ZREZG7JM3NFV R + TROJ R002C0DLB20 R346194 RQW@AMEVTVDJ SCORE SUSGEN TROJANBANKER UNSAFE WFHUJ ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRI!4DB6B3ECBC15 20210107 6.0.6.653
Alibaba Trojan:Win32/Emotet.b2c1097a 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20210108 21.1.5827.0
Kingsoft Win32.Troj.Banker.(kcloud) 20210108 2017.9.26.565
Tencent Malware.Win32.Gencirc.10cde669 20210108 1.0.0.1
CrowdStrike 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619470418.719126
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (4 个事件)
Time & API Arguments Status Return Repeated
1619470406.656126
CryptGenKey
crypto_handle: 0x00594330
algorithm_identifier: 0x0000660e ()
provider_handle: 0x00596f78
flags: 1
key: f7±- –"ª=+ö~
success 1 0
1619470418.734126
CryptExportKey
crypto_handle: 0x00594330
crypto_export_handle: 0x00596f38
buffer: f¤tF„?CøÝj¥÷lH¶•³Z"D6{—_E,6НRk0Â tnل#|Ìõ*«jPÃ%Çf‚Mv+Ð dXˆ²0’‚û€ø5² d±Š]Œº`{0);„riØï×ÿ&#
blob_type: 1
flags: 64
success 1 0
1619470447.219126
CryptExportKey
crypto_handle: 0x00594330
crypto_export_handle: 0x00596f38
buffer: f¤üéæ\SVk±³X³âùèTwø„ÜkT–÷ FetŒ”æn„Õ!FßÝ6Ö°*æ4<§³½½?z‚¥¬™ÃÙk¸×Nú†ŒÆÑȇUÛÊ.ûG”(•º3^Ìx
blob_type: 1
flags: 64
success 1 0
1619470471.906126
CryptExportKey
crypto_handle: 0x00594330
crypto_export_handle: 0x00596f38
buffer: f¤r$MÿF%M‹cò½\½Ã茥̍ÏéDb—¹ÊÿºÃH½cÂL¡ìDYl³C¡,ìßúˆ‘à úæ2ï¤4âã/=[jÉãj:˄ìe\f†ÐîDˆ³Ú.|'Ë
blob_type: 1
flags: 64
success 1 0
This executable has a PDB path (1 个事件)
pdb_path c:\Users\User\Desktop\2005\27.7.20\custom_pattern_brush_src\BrushTool\Release\BrushTool.pdb
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (3 个事件)
suspicious_features Connection to IP address suspicious_request POST http://37.139.21.175:8080/OUy1ZjXr/M1OOnVmnwoR/0ErNDWYqp0/Nak87kiJO1SWOrgUrw7/T6vir5MYGGyrPqEpy/
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:1121573493&cup2hreq=d7ce2a0f5875d04080439983c0797118de48806f5e587d886b14a7823c34eea8
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2
Performs some HTTP requests (7 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m
request POST http://37.139.21.175:8080/OUy1ZjXr/M1OOnVmnwoR/0ErNDWYqp0/Nak87kiJO1SWOrgUrw7/T6vir5MYGGyrPqEpy/
request POST https://update.googleapis.com/service/update2?cup2key=10:1121573493&cup2hreq=d7ce2a0f5875d04080439983c0797118de48806f5e587d886b14a7823c34eea8
request POST https://update.googleapis.com/service/update2
Sends data using the HTTP POST Method (3 个事件)
request POST http://37.139.21.175:8080/OUy1ZjXr/M1OOnVmnwoR/0ErNDWYqp0/Nak87kiJO1SWOrgUrw7/T6vir5MYGGyrPqEpy/
request POST https://update.googleapis.com/service/update2?cup2key=10:1121573493&cup2hreq=d7ce2a0f5875d04080439983c0797118de48806f5e587d886b14a7823c34eea8
request POST https://update.googleapis.com/service/update2
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619470400.391876
NtAllocateVirtualMemory
process_identifier: 1432
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x01f20000
success 0 0
1619470459.812001
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004070000
success 0 0
1619470406.312126
NtAllocateVirtualMemory
process_identifier: 3168
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004f0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Foreign language identified in PE resource (3 个事件)
name RT_ICON language LANG_CHINESE offset 0x000ad3bc filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000128
name RT_ICON language LANG_CHINESE offset 0x000ad3bc filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000128
name RT_GROUP_ICON language LANG_CHINESE offset 0x000af34c filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED size 0x00000022
Drops a binary and executes it (1 个事件)
file C:\Windows\SysWOW64\netcorehc\fdeploy.exe
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (13 个事件)
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619470403.844876
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4db6b3ecbc15b5cf74fa250de1de52bb.exe
newfilepath: C:\Windows\SysWOW64\netcorehc\fdeploy.exe
newfilepath_r: C:\Windows\SysWOW64\netcorehc\fdeploy.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\4db6b3ecbc15b5cf74fa250de1de52bb.exe
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619470420.359126
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)
entropy 7.3267114730937415 section {'size_of_data': '0x0000c000', 'virtual_address': '0x00098000', 'entropy': 7.3267114730937415, 'name': '.data', 'virtual_size': '0x0000f708'} description A section with a high entropy has been found
Expresses interest in specific running processes (1 个事件)
process fdeploy.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619470419.141126
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 212.51.142.238
host 24.234.133.205
host 37.139.21.175
Installs itself for autorun at Windows startup (1 个事件)
service_name fdeploy service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\netcorehc\fdeploy.exe"
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1619470405.000876
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x029ec440
display_name: fdeploy
error_control: 0
service_name: fdeploy
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\netcorehc\fdeploy.exe"
filepath_r: "C:\Windows\SysWOW64\netcorehc\fdeploy.exe"
service_manager_handle: 0x029ebe00
desired_access: 2
service_type: 16
password:
success 43959360 0
Deletes executed files from disk (1 个事件)
file C:\Windows\SysWOW64\netcorehc\fdeploy.exe
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619470422.937126
RegSetValueExA
key_handle: 0x000003b8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619470422.937126
RegSetValueExA
key_handle: 0x000003b8
value: »¾®:×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619470422.937126
RegSetValueExA
key_handle: 0x000003b8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619470422.937126
RegSetValueExW
key_handle: 0x000003b8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619470422.937126
RegSetValueExA
key_handle: 0x000003d0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619470422.937126
RegSetValueExA
key_handle: 0x000003d0
value: »¾®:×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619470422.937126
RegSetValueExA
key_handle: 0x000003d0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619470422.953126
RegSetValueExW
key_handle: 0x000003b4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\netcorehc\fdeploy.exe:Zone.Identifier
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Johnnie.265357
FireEye Generic.mg.4db6b3ecbc15b5cf
CAT-QuickHeal Trojan.Emotet
McAfee Emotet-FRI!4DB6B3ECBC15
Cylance Unsafe
Sangfor Malware
K7AntiVirus Trojan ( 0056eb241 )
Alibaba Trojan:Win32/Emotet.b2c1097a
K7GW Trojan ( 0056eb241 )
Cybereason malicious.cbc15b
Arcabit Trojan.Johnnie.D40C8D
Cyren W32/Kryptik.BRS.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
ClamAV Win.Dropper.Emotet-9815503-0
Kaspersky HEUR:Trojan-Banker.Win32.Emotet.gen
BitDefender Gen:Variant.Johnnie.265357
NANO-Antivirus Trojan.Win32.Emotet.hpchzv
AegisLab Trojan.Win32.Emotet.L!c
Avast Win32:Malware-gen
Rising Trojan.Kryptik!1.C983 (CLASSIC)
Ad-Aware Gen:Variant.Johnnie.265357
TACHYON Banker/W32.Emotet.704512.B
Emsisoft Trojan.Emotet (A)
Comodo Malware@#zrezg7jm3nfv
F-Secure Trojan.TR/Kryptik.wfhuj
DrWeb Trojan.DownLoader34.9048
VIPRE Trojan.Win32.Generic!BT
TrendMicro TROJ_GEN.R002C0DLB20
McAfee-GW-Edition BehavesLike.Win32.Emotet.jh
Sophos Mal/Generic-R + Troj/Emotet-CKI
Ikarus Trojan-Banker.Emotet
Jiangmin Trojan.Banker.Emotet.nzo
Avira TR/Kryptik.wfhuj
Antiy-AVL Trojan[Banker]/Win32.Emotet
Kingsoft Win32.Troj.Banker.(kcloud)
Gridinsoft Trojan.Win32.Emotet.oa!s1
Microsoft Trojan:Win32/Emotet.ARJ!MTB
ZoneAlarm HEUR:Trojan-Banker.Win32.Emotet.gen
GData Gen:Variant.Johnnie.265357
Cynet Malicious (score: 85)
AhnLab-V3 Trojan/Win32.Emotet.R346194
BitDefenderTheta Gen:NN.ZexaF.34742.RqW@ameVTVdj
ALYac Gen:Variant.Johnnie.265357
MAX malware (ai score=87)
VBA32 TrojanBanker.Emotet
Malwarebytes Trojan.MalPack.TRE
ESET-NOD32 a variant of Win32/Kryptik.HFFH
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 212.51.142.238:8080
dead_host 24.234.133.205:80
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-07-28 05:25:22

Imports

Library KERNEL32.dll:
• 0x47a1ac SetFileTime
• 0x47a1b0 SetFileAttributesA
• 0x47a1b4 GetFileAttributesA
• 0x47a1b8 GetFileTime
• 0x47a1bc SetErrorMode
• 0x47a1c0 GetTickCount
• 0x47a1c4 RtlUnwind
• 0x47a1c8 RaiseException
• 0x47a1cc HeapAlloc
• 0x47a1d0 HeapFree
• 0x47a1d4 HeapReAlloc
• 0x47a1d8 VirtualProtect
• 0x47a1dc VirtualAlloc
• 0x47a1e0 GetSystemInfo
• 0x47a1e4 VirtualQuery
• 0x47a1e8 GetCommandLineA
• 0x47a1ec GetProcessHeap
• 0x47a1f0 GetStartupInfoA
• 0x47a1f4 ExitThread
• 0x47a1f8 CreateThread
• 0x47a1fc HeapSize
• 0x47a200 TerminateProcess
• 0x47a20c IsDebuggerPresent
• 0x47a210 Sleep
• 0x47a214 GetACP
• 0x47a218 FatalAppExitA
• 0x47a21c VirtualFree
• 0x47a220 HeapDestroy
• 0x47a228 GetStdHandle
• 0x47a23c SetHandleCount
• 0x47a240 GetFileType
• 0x47a250 GetStringTypeA
• 0x47a254 GetStringTypeW
• 0x47a25c GetConsoleCP
• 0x47a260 GetConsoleMode
• 0x47a264 LCMapStringA
• 0x47a268 LCMapStringW
• 0x47a26c GetTimeFormatA
• 0x47a270 GetDateFormatA
• 0x47a274 GetUserDefaultLCID
• 0x47a278 EnumSystemLocalesA
• 0x47a27c IsValidLocale
• 0x47a280 IsValidCodePage
• 0x47a284 GetLocaleInfoW
• 0x47a288 SetStdHandle
• 0x47a28c WriteConsoleA
• 0x47a290 GetConsoleOutputCP
• 0x47a294 WriteConsoleW
• 0x47a2a8 GetAtomNameA
• 0x47a2ac GetOEMCP
• 0x47a2b0 GetCPInfo
• 0x47a2b4 CreateFileA
• 0x47a2b8 GetShortPathNameA
• 0x47a2bc GetFullPathNameA
• 0x47a2c4 FindFirstFileA
• 0x47a2c8 FindClose
• 0x47a2cc DuplicateHandle
• 0x47a2d0 GetThreadLocale
• 0x47a2d4 GetFileSize
• 0x47a2d8 SetEndOfFile
• 0x47a2dc UnlockFile
• 0x47a2e0 LockFile
• 0x47a2e4 FlushFileBuffers
• 0x47a2e8 SetFilePointer
• 0x47a2ec WriteFile
• 0x47a2f0 ReadFile
• 0x47a2f4 DeleteFileA
• 0x47a2f8 MoveFileA
• 0x47a300 TlsFree
• 0x47a308 LocalReAlloc
• 0x47a30c TlsSetValue
• 0x47a310 TlsAlloc
• 0x47a318 GlobalHandle
• 0x47a320 TlsGetValue
• 0x47a328 LocalAlloc
• 0x47a32c GlobalFlags
• 0x47a340 GlobalReAlloc
• 0x47a348 GetModuleFileNameW
• 0x47a34c CopyFileA
• 0x47a350 GlobalSize
• 0x47a354 FormatMessageA
• 0x47a358 LocalFree
• 0x47a35c MulDiv
• 0x47a360 GlobalGetAtomNameA
• 0x47a364 GlobalFindAtomA
• 0x47a368 lstrcmpW
• 0x47a36c GetVersionExA
• 0x47a370 GlobalUnlock
• 0x47a374 GlobalFree
• 0x47a378 FreeResource
• 0x47a37c GetCurrentProcessId
• 0x47a380 SetLastError
• 0x47a384 GlobalAddAtomA
• 0x47a388 CreateEventA
• 0x47a38c SuspendThread
• 0x47a390 SetEvent
• 0x47a394 WaitForSingleObject
• 0x47a398 ResumeThread
• 0x47a39c SetThreadPriority
• 0x47a3a0 CloseHandle
• 0x47a3a4 GetCurrentThread
• 0x47a3a8 GetCurrentThreadId
• 0x47a3b0 GetModuleFileNameA
• 0x47a3b8 GetLocaleInfoA
• 0x47a3bc GlobalLock
• 0x47a3c0 lstrcmpA
• 0x47a3c4 GlobalAlloc
• 0x47a3c8 GlobalDeleteAtom
• 0x47a3cc GetModuleHandleA
• 0x47a3d0 GetStringTypeExW
• 0x47a3d4 GetStringTypeExA
• 0x47a3e0 lstrlenA
• 0x47a3e4 lstrcmpiW
• 0x47a3e8 lstrcmpiA
• 0x47a3ec CompareStringW
• 0x47a3f0 CompareStringA
• 0x47a3f4 lstrlenW
• 0x47a3f8 GetVersion
• 0x47a3fc GetLastError
• 0x47a400 MultiByteToWideChar
• 0x47a404 InterlockedExchange
• 0x47a40c LoadLibraryA
• 0x47a410 FreeLibrary
• 0x47a414 lstrcatA
• 0x47a418 CreateProcessA
• 0x47a41c ExitProcess
• 0x47a420 LoadLibraryExA
• 0x47a424 GetProcAddress
• 0x47a428 GetCurrentProcess
• 0x47a42c WideCharToMultiByte
• 0x47a430 WinExec
• 0x47a434 FindResourceA
• 0x47a438 LoadResource
• 0x47a43c LockResource
• 0x47a440 HeapCreate
• 0x47a444 SizeofResource
Library USER32.dll:
• 0x47a524 IsRectEmpty
• 0x47a528 SetRect
• 0x47a52c InvalidateRgn
• 0x47a530 GetNextDlgGroupItem
• 0x47a534 UnregisterClassA
• 0x47a53c SetMenu
• 0x47a540 BringWindowToTop
• 0x47a544 CreatePopupMenu
• 0x47a548 InsertMenuItemA
• 0x47a54c LoadAcceleratorsA
• 0x47a550 LoadMenuA
• 0x47a554 ReuseDDElParam
• 0x47a558 UnpackDDElParam
• 0x47a560 GetKeyNameTextA
• 0x47a564 MapVirtualKeyA
• 0x47a568 SetParent
• 0x47a56c UnionRect
• 0x47a570 PostThreadMessageA
• 0x47a574 SetTimer
• 0x47a578 KillTimer
• 0x47a57c GetDCEx
• 0x47a580 LockWindowUpdate
• 0x47a584 ClientToScreen
• 0x47a588 GrayStringA
• 0x47a58c DrawTextExA
• 0x47a590 DrawTextA
• 0x47a594 TabbedTextOutA
• 0x47a598 FillRect
• 0x47a59c GetMenuStringA
• 0x47a5a0 InsertMenuA
• 0x47a5a4 RemoveMenu
• 0x47a5a8 ScrollWindowEx
• 0x47a5ac ShowWindow
• 0x47a5b0 MoveWindow
• 0x47a5b4 SetWindowTextA
• 0x47a5b8 IsDialogMessageA
• 0x47a5bc IsDlgButtonChecked
• 0x47a5c0 SetDlgItemTextA
• 0x47a5c4 SetDlgItemInt
• 0x47a5c8 GetDlgItemTextA
• 0x47a5cc GetDlgItemInt
• 0x47a5d0 CheckRadioButton
• 0x47a5d4 CheckDlgButton
• 0x47a5dc SendDlgItemMessageA
• 0x47a5e0 WinHelpA
• 0x47a5e4 IsChild
• 0x47a5e8 GetCapture
• 0x47a5ec GetClassLongA
• 0x47a5f0 GetClassNameA
• 0x47a5f4 SetPropA
• 0x47a5f8 GetPropA
• 0x47a5fc RemovePropA
• 0x47a600 SetFocus
• 0x47a608 GetWindowTextA
• 0x47a60c GetForegroundWindow
• 0x47a610 BeginDeferWindowPos
• 0x47a614 EndDeferWindowPos
• 0x47a618 UnhookWindowsHookEx
• 0x47a61c GetMessageTime
• 0x47a620 GetMessagePos
• 0x47a624 MapWindowPoints
• 0x47a628 ScrollWindow
• 0x47a62c TrackPopupMenuEx
• 0x47a630 CharNextA
• 0x47a634 SetScrollRange
• 0x47a638 GetScrollRange
• 0x47a63c SetScrollPos
• 0x47a640 GetScrollPos
• 0x47a644 SetForegroundWindow
• 0x47a648 ShowScrollBar
• 0x47a64c UpdateWindow
• 0x47a650 GetMenu
• 0x47a654 GetSubMenu
• 0x47a658 GetMenuItemID
• 0x47a65c GetMenuItemCount
• 0x47a660 CreateWindowExA
• 0x47a664 GetClassInfoExA
• 0x47a668 GetClassInfoA
• 0x47a66c RegisterClassA
• 0x47a670 AdjustWindowRectEx
• 0x47a674 ScreenToClient
• 0x47a678 EqualRect
• 0x47a67c DeferWindowPos
• 0x47a680 CopyRect
• 0x47a684 GetScrollInfo
• 0x47a688 SetScrollInfo
• 0x47a68c SetWindowPlacement
• 0x47a690 GetDlgCtrlID
• 0x47a694 DefWindowProcA
• 0x47a698 CallWindowProcA
• 0x47a69c OffsetRect
• 0x47a6a0 IntersectRect
• 0x47a6a8 GetWindowPlacement
• 0x47a6ac GetWindow
• 0x47a6b4 MapDialogRect
• 0x47a6b8 SetWindowPos
• 0x47a6bc GetDesktopWindow
• 0x47a6c0 SetActiveWindow
• 0x47a6c8 DestroyWindow
• 0x47a6cc GetDlgItem
• 0x47a6d0 GetNextDlgTabItem
• 0x47a6d4 EndDialog
• 0x47a6dc GetWindowLongA
• 0x47a6e0 GetLastActivePopup
• 0x47a6e4 IsWindowEnabled
• 0x47a6e8 MessageBoxA
• 0x47a6ec ShowOwnedPopups
• 0x47a6f0 SetWindowsHookExA
• 0x47a6f4 CallNextHookEx
• 0x47a6f8 PtInRect
• 0x47a6fc SetRectEmpty
• 0x47a700 DrawIcon
• 0x47a704 AppendMenuA
• 0x47a708 SendMessageA
• 0x47a70c GetSystemMenu
• 0x47a710 GetMessageA
• 0x47a714 TranslateMessage
• 0x47a718 DispatchMessageA
• 0x47a71c GetActiveWindow
• 0x47a720 IsWindowVisible
• 0x47a724 GetKeyState
• 0x47a728 PeekMessageA
• 0x47a72c GetCursorPos
• 0x47a730 ValidateRect
• 0x47a734 SetMenuItemBitmaps
• 0x47a73c LoadBitmapA
• 0x47a740 GetFocus
• 0x47a744 ModifyMenuA
• 0x47a748 GetDialogBaseUnits
• 0x47a74c DestroyIcon
• 0x47a750 GetSysColorBrush
• 0x47a754 WaitMessage
• 0x47a758 DeleteMenu
• 0x47a75c WindowFromPoint
• 0x47a760 DestroyMenu
• 0x47a764 GetMenuItemInfoA
• 0x47a768 EndPaint
• 0x47a76c BeginPaint
• 0x47a770 TrackPopupMenu
• 0x47a774 GetWindowDC
• 0x47a778 IsIconic
• 0x47a77c GetWindowRect
• 0x47a780 GetClientRect
• 0x47a784 InvalidateRect
• 0x47a788 OpenClipboard
• 0x47a78c EnableWindow
• 0x47a790 LoadIconA
• 0x47a794 GetSystemMetrics
• 0x47a798 CloseClipboard
• 0x47a79c SetClipboardData
• 0x47a7a0 SetCursor
• 0x47a7a4 InflateRect
• 0x47a7a8 GetDC
• 0x47a7ac ReleaseDC
• 0x47a7b0 RedrawWindow
• 0x47a7b4 SetCapture
• 0x47a7b8 GetParent
• 0x47a7bc MessageBeep
• 0x47a7c0 ReleaseCapture
• 0x47a7c4 IsWindow
• 0x47a7c8 GetSysColor
• 0x47a7cc DestroyCursor
• 0x47a7d0 SetWindowLongA
• 0x47a7d4 CopyIcon
• 0x47a7d8 LoadCursorA
• 0x47a7dc CharLowerA
• 0x47a7e0 CharLowerW
• 0x47a7e4 CharUpperA
• 0x47a7e8 CharUpperW
• 0x47a7ec PostQuitMessage
• 0x47a7f0 PostMessageA
• 0x47a7f4 CheckMenuItem
• 0x47a7f8 EnableMenuItem
• 0x47a7fc GetMenuState
• 0x47a800 GetTopWindow
Library GDI32.dll:
• 0x47a038 SetWindowOrgEx
• 0x47a03c OffsetWindowOrgEx
• 0x47a040 SetWindowExtEx
• 0x47a044 ScaleWindowExtEx
• 0x47a04c ArcTo
• 0x47a050 PolyDraw
• 0x47a054 PolylineTo
• 0x47a058 PolyBezierTo
• 0x47a05c ExtSelectClipRgn
• 0x47a060 DeleteDC
• 0x47a068 CreatePatternBrush
• 0x47a06c CreateCompatibleDC
• 0x47a070 SelectPalette
• 0x47a074 PlayMetaFileRecord
• 0x47a078 GetObjectType
• 0x47a07c EnumMetaFile
• 0x47a080 ScaleViewportExtEx
• 0x47a084 CreatePen
• 0x47a088 ExtCreatePen
• 0x47a08c CreateSolidBrush
• 0x47a090 CreateHatchBrush
• 0x47a098 SetRectRgn
• 0x47a09c CombineRgn
• 0x47a0a0 GetMapMode
• 0x47a0a4 PatBlt
• 0x47a0a8 DPtoLP
• 0x47a0ac GetTextMetricsA
• 0x47a0b0 GetBkColor
• 0x47a0b4 GetTextColor
• 0x47a0b8 GetRgnBox
• 0x47a0c0 GetCharWidthA
• 0x47a0c4 CreateFontA
• 0x47a0c8 StretchDIBits
• 0x47a0cc SetViewportExtEx
• 0x47a0d0 OffsetViewportOrgEx
• 0x47a0d4 SetViewportOrgEx
• 0x47a0d8 SelectObject
• 0x47a0dc Escape
• 0x47a0e0 ExtTextOutA
• 0x47a0e4 TextOutA
• 0x47a0e8 RectVisible
• 0x47a0ec PtVisible
• 0x47a0f0 StartDocA
• 0x47a0f4 GetPixel
• 0x47a0f8 BitBlt
• 0x47a0fc PlayMetaFile
• 0x47a100 CreateBrushIndirect
• 0x47a104 GetViewportExtEx
• 0x47a108 SelectClipPath
• 0x47a10c CreateRectRgn
• 0x47a110 GetClipRgn
• 0x47a114 SelectClipRgn
• 0x47a118 DeleteObject
• 0x47a11c SetColorAdjustment
• 0x47a120 SetArcDirection
• 0x47a124 SetMapperFlags
• 0x47a130 SetTextAlign
• 0x47a134 MoveToEx
• 0x47a138 LineTo
• 0x47a13c OffsetClipRgn
• 0x47a140 IntersectClipRect
• 0x47a144 ExcludeClipRect
• 0x47a148 SetMapMode
• 0x47a150 SetWorldTransform
• 0x47a154 SetGraphicsMode
• 0x47a158 SetStretchBltMode
• 0x47a15c SetROP2
• 0x47a160 SetPolyFillMode
• 0x47a164 SetBkMode
• 0x47a168 RestoreDC
• 0x47a16c SaveDC
• 0x47a170 CreateDCA
• 0x47a174 CopyMetaFileA
• 0x47a178 GetDeviceCaps
• 0x47a17c SetBkColor
• 0x47a180 SetTextColor
• 0x47a184 GetClipBox
• 0x47a188 GetDCOrgEx
• 0x47a190 GetObjectA
• 0x47a194 CreateFontIndirectA
• 0x47a198 GetStockObject
• 0x47a19c Rectangle
• 0x47a1a0 CreateBitmap
• 0x47a1a4 GetWindowExtEx
Library comdlg32.dll:
• 0x47a818 GetFileTitleA
Library WINSPOOL.DRV:
• 0x47a808 DocumentPropertiesA
• 0x47a80c OpenPrinterA
• 0x47a810 ClosePrinter
Library ADVAPI32.dll:
• 0x47a000 RegDeleteValueA
• 0x47a004 RegSetValueExA
• 0x47a008 RegCreateKeyExA
• 0x47a00c RegSetValueA
• 0x47a010 RegOpenKeyA
• 0x47a014 RegEnumKeyA
• 0x47a018 RegDeleteKeyA
• 0x47a01c RegQueryValueA
• 0x47a024 RegOpenKeyExA
• 0x47a028 RegQueryValueExA
• 0x47a02c RegCloseKey
• 0x47a030 RegCreateKeyA
Library SHELL32.dll:
• 0x47a4f0 ExtractIconA
• 0x47a4f4 SHGetFileInfoA
• 0x47a4f8 DragFinish
• 0x47a4fc DragQueryFileA
• 0x47a500 ShellExecuteA
Library SHLWAPI.dll:
• 0x47a50c PathFindFileNameA
• 0x47a510 PathStripToRootA
• 0x47a514 PathFindExtensionA
• 0x47a518 PathIsUNCA
Library oledlg.dll:
• 0x47a8a8
Library ole32.dll:
• 0x47a824 OleInitialize
• 0x47a82c OleUninitialize
• 0x47a830 OleRun
• 0x47a834 StringFromGUID2
• 0x47a838 CoCreateInstance
• 0x47a83c CoDisconnectObject
• 0x47a84c CoGetClassObject
• 0x47a850 OleDuplicateData
• 0x47a854 CoRevokeClassObject
• 0x47a858 ReleaseStgMedium
• 0x47a85c CreateBindCtx
• 0x47a860 CoTreatAsClass
• 0x47a864 StringFromCLSID
• 0x47a868 ReadClassStg
• 0x47a86c ReadFmtUserTypeStg
• 0x47a870 OleRegGetUserType
• 0x47a874 WriteClassStg
• 0x47a878 WriteFmtUserTypeStg
• 0x47a87c SetConvertStg
• 0x47a880 CoTaskMemFree
• 0x47a884 CLSIDFromString
• 0x47a888 CLSIDFromProgID
• 0x47a890 OleSetClipboard
• 0x47a894 OleFlushClipboard
• 0x47a89c CoTaskMemAlloc
Library OLEAUT32.dll:
• 0x47a44c SysAllocStringLen
• 0x47a450 VariantClear
• 0x47a454 VariantChangeType
• 0x47a458 VariantInit
• 0x47a45c SysStringLen
• 0x47a464 SysStringByteLen
• 0x47a474 SafeArrayDestroy
• 0x47a478 SysAllocString
• 0x47a480 SafeArrayAccessData
• 0x47a484 SafeArrayGetUBound
• 0x47a488 SafeArrayGetLBound
• 0x47a490 SafeArrayGetDim
• 0x47a494 SafeArrayCreate
• 0x47a498 SafeArrayRedim
• 0x47a49c VariantCopy
• 0x47a4a0 SafeArrayAllocData
• 0x47a4a8 SafeArrayCopy
• 0x47a4ac SafeArrayGetElement
• 0x47a4b0 SafeArrayPtrOfIndex
• 0x47a4b4 SafeArrayPutElement
• 0x47a4b8 SafeArrayLock
• 0x47a4bc SafeArrayUnlock
• 0x47a4c8 SysReAllocStringLen
• 0x47a4cc VarDateFromStr
• 0x47a4d0 VarBstrFromCy
• 0x47a4d4 VarBstrFromDec
• 0x47a4d8 VarDecFromStr
• 0x47a4dc VarCyFromStr
• 0x47a4e0 VarBstrFromDate
• 0x47a4e4 LoadTypeLib
• 0x47a4e8 SysFreeString

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49185 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49186 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49183 203.208.41.34 update.googleapis.com 443
192.168.56.101 49184 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49195 203.208.41.98 update.googleapis.com 443
192.168.56.101 49198 37.139.21.175 8080

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 54260 114.114.114.114 53
192.168.56.101 54991 114.114.114.114 53
192.168.56.101 55169 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56743 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=30222-47969
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=17756-30221
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://37.139.21.175:8080/OUy1ZjXr/M1OOnVmnwoR/0ErNDWYqp0/Nak87kiJO1SWOrgUrw7/T6vir5MYGGyrPqEpy/ 
POST /OUy1ZjXr/M1OOnVmnwoR/0ErNDWYqp0/Nak87kiJO1SWOrgUrw7/T6vir5MYGGyrPqEpy/ HTTP/1.1
Referer: http://37.139.21.175/OUy1ZjXr/M1OOnVmnwoR/0ErNDWYqp0/Nak87kiJO1SWOrgUrw7/T6vir5MYGGyrPqEpy/
Content-Type: multipart/form-data; boundary=---------------------------444923397463368
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 37.139.21.175:8080
Content-Length: 4564
Connection: Keep-Alive
Cache-Control: no-cache
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=1290324-1310831
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6742
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=101427-182003
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=701756-1290323
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=d0757b3c24d5f279&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619441314&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=6743-17755
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.