10.2
0-day
24 个模型检测该样本为恶意！
重新分析
更多

ce7f5d6a1cdaf1b2396d9646cb7045731a6f0c9d1586ee85e7944d7ff50dbd2b

681628f3808200aa87e81480ddd3ca9f.exe

分析耗时

111s

最近分析

文件大小

1.6MB
静态报毒 动态报毒 CMRTAZQAKBGTO CROSSRIDER CROSSRIDER1 DS@8M1BFT ELDORADO GLRPKQ GRAYWARE HIGH CONFIDENCE NXWZQLMSJ70O0O PLAYTECH PLAYTECHPMF R300843 RDMK S9225160 SUSGEN SUSPICIOUS PE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Playtech 20200211 6.0.6.653
Alibaba 20190527 0.3.0.5
Avast 20200211 18.4.3895.0
Tencent 20200212 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200212 2013.8.14.323
CrowdStrike 20190702 1.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path F:\QT_DL_INSTALLER_BUILD\web-installer\WebInstaller\noneAdminRelease\WebInstaller.pdb
Tries to locate where the browsers are installed (3 个事件)
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Mozilla Firefox
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
The file contains an unknown PE resource name possibly indicative of a packer (3 个事件)
resource name DATA
resource name PNG
resource name None
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:313134937&cup2hreq=b2868d699a88b1966cee1c9bb767138586a9b302430b537788d530a22659f264
Performs some HTTP requests (24 个事件)
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request GET http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
request GET http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/index.7ze
request GET http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze
request GET http://cache.download2.casino.com/download/casino/client_update_urls.php
request GET http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom/casino[zh-cn].cab
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620735626&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a939bee6462d9526&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620735143&mv=m&mvi=3
request GET https://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=Qar6cX%2FbAGzfAFb8Ftvv1lrbjg0yeW%2F9Y47FvN242TtS85wnqGfy%2F%2BfIKjeLQT9Uta3VF39vjsv5vnjCizsZZsso25UK2CQlb%2BI%2BYSIXUnbUnjerfylktcdIRc6RGIAEFZ%2F3Dg%2FVSG7c7dX7nBDX2HvinA0k3LRy7RchgiNMbglHHwaDLzLQS7nOxlvwO6OH1mlATU19f4%2B3ytyZY%2BuUoGYojWhYRYi%2F0AZ%2BEaIGgxGxjQ%2BC3BfzrA3Z4os31oXDfAx1QJ%2BNk%2BW6O1HXi2yL%2B3%2F01J7JSe30cD9bH3wHTZACgPbVEWliliIWuYIsKL2CVEBr2Bn%2Bv9IUy%2FMg%2BJyYriSD6h9fbdMy7AsffxMNX6kWrgoFgc7cmj1MrmWHXrWS%2Bj70TSJZyrFxLaobqvVFAJMUnwLYR9lGp0BwmEwn%2Flyco0bkwi38N36YpdS0W6vFa2ZO4W%2BCioihBfsWagh%2Bk76R3o1Yl%2Fq7JCf3bBMIuwrJqGn%2BOCVYbtFt05qBf%2Bam3vyxfBga0f9Ynlmw%2FqXnU2TdRsMkSOwpRbzO2%2BOQIRFpEteWi48HsEtoL5emIdz2j8XD3COR%2F2JVEe7m758NLhOJDpPCUqWNTgFELHxqwKmhRB%2FvwTJ20lX%2BPNSioapdP6i7nHNCOE5ZGiQD4cZl9ph0RxYBq3wo%2BfBxsepYg67BymLtsXhMyhKla%2FIQ1BMnuORJuQ4xMZoV8nDh62lo9UZTyvoox0b3aghFMv0RhXKqrjCuAFnY%2FE%2BF5lCAtlxZqi3MUrlJsufIjaDWhobXyGYLF%2B%2Bz8Iij0CgoudYs7HKwG9zncLXCoacbdgKGto2%2B5Z5XPUnGwjCrwLZNXUIHtaDAph%2BJIontk8XKBNV0a72fleDaYvC6P92wOOFTM3f21nUU%2FaG312fTLPGcCVkm3gLjDJ5LlmG7jYrO6W9nrTm8Q99AEzOL9l50yPnb8PYLPCktvOTSsJPhLh8%2BSirrdcw1l%2BZl3AriGOjkr8TxFi27N6SFQ95JFM3In8YpEST1iPt5OlKrYjy6UE64aBzhQ04aT13BOVUhiMjwUQu2Oc7S0hh9mT59cbW4A0%2FxedUPxLOB6uI2YFt7JiGIsJcloezAalw6H0dqSoEwgOTK5%2FK1iIo6VkIa14ZMbijQ83eUQjPFs7MDRzGItJVc8p6rR6hK9pWZu2ay07pAKCen7GkBK6zZMm5sxUiB2GwYMn0ImHnoBPEY%2FEXmcXhzugvjhv9h8jVS6Rqq8nns9bSK7l4PVMymuZFUrthwKk6%2BQBpa4WcotDa%2Fw1jUWUgM17SR3IY%2FiOZsOdty6imaPRl8zp4%2BsAsWqAYPVUrVEjuck2h8jInVgbGUuSpatQh%2FnpEHeg%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=OXQtd1Bp2bKzXKEDGI18rBhqTcb4DH3DCI0mUjfwjUYsgE8yagXZb2f4Mn%2Fnpl9qrbmB2QSPXsMfZBGvEkzAtkFUaY011BC67V22DPSekO6leJsdZDn%2BnRyRXEIQMdGtDrgRI85JPfTUQMKTmVqX%2FieB5yzN%2FSQK5V%2BCUYZL4Iz%2FD2no9hNdOHOH2E0t1P%2BYjTrAW31dm%2Brd4na7cYa%2Ba%2BBLOBo%2FY5REnFQXIt2xMrFybpHn%2BFrtqVFMLS8vMUXOSPcd7bTPPz9eNCGJBwHV1mvpR4ZSX8jNasZUThLw6fX2Gqra%2Bi%2B5YJYkPfqOsfyGBF51GaC58Vo2RCQrkdlu4tfwCfKpnP9HBWhUwSJ2huN1ei1fp9ILSpHs8AAPssGeTUelqc8wcnXDIoxWHO%2BtE57G95MxCb6qxhLSn3nk6DW6mssBfU3sOwSwuh%2FmGz%2BlUDg%2B0KLqiA0SyB6sanBa1xUUk%2BPh%2BQCU%2B8Qjp0Qd8%2Fu0i1nR1xsO1hScHL1niYPrPRaOD%2B5g59lBsOY%2F%2B%2BErIV7sSlIhUz2qc6H3f7UuBahuRJg19L4Buwpx7VPSG9tkwMIG3Nt7YzCQbaiLRvhNtmcX9NHmZ7ukWOiXz3%2FpkgUBUpap5Tjy3iYORxoN1z3G8cvCzH8ZO58GZbHXU415OGDejCi1JRoG%2Bdl204GeGQKB4WfCdy1yzzpCQ1k9B9D0verq9RJVyMJKqy5DhVZmb6tDikPRcTCQs96PiQXOrb0YjoC3Pq2gkhMjqpYsAWxwIq97OJuusiclfq9zWJAaZsRw8cLMiAjtYmP4yM1EnYC8zD9%2BavY94sqQTtU7T9BNgW3XP%2Bbe4olu90UdHTXdXBwR%2BhyshvvlHlG63oMywvc%2BeTW3bqTyTOOchJ5Ahh4QIBtfdquDOx%2Bg5NeYSa85YLu2tMiPfPysvEWs%2BitszlMWjyTQDL9oAnUIBTTO60CH%2F7d64Tx8E8xTXN9J112Herx7WI%2Bq54dHv56R8gq%2Bbe2kHXJaPO9fPfWotxTjpiLjmNPfXeDk%2FQ7NM0cSy1fuM4b0EYRfWMqMlsKYacjauTNeIODLvOMmNE686FgFrEfuTu6HzDRGfT3IekG8TAWJyNzNj9Yfu1iQVrnpmN2i73XGmysnIpL%2B%2B8kjg0nbOu8iinco%2BAbHDAFcuyJjKP%2Bxel3Nn4fO6iM32UQsI%2BEEvevqJH7b2YEpihSCFJZX16YyYscgz5qHuZXur3mB7fr5aZ%2BFM64pkfDuUo2X%2BQx%2BhMaPmCz1jCgnUyiTyf6Q%2FiA%2Bj9XN8POeS6eb7Az%2F%2F6A0mBnO6hY0lrx%2FA8ItecdrPMh3VK9MHFyh7jxhKnyj0fD5uQ4x%2FxBDhZs97PZIdkXD9g%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=FcISDdE2qeaOb9Smo7VgKLLD5WAh7MRkeE5YBXmC22v7vSFrOR%2Bk2M4wwhV1GELJKyGqphjR3hQY%2BrCZdHbjM8x8AsPQ%2F939texf%2FlFEL0O32GSAs1fgY4kj4R4080HpZYngcpQSxMmsuTW03mSw6DYqMV%2BB%2B%2FB8FjXeTskgf18MXD%2BFMwX6LIsq7WmfQ%2BHJoANmOCkdShni4BrFe6RIYljxX%2B6Zkypo%2BHi7gDsesGa06kTBeEvSwDRqTftTOliHbzrBgrvAe%2FSCaYptCsGfoJ8HDlwXyo%2BXYM5Rx1NwQDu5UpcnBeToD8C9XS6M94LdGXSnXEE2AIsJ9Zc02nsnJhvDBWI9rSXYy%2FRB4%2B6lLhUERK%2Fi6NeLfPomoeNUn%2BcoTO%2BpqPmaA8Iy7qFthiOuOWuBhluN7%2Bwn47n3UTlWBIQl4hy6XL4C1HSVUzrTQ0fW52xCZLNdDG%2F9vG8r9mIKg5VX7tujN5S4LK%2BcD%2Bdt6j8IP4oFUWvhvWWOn%2B%2FUbSzINWMOmCHoTI6jAqC71MejK1JYSXsoSscCWkS5IchgourmFnne4UV2LVoB1qeZ8jGL3R%2FfVUXWO570%2F9LkDsfBbhgq1iV5HB0Nu4o1yuBitSHQLH4zc7IUIpwGqAXQrocwgBEZQwWe7NShUbe%2BDgsjiYmLWQqlDtCpbzsLubNBqcuH4Royo21O3wqpKvQHBEex8iycQCvStgHZpncxnLE9T%2FPPRCIiLcNdWn9juCaez9ikWZm5OdxrOFOHPtpfIM0VeoyFWsXSrgtD%2BSJMWsQDp%2B34NuOTqTVofJDnbJjDfbn6623dp6uM7GdFcyxuVghZHejIAowedfy9Fdqo4NfukG92R8xa1WHgg7Gd2eI5Gx0DHQv39YV%2F2Bp4y8%2FcUdZdkm8uEbIlgQyDzSwUTfvsjz6MhSjkKJ%2BEpitiToxvCqKfbl%2BEmGiIteJii87b6DCmqULvVHoqQVWq7q1T2e3wUy24X9HOiQmC69VARkTHXl%2F%2FHJjaqQw7VAtWJbz7oXfTtPHoiZaScxcxPLcN5sTKvHy75tfCjOlwCSotDREWGGhu5UCv9LYXZWkGBTcmFBxoctElNJT0p%2FJF1MF8Tgm1qUst5LNByx35ex1BPQRZ2qCW%2FIBjF8uXPFuIaZmLMTndH9kdQsGvJSudWjd7bZ0V%2BWzTVO5kdlml5a%2B%2FiYNsZfyme5dZgOz30LEoSfcK1r593sXhn%2Bp4z9OCucO5H5G0jkpVWHX8MBlf8abgFuleyXWIeyDdAd4wx1Pg78mLvNxRvYcb66Yv8VT9WYIf88e7JQtYFvtT%2FzcPYw7S19Rc6kC3woauJ5JjOYUmG0rbIQmfSGCVCq1Vl2YN7szx82E7rw%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=v3m7OVoDHJCc%2B4g0aToNgT%2FHi%2BSqRZEQXIMcGRZqCakX3CXDR40VjuyENy%2FjQQqprJXlIw4WAjBikKo5%2Fg5gCdvkzNK7gvg2bN8JPMMzq5LGTUSomEOBAnODKsxvCyOeAhQcy%2FvWsZP5BMFrGTJ%2FeXTEB0WvvrQq7BKe1bWIGRnLBLgnwNEoE0bLM6cnqNYhQSgxFUvofaFHV5ghJ23yGNJzjoj0HeVW3F1QHC4oXEkollrmVX8Bc4jXTL03R6P7P6zU2R3CIDnUGBAYYPvA%2F4fY8E8rkaIkg%2FpJb2p9%2B%2F6%2BQ9olpi%2BDaCpPziM5hdnGiNkFpgH1VIVPre6Q6v3KnBzN6cXXzAmHGDJne%2FpH%2Fxz4gi2FLM2edaxN%2BelMWU4%2FSqCHMTyG2uO2iLf0gvo44ftJLiNMBcymx3XcUbg%2FL7vlXFY8KSSvNML0TWxCEPK4paOw6PQM%2FM0QZjP3%2B3CZLG%2F%2Bn5pvE8xquItEe7XN08jg4Z%2F2UwhzIeEqT24kedBJpkNQxume9Qs5x%2FkEfjZXhy%2BzQouy4Fv1DwLbrbxUaJuCLpLB1mVZW9kP%2BOq%2BVnVdBIBXpKLZWQBpRMdIdCiYbowc25gdgkMDYV3gDTOqqN%2BvzQeRDX4o0%2FCV5HaSiBx0z6AiYyKQLxHOZKDng%2F0b1Ob6PNbb9e3J8xhGR8M6uN2r%2BujIYx4C0%2FFS3vSbb6VDShN5SIJXam0j0xsgQq85b9OQ74rjvu6yn9oezmkkhPilkLlO6JbsYaT%2BHsgz%2BuWri28U6WL%2BA%2BRf8F93K52vXCkFX2%2FZvYbj2rH7A1bjMWCHhOqbDd1qWkiBamSQuEyg0f3gDQ%2FUDE9UY%2B1wjEfUkGmCdV6vwjWKuAUXsDPUE81KXr7QdrUkgSGlLSU8dMEabBvCguemK0Az2tBNscWEdzI737Jmx6hf2aZaadMmnEO%2FLMqHJZ9xPr70XrI58NsZnRPWEnnDoV9gaW5rG2ZnUyNeVIvmWgzUGM8ak3ILjzKSX2l5Fd78SXa0tamqXldPTWmCEeql6ujhXV3hszQrSu2B8kxnJwGfgHvckL3iAtgDESUS87IhCx9Hkz6K%2BczevkgpbI1fEVC8Pw8V%2BZqqYiQaHG8sR%2BKB1I0w8yNFUCWSvKqwCHA3xVTI8JH6jRvebjRTUlrHG%2F%2Bni1FfGXPalJtIk%2Fsk30VTd1%2F%2F%2FCKPitFNe4vwbYK8u2FLaJyuj5eD7eKA2DSg9%2FcfZh2uTjdIaIsxR4xpN24li5%2Faub1bdmWF7b2QouBBXsOLapBGyVFTYRMvHNNg7ZmW1Y4jELHpDSBzktb%2BTmxduOwICP%2FJEhFfHWO65cKEHIv3L8zV0WHmLr%2B6YWXvNDcs3Jx35qsBPQ%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=a5bHm9wceMhX2cK%2Bz8xC%2FgDSViba%2FIpoBEsontZA4%2F%2BijayOEHdcSupWflSmUTOaZuC5cl9hz1QQwp1LvpGDmBLGNV6NICWVyu0CsTghtdAzoD%2FL8BpmzQv%2B4kQpZxtSNdLA78GbDnppl74UoAdmrmTAB6Jh0LFomW1jAyGex99ajm2O3RYX89P8ZLeb0dihXbd5ZWGnTkrsMSt%2FS20QgNt7kzuF0dhDPCnnClMer%2FHseespjhjpjSDNjX33nlQFpPktmwyXDIOAL%2F%2FLTx2LlNFyODesp9Qygcmrw%2BJluueFhro7K0P%2BroXD5M8DYEG%2B6Fah9AIeqHcYHqI2oAdBlqJE7R45qnRAGJsiXyzfXtAKShRrIwvgV0a5iwjmHyHsJwE5%2F4M7avItPvqVLwV3ymeaBtXsRf4a55wfb7rwh2KMZRD8SxsjcsMHg%2FevdWh1oK%2FVU8INL2pllXhozxomqsJvwFOODqqOVq%2BGOjfR4v3EL5dxbXkiRmXCz4vMwwcr8phGm%2BFYQxselG6Eh2OAJkqKqfU7HtOZv1EJYCi08G6XMqu6OSpFdTPztd%2B99lj%2FoRR3%2BbsQPFz6ZTqfTUKii20KAlPF82qq5Fohp7zxHqw0CSiWxSA5ht7H%2B85yPnlzSXKGnioxFnH1ucg9jgv7Xr2L1NWIk%2Fd3hyPnizl%2BvfkNYZLsw3uhIoSgDPRg3wrcLCyYndCC3K88VdCdx2al23VYAOKBPxfT4IjkAYu6kOygmdwzhY6AOFDa18%2BORmFckiDSmTonEpUACr5aQLe4MjDUAb7KqAGA3Ol3NihhMsuIMqGNeOC41GzZet48SeMafp0RiCsOf%2Fb0fTr7p%2BthWSr1UkSb1uTz5PhvhAgk2e4OvhDzvMd%2FBe8EGw0sRqC5cn8XYfZuWJNMCKjG7yhuUWNNFkpcldMeRKjpbFwntqz5KF6Ss7D1QZVQ9i3C5UiHwQOlnk8c%2F5eU71owLpBfhy%2FBbEWxqII3HcukajEhFKa78911mEUp9WBz5P6Yui8heF2dRw0MoFpx6YVT0LNX3wyYjcdywUDMqi%2FoM73owl%2BVVwJuDT5rBpZCYtipxTxDtwVz4%2FRn6qvYxy4l9TrWwHHOEJHPnt5PsG4JuFDxaykL3%2BT1TFZ2utLfk72dCo85eleRXjtQaI7U40K4XjSefq75FYuM1c%2Bd8SBAgYCe1TOtZFpiy8cIUDm%2FJJlPTffQZ88Tr6LPV2LFLXuv5dA7WB%2Buulma9VxjGo8CVEK61hAnUcfw0RP8MRmMQbowcHRLXM%2FHickB9njVe7mSDmybesb1EW8rgqAVwriAY0zh2OVS2lZFWwsN3JiUKJK1TjgyYy4UMbKzbNqgxIlwDPVJaQ%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=cxSC%2B3bDydhEPWUD7ULUHckNMXWYS%2FCxPt1punYMPuU07muTFtciz5pND%2Fed3BaaD2IgoZYRhqQ48J5GC6vTNfN3yxbTItwfg1pixNpkiUNIGi3ylEvFUpMqo6sTIAq%2Bt%2FLYqY2C2HdaTBHlevcpBQJlImkj8yd9pKTgw94kJ39mf588Or5JCMSnLKloyzjF%2BWCrEm2jukjmxwIKh2LqBrZyOkyGnVZ1Q7XaoBsTKLhKoR8lUuGMNeiz5eJAz9SqDSCpzQSzAofd62QfZ%2BM1PmPM40U4%2Fdfyj0UgzXnyS%2FQ9fLGjmd0rwyDfR4nkALWzYZ%2FaL3V7x6JjLDwjJAUDq1E55kYVpzpYLkMHmdHTjSo1lvQuRWUzDDev3LjNq3nZOQlwY7K%2BCrFEcJcUVAzU06nKRvznC8aWlat3CZXuNxS5EpxyKEjpQkat69fGtRxZC1ruY4hrnmCBfOj7ppkQHoxgDjBEl116v1sn5EJWibr7gODEqUnwKNsHdmCUucZsNPr1orjY3GwX7f2IetSaRQCBTlf%2ByvZM%2B4m19AP7vg5KYWm0WnxLWGMewm3zfXfPpgDnPHWHuglEKJ02Gq4TBLYjY4ahYt3nq6xS2yFldl%2B5aewOKYta5ohW3l%2BtHQXOfIVj6PLcX3Wbd5kcQW%2BQ%2FsYPy3LvoOeVUZCFW8A2fsQbXFnU3BsFaY2X3fv0TaMBDWKgYaXQ7tdg2J3MEYVIHDfLQkE3rGqwxclAy65nlMxsh3%2FHKF3%2B2fvE2OelXdAmBLxLmzJ369SSFbovwVhz%2FRD17H6b1sEezLZJttRzGsjYGciobuFwyE8Yzu2umZw%2B2chtx1SPyYIY07aC3yR2gi9XHsq4ug52up74%2Be77I2XckEzVTs03FmgwGuRce6AXGus7tcs7xaigQlrtqxiN5BUwuhHDH2pNTCV53mq04ntr5WSg8p0DKkzXpk4F5mX%2BgX4SK3%2FH2tc9agcRx%2F9quRf6SgVSWCiJmESjYVonEgwsmlYE%2FaUHsVpx2i0%2FuQOPlgGg%2BMUr94eaG11hsL%2BD8hrjwT6bpuZKxU%2BYeEwiucXYLHvGHDXsgK2DXJPBvwb9QsHUhpScjCGGaka6sDES42S30kPdpeRg3CdkvEG%2FXBelqd1dunUzZEIR0Sae15KESXiO70n59vrh0x%2FBK4Cjy24ypTSkmhk%2Bc57trBlTxxHG9tEgrbtcpXzKLP%2BwD1N1wQSGekAYorBqbJ9YfnSF1aoEr2IcRVGC297rrdSvtibHYW681DaFtk8gCQOkaVXJD6RG1pWdFB8eBMCAKD58AuFE50A%2FQ8mH9j5B%2F0UWH1uglENazQjf%2BoPRwKFG%2BIPFLvcqVLQeDEVqixf8zr%2FDwQ%3D%3D
request GET https://c6m7w2m9.ssl.hwcdn.net/playtech_cabs/casino_casinocom/casino[zh-cn].cab
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=Y38Cu1hxVGtCeLuPvkya3eEKvntTAoPcIXtMAnV7FIGJi430iWm3q7WsUlenPW9e%2FE%2F3LhIhqN5VyuOat8pMDGho8bk3qFIChWoIvxCxN4heoVkLZ3LO265OM8sQbwxTSZdMxDyXAt2OWFds%2FPySA13GNicJd%2BeJppEGA5pmNGXpKuDVfrXdUl7uK1wls97vEByFAYcZs0bxJn5vmkq97z%2BWf0XCGPqX6njorBGtMZWqSN4btRQ%2Bo8UrR4cVTsyqSEgJnFfeFWpHoQzBkmUpezwwjODGWLXAnRYqkVtXyfsvTkzsrFQfPVay4tM0oAGq96NP2NKCj0wo4ca6b4pf3io9Ufspo1BmTX5qfjhUwVIC%2FshmhOB9o3doXyKm%2BDgRi4ibwMjZmItnvXkKD%2FKBX6TXj79dNEv0d2trXOoxmq53QBhM9JTdjvCEl%2FQoO6pehAz85fMhtbaqTzzVpOsGkmPqYYuYxUioTEE5zXzsu8nV1y5ef1yIwyfk1meJG%2F0X27uPsLULS2XCwrXjfxhxrlhpoyEQwVl6%2Bk%2FU40pV7YZQpglnBMJAOzWlTTxU7dmli6QUjvyr6WBMfWQhxCWtVfZtYbWnykcw40aSP%2Bwyi2X7NFdLYOQDjkq5593l5W1TP7R8sP4Q5Ct1L46HbHBWrXP4uIITqdjtBLau%2Br6yViue1zizPAAuDnA0RTRAEf6hb0v1smSQeAqaG2x%2BncRP3%2FC9rzXO1qtcMWDau%2FlKtgaQSGlzhuWHgmWaH3nvvP%2FXkdkTFr%2BEKGLNJGCOZTlblHWdxjuCFkzh9W46c%2BDHt8NnmvquRe0LWIVgt1NlCFV5kFBntu4j2aHtKNwrWCHorLV0OogLh0NNPdU3PKLwG6OXwN4wApNd2I4uJNqQ1Mf7M5bFGYRrGWV4Regv0h31AHVVDJx7wRwJwZrl2o5lX9klOhl7uop%2FTxbJeZ6jbZT%2FtwRF%2BAKWETJSfRy50%2BZOClcyp5RZ51tZumu%2FYd1X%2FYPAmB7tzkM0gH5Oi1QTYRWWAUVXNhseCAGPyzyS1r%2BajJG438tCT7%2FzHQLIsuPOMy2qmdoiFwzO30bBe2l7Hf%2BEiptvE86%2B0k9yDrgZpnsKDstwJ1bxRq73ICcbToxG2T32u%2BbJG6O4r2zju9U77753A%2BjxvImv6jaz%2BJ5Pjb4SOUUFV6f6DmKiBZIE6O5l0TpSm3Ilvap88sNM6lSyeS1QUOiUvQOvgZhz7k4TGBIWw5lO%2FwRK3jM%2FWsa6Jc4XSA%2FzaQGiVf13cOk%2BpKaKqYiU77xfVrWYGDFZKxE6rm92DzEUaTZoAQU28WhK7rsRA5cQR%2FP8CFLhpnCSl1ohymNacwyi3dA9k1n46i9PHWc19w%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=tUP90FuLkaE%2BPszSSp9U4KvIlNb2U66XvUifrd8T%2BNKmKOg79YAF9%2BJ%2Fxe7O9gF3xHINLXXodKPi3y1Idae8s7%2BsRlJoaoVD6KcNKeQmANDcs4lWtY1Qhbw5xm8fseaPz2iYnxbFZcWk6jho61R%2FH2z%2B4eqeSJ7CPGK%2F9QAdKhwDDF9BXZ3%2F1s34AGg9%2BoHsHw72TWIrXclxS1tCLWV1cYCD14Ulipaudy74BzHBLpksL0fMfaQiXjq1em7TmlJfdA8PncaWpH9nFiHvErZi%2BZZepk7H1HlKVb0V3a0zLHyCV0a5%2FTTsrdC8SyFVeAAd179%2B5N3Rq1wvB7dA%2B9mrloN8VgUEYzvl1BxNE4%2BTf80Jlz8DXOl4Z%2B6mkQ3iN6togw38arcZ3XZ8GhqjZyEXjsZhv8ThNTPNVE%2FoSsZ6np2fzQKKd%2F5TJOcCqjgd2M2rXTxliI%2FPwOezVBpwc%2By09ReeQpVgQCQXRi0PgFT9FjpzPDiufpgQbmUmzjDNBWSGrOQ2qyTlLHMhDtCpX9WUyUszi1LbgYlaKQwjLz7GeLRHfm%2F%2Bd2%2BFvdcTCFOMB6M9%2BH9nnSkh5TAUE8eBa2EC1nHktav903O5XCK%2Fx2wIByq3tj7NvC4zKwNHsXB4f59pEq%2Bulr8F0LOY8i4F6vA2jOkT0gxUpsiYTD07pAi0e%2BU%2Fk39lGcHqWru%2BNe2peKbBFBtqYqH7fVevw1TsJFBCgsfJKuUdiAVBmSLnJOqaNaWh%2BfLN2QZNColaLDAsMkp4cVtlrLCUekuuNTr1JT4wwFDveZfs9khqdeL113YRlimLih0uw%2FOLwBXfw8PXUqT9Mo1tV48BFbN89A5PjFrmuoJBD8Nh5fw%2FL7S9j2OYvT0V7ThXvaQQNpiEA%2F1QpNdFd7U270uo3KpzPLjEmpC34t4wR0InnIj89sRvOmfWtc02b6jFyxBcMWr5oAmgc8VAOjjjTI3XXEA%2FN7uucNHKqABYqAUydObP6T3HqIG9Ut7M8TWJ%2FiQo8dxlT7iM8vKtkkxO7%2BIb87ffUjJBT7biFEems3%2F7wmPv2gpHTTzcHDyaU4SMWSpkO3Bbepcv%2F%2BJ%2B5nqZaCiNBZ6WVJ6ePxK%2F%2BgjiuqkpKqNKivoGBoJpzIb0jU74yepLuv84QYLWscBNw0DBwJjFPwJ1djn4TXhvZ4veSWoX%2FGMH6HVDOs3K1NUXAhII5HcZRYyReatQYw84RrZbwvg8TnLlZtIbXULuw56YSXNpfjbvEEyc8PEbiaif0NkuerQJ1G6ZpNX%2B%2FJn939pcXsB%2B9Jx7vsKgg2%2FWd9sRSqz8PnVDJ74bg9eMlOhlRAskl6iBV7SLmV9A2pgF2VKJhmXWtHh8U2tUUOyArA%3D%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=qZC8ysoiPHetfM6s0rIJZc078NC2kWtf0w79T%2BuR8N7xjbtsp28f%2Fd8imvIUGqHkABB2g%2FRMlgWkYEyBS9PiMDr4YlB7j0iwAFc02L7pJKY1%2FB%2B%2FQwaJZc6hToDeYMpn%2B33l7xiw2sh7Itn6u6AyVF29ff4Z%2FHBubyubPveH3oQqXXNykHD%2BaBzOu5Qh2tG2kRgL2MGCnqafo4d6kAz%2FbOTNUG57xx1tDQHg2JtPoiJwgY45y0r3O6O4dFQ47ec4aGfJRl3sAfFCFCUI5DmpO1bRPaWK7l2%2FY3w0XbGqPa8Dhw0eDTQGspUn9GYqGtx5Dp1XANlUeNAEXAYJtbHAcObaruU8GEVkgfCbOwWl9trl5LxsXrmhzcRqMHkixyg91hhyPQb%2BelFE2TACjgTcawtvGZneRS0UmnrOML05MNolog1UYlvyOjyuMzsPYofNhd68IIZliFhxAC7iMKOwfSt1gsutCBZVYwC0aTkhOuUFhA2xZvQtyd7ioEU%2FrUeQHMRN4BXE%2FQgDrjWivWacaevB%2FAF1Hd54zMBe5DgZ1ecAHI6ar%2BPYEiyBp9c3tjadA0rDV1OUqtiLT%2FkUdEe%2FmDFow0t%2Bs8gcBiZRchO8a51QsatwjyvjZ2YArx6cEtrALmAXRxw2S%2BOZb9%2BIfUoB%2FgNpeU8Shw3Nn%2FgeByNUuwhuwKt5rlbh9kZy8LqdtMW3RfFJwUdcn%2FG7Sg9wwDPe0bIjJaT%2Fmx2DEEfuBPzTNRqHJ1l29hv%2B3MpiBQ7Dwkg0rUCkZSGDR2cPchoY08gTXs7WA14aWaB2fbPbI16I9u%2FIjUyH7Wl649aIE2HKqck7G0rf5mx%2BSfV5LKW4df0WRwh4H0PHA3tJmyRYbe97HDmG%2F%2BVwbD8V0vNtS4ZTibe5ms9Hz8TYUPTQyDBe6sC9ydGMW1GpaUytGC0vfqwOdXbcmRSgyCN15bReRh3WA%2B1eOc6Fke205zJ%2F9FTMyRX10qoH%2BhRMdTkpaGxX4B3MQYfFdDrVNda5%2FGwqRsdf8W%2Bo2anJNQBR8zhEDrU1NMtuVzahwUoN33PNIdqj2JFGPJlN%2BFgC2boZqHxhTrvsCKeUKtZkPMwwsozejUY6MwFwDoXQnTZqHp2lXK7XH23LymoMQW9TvjwlDOfy60IoOVQfkN5cYxGJ0uglPKYUrg%2BDlSS%2Bh%2BvEK6kLRZU%2BFIyRjCPUDCWzDXSr0GH6EkFSlFJEmaPeevKAslAI6J24ALVfZry9qFHpSCzqmuOTgJRHkhkD494bFwAnT68gc3oZf820lo04P0HM3jAmcMIEb8ko7s6JEfydQkPXjrAD4bWoP7cmBgYvQBxD9jayUp8FKoFGn8GRvQ0Oq%2Fvx3bA06MM2BQ%3D%3D
request POST https://update.googleapis.com/service/update2?cup2key=10:313134937&cup2hreq=b2868d699a88b1966cee1c9bb767138586a9b302430b537788d530a22659f264
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=IHRrURqkMkhh7Jx03oO1PYVeqXbOOCxZ5TZpuvXKn4l48bl2B7YRv410q%2FauY9tOc7HfVaMAVvjIc4K1E7wMX9q8EOT9YeOVP2Fb6Ao2b8VMtYCI%2B6H2MLLjox0vodibTqR3fPjaNcGr0lrFs0dM2L2D2J3Krqq3eb3a6AHVhvTA4xQmKGHJ2%2FDiR0XBCxAkgIRj766pGySGvrWvi5AGBPCvzW%2FWLrT4Q9ghDa2chxI8n5hwW3VX6PPq9JR2ChoyOaLpd9a6QAlh1KV7Kt1ef2AfPmLdnGKWMZZgROmpcA485WyqIoOjaA%2FF%2BXjefTZ8vGUsDeqrj%2FzLxuHy48Gpirl5dBZ0lhSuaWShOn44N%2F8bMIgaleNJ6Yg2lOsu2PnWxHDgcokdxYLb1DLB%2B2mAu9OFmYPuEZrgQjRGDxRd2ZZnAOQTe1tmmv%2Fh7%2FFpBrYdFKXlubYChdYPdIn3IILi47guGukBJdCpUPp1rZ1ksuePv6To5MaZqtYAnDyptU7B9rBz3%2FJP87vmF85x0IobPn6ePMmKUY6tn%2B7eZkQNkJfoGC1B85VVrWplDshiYzF46lNs8c51VRs7UTKE%2B%2B8R23ZdT%2F2uvL64XufPHudKQ50nbKgkaO735fX4cyRYYGycPAFc%2Fk9jwtIrvbIjrnInett8I227kv1HOijW%2BkxCyh8u2%2BYACqriKxfXe1Eako5fgx%2F9M7YoHtDzZg5%2BvzJOznGSnxoYzFs5qPX1ytlRwO0UVctCB%2FHfXqDxBKFjVPbR8UGTrCuoKoWoYAA4U9qTrDJ%2B8cfQtQCipS2x2H2jgD%2BVzVV%2FHwQOppHDSCi7rUCW9bp3%2BL86NNcqnhHZ52mpLcFSSBib9FUGfk6CixtgatsCadgAJ1ccOnAnM%2BaxmAhGjncPK1UxJ2co9cl3%2F5Tyb%2BEWITElEo5H2shMLpQOLZvrRWFNM670Ey1ftBcSxlOTsRMRn551KQnEQIOCssKpSOWT8dL8o7nMlcpYqRh%2BJntssQnTvXXj1RArYOsIWEStZLs6awP9k%2BEyiNpyfeLY0HTd9vV%2B1K8ygbhBJRSTNkfDzoBsoHYRM%2BswYn3Bjr9x%2FfU4HoAeqh5Nk%2BzynucxI8Ag4bUumfe88tVlcKivE4Td%2Byuok5bWUBZhW0w82ppHwvFHaPLe5rCVrpZ5hmMQ0Q8PfUBGIcvV%2BWWd6FC%2BRSKaNf%2BDPxt2gXfowb%2BuvHATlCi1yoAMMxilV9KoTFVV30jqnkbKMy2XBP%2Frn2dJLtnYCxifC3uYG1VS8kg3EIpfjQXHMiOwrqtyZEEwEbHVUNb6gGnHIHByEnOS1hPqEICyjEl3J9m%2F9264jI51WPJYVoZG7x9AbmmTJDMAf2e3pw%3D%3D
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:313134937&cup2hreq=b2868d699a88b1966cee1c9bb767138586a9b302430b537788d530a22659f264
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620762724.56175
NtAllocateVirtualMemory
process_identifier: 2468
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02970000
success 0 0
1620764651.246375
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004770000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Steals private information from local Internet browsers (2 个事件)
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Firefox
registry HKEY_CURRENT_USER\Software\Mozilla\Mozilla Firefox
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\815B7C0CBF8446429A10798694A7CC60\casinocom_new_notif\js\template.js
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (8 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620762728.46875
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 个事件)
Time & API Arguments Status Return Repeated
1620762766.92175
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620762766.92175
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620762766.93675
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
1620762766.93675
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Queries for potentially installed applications (6 个事件)
Time & API Arguments Status Return Repeated
1620762723.04675
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620762723.04675
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x000000e0
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620762759.06175
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620762759.06175
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x000007e8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620762759.06175
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620762759.06175
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x000007e8
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620762759.07775
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Playtech WinClient Downloader/1.0
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Attempts to create or modify system certificates (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620762731.04675
RegSetValueExA
key_handle: 0x000004d4
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620762731.04675
RegSetValueExA
key_handle: 0x000004d4
value: @Âü†‡F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620762731.04675
RegSetValueExA
key_handle: 0x000004d4
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620762731.04675
RegSetValueExW
key_handle: 0x000004d4
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620762731.04675
RegSetValueExA
key_handle: 0x000004ec
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620762731.04675
RegSetValueExA
key_handle: 0x000004ec
value: @Âü†‡F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620762731.06175
RegSetValueExA
key_handle: 0x000004ec
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620762731.07775
RegSetValueExW
key_handle: 0x000004d0
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620762755.54675
RegSetValueExA
key_handle: 0x0000053c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620762755.54675
RegSetValueExA
key_handle: 0x0000053c
value: €)—•‡F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620762755.54675
RegSetValueExA
key_handle: 0x0000053c
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620762755.54675
RegSetValueExW
key_handle: 0x0000053c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620762755.54675
RegSetValueExA
key_handle: 0x0000076c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620762755.54675
RegSetValueExA
key_handle: 0x0000076c
value: €)—•‡F×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620762755.54675
RegSetValueExA
key_handle: 0x0000076c
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 个事件)
DrWeb Trojan.Crossrider1.63459
CAT-QuickHeal PUA.PlaytechPMF.S9225160
McAfee Playtech
K7AntiVirus Adware ( 005295061 )
K7GW Adware ( 005295061 )
Invincea heuristic
F-Prot W32/PlayTech.C.gen!Eldorado
NANO-Antivirus Trojan.Win32.Crossrider1.glrpkq
Comodo Application.Win32.Playtech.DS@8m1bft
McAfee-GW-Edition Playtech
Ikarus PUA.PlayTech
Cyren W32/PlayTech.C.gen!Eldorado
MaxSecure Trojan.Malware.121218.susgen
Antiy-AVL GrayWare/Win32.PlayTech.FC71
Microsoft PUA:Win32/Playtech
Endgame malicious (high confidence)
AhnLab-V3 PUP/Win32.Playtech.R300843
VBA32 Trojan.Crossrider
APEX Malicious
ESET-NOD32 a variant of Win32/PlayTech.A potentially unwanted
Rising PUF.PlayTech!1.B89C (RDMK:cmRtazqAkBGtO/NxwZqLMSj70o0o)
SentinelOne DFI - Suspicious PE
Fortinet Riskware/PlayTech.FC71
Webroot W32.Adware.Gen
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 192.168.56.101:49194
dead_host 172.217.160.110:443
dead_host 172.217.24.14:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-11-13 16:34:35

Imports

Library WININET.dll:
• 0x51a4d8 InternetConnectW
• 0x51a4dc HttpSendRequestW
• 0x51a4e0 InternetSetOptionW
• 0x51a4e4 HttpQueryInfoW
• 0x51a4e8 InternetReadFile
• 0x51a4f0 InternetCloseHandle
• 0x51a4f8 InternetCrackUrlW
• 0x51a500 HttpOpenRequestW
• 0x51a504 InternetOpenW
Library VERSION.dll:
• 0x51a4c8 VerQueryValueW
• 0x51a4cc GetFileVersionInfoW
Library gdiplus.dll:
• 0x51a50c GdiplusStartup
• 0x51a510 GdiplusShutdown
• 0x51a518 GdipReleaseDC
• 0x51a51c GdipGetImageWidth
• 0x51a520 GdipCloneImage
• 0x51a524 GdipFillRectangleI
• 0x51a528 GdipCreateFromHDC
• 0x51a534 GdipDisposeImage
• 0x51a538 GdipAlloc
• 0x51a53c GdipCreateSolidFill
• 0x51a544 GdipDrawImageRectI
• 0x51a548 GdipDeleteGraphics
• 0x51a54c GdipSetPenMode
• 0x51a550 GdipGetImageHeight
• 0x51a554 GdipDeletePen
• 0x51a558 GdipFree
• 0x51a55c GdipDeleteBrush
• 0x51a560 GdipCreatePen1
Library PSAPI.DLL:
Library CRYPT32.dll:
• 0x51a054 CryptMsgClose
• 0x51a058 CertGetNameStringW
• 0x51a064 CertCloseStore
• 0x51a068 CryptMsgGetParam
• 0x51a06c CryptQueryObject
Library KERNEL32.dll:
• 0x51a0a4 EncodePointer
• 0x51a0a8 ReadConsoleInputA
• 0x51a0ac SetConsoleMode
• 0x51a0b0 IsValidCodePage
• 0x51a0b4 GetACP
• 0x51a0b8 GetOEMCP
• 0x51a0c4 GetVersionExW
• 0x51a0c8 WriteFile
• 0x51a0cc ReadFile
• 0x51a0d0 GetStdHandle
• 0x51a0d4 GetLastError
• 0x51a0e4 WideCharToMultiByte
• 0x51a0e8 MultiByteToWideChar
• 0x51a0ec GetFullPathNameW
• 0x51a0f0 CreateDirectoryW
• 0x51a0f4 SetFileTime
• 0x51a0f8 CreateFileW
• 0x51a0fc lstrlenW
• 0x51a100 RemoveDirectoryW
• 0x51a104 CloseHandle
• 0x51a108 DeleteFileW
• 0x51a10c SetFileAttributesW
• 0x51a110 FindFirstFileW
• 0x51a114 FindClose
• 0x51a118 FindNextFileW
• 0x51a11c GetFileSize
• 0x51a120 SetFilePointer
• 0x51a124 SetEndOfFile
• 0x51a128 GlobalMemoryStatus
• 0x51a12c GetModuleHandleW
• 0x51a130 GetProcAddress
• 0x51a134 GetSystemInfo
• 0x51a138 VirtualFree
• 0x51a13c VirtualAlloc
• 0x51a140 WaitForSingleObject
• 0x51a144 SetEvent
• 0x51a14c ResetEvent
• 0x51a150 CreateEventW
• 0x51a154 FindResourceExW
• 0x51a158 FindResourceW
• 0x51a15c LoadResource
• 0x51a160 LockResource
• 0x51a168 OutputDebugStringW
• 0x51a16c GetCurrentThreadId
• 0x51a170 GetCurrentProcessId
• 0x51a178 CreateThread
• 0x51a17c CopyFileW
• 0x51a180 GetFileAttributesW
• 0x51a184 lstrlenA
• 0x51a18c FlushFileBuffers
• 0x51a190 GetLongPathNameW
• 0x51a194 GetVersion
• 0x51a198 MapViewOfFile
• 0x51a19c UnmapViewOfFile
• 0x51a1a0 FlushViewOfFile
• 0x51a1a4 Sleep
• 0x51a1a8 GetModuleFileNameW
• 0x51a1ac CreateFileMappingW
• 0x51a1b0 GetCurrentProcess
• 0x51a1b4 OpenProcess
• 0x51a1b8 TerminateProcess
• 0x51a1bc Process32FirstW
• 0x51a1c0 Process32NextW
• 0x51a1c8 HeapAlloc
• 0x51a1cc HeapFree
• 0x51a1d0 GetProcessHeap
• 0x51a1d4 GetTickCount
• 0x51a1d8 GetExitCodeProcess
• 0x51a1e0 GetProcessId
• 0x51a1e4 LocalAlloc
• 0x51a1e8 LocalFree
• 0x51a1f0 GlobalLock
• 0x51a1f4 GlobalAlloc
• 0x51a1f8 MulDiv
• 0x51a1fc lstrcmpW
• 0x51a200 GlobalUnlock
• 0x51a208 RaiseException
• 0x51a20c SetLastError
• 0x51a210 GlobalFree
• 0x51a214 GlobalHandle
• 0x51a218 FreeLibrary
• 0x51a21c LoadLibraryExW
• 0x51a220 lstrcmpiW
• 0x51a224 GetModuleHandleA
• 0x51a228 GetFileType
• 0x51a230 LoadLibraryA
• 0x51a234 GetVersionExA
• 0x51a244 TlsAlloc
• 0x51a248 TlsGetValue
• 0x51a24c TlsSetValue
• 0x51a250 TlsFree
• 0x51a254 GetStartupInfoW
• 0x51a258 HeapSize
• 0x51a25c RtlUnwind
• 0x51a260 GetConsoleCP
• 0x51a264 SetFilePointerEx
• 0x51a268 GetStringTypeW
• 0x51a26c LoadLibraryW
• 0x51a278 ReadConsoleW
• 0x51a27c IsDebuggerPresent
• 0x51a284 HeapReAlloc
• 0x51a288 ExitThread
• 0x51a290 GetLocalTime
• 0x51a298 GetCPInfo
• 0x51a29c GetModuleHandleExW
• 0x51a2a0 WriteConsoleW
• 0x51a2a4 GetCommandLineW
• 0x51a2a8 ExitProcess
• 0x51a2ac AreFileApisANSI
• 0x51a2b4 GetConsoleMode
• 0x51a2b8 SetStdHandle
• 0x51a2bc GetLocaleInfoW
• 0x51a2c0 IsValidLocale
• 0x51a2c4 GetUserDefaultLCID
• 0x51a2c8 EnumSystemLocalesW
• 0x51a2cc CompareStringW
• 0x51a2d0 LCMapStringW
• 0x51a2d8 HeapDestroy
• 0x51a2e0 InitializeSListHead
• 0x51a2ec SizeofResource
• 0x51a2f0 DecodePointer
Library USER32.dll:
• 0x51a368 EndPaint
• 0x51a36c GetMessageW
• 0x51a378 MessageBoxA
• 0x51a37c CallNextHookEx
• 0x51a380 GetClientRect
• 0x51a388 SetFocus
• 0x51a38c GetMenuItemInfoW
• 0x51a390 BeginPaint
• 0x51a394 GetClassInfoExW
• 0x51a398 TranslateMessage
• 0x51a3a0 IsDialogMessageW
• 0x51a3a4 RegisterClassExW
• 0x51a3a8 GetWindowPlacement
• 0x51a3b0 CheckMenuRadioItem
• 0x51a3b4 GetWindowTextW
• 0x51a3b8 PeekMessageW
• 0x51a3bc GetClassNameW
• 0x51a3c0 ReleaseDC
• 0x51a3c4 GetDlgItem
• 0x51a3c8 SetWindowLongW
• 0x51a3cc EndDialog
• 0x51a3d0 RedrawWindow
• 0x51a3d4 SendDlgItemMessageW
• 0x51a3d8 GetSysColor
• 0x51a3dc IsWindow
• 0x51a3e0 SetMenuDefaultItem
• 0x51a3e4 SetWindowsHookExW
• 0x51a3e8 UnhookWindowsHookEx
• 0x51a3ec ReleaseCapture
• 0x51a3f0 ClientToScreen
• 0x51a3f4 GetParent
• 0x51a3f8 EnableWindow
• 0x51a3fc SetWindowTextW
• 0x51a400 SetMenuItemInfoW
• 0x51a404 CallWindowProcW
• 0x51a408 DestroyWindow
• 0x51a414 SetTimer
• 0x51a418 ScreenToClient
• 0x51a41c MapDialogRect
• 0x51a420 CharNextW
• 0x51a428 FillRect
• 0x51a42c IsChild
• 0x51a430 GetWindow
• 0x51a434 MoveWindow
• 0x51a438 DispatchMessageW
• 0x51a43c KillTimer
• 0x51a440 InvalidateRect
• 0x51a444 GetWindowLongW
• 0x51a448 GetDesktopWindow
• 0x51a44c GetLastInputInfo
• 0x51a454 GetSystemMetrics
• 0x51a458 SwitchToThisWindow
• 0x51a45c UpdateLayeredWindow
• 0x51a460 GetWindowRect
• 0x51a464 PostQuitMessage
• 0x51a468 UnregisterClassW
• 0x51a46c LoadCursorW
• 0x51a470 GetDC
• 0x51a474 LoadIconW
• 0x51a47c SetWindowPos
• 0x51a480 ShowWindow
• 0x51a484 FindWindowExW
• 0x51a488 CreateWindowExW
• 0x51a48c MessageBoxW
• 0x51a490 RegisterClassW
• 0x51a494 ValidateRect
• 0x51a498 DefWindowProcW
• 0x51a49c PostMessageW
• 0x51a4a0 EnumWindows
• 0x51a4a8 SetCapture
• 0x51a4ac GetFocus
• 0x51a4b0 SetDlgItemTextW
• 0x51a4b4 AnimateWindow
• 0x51a4b8 CharUpperW
• 0x51a4bc SendMessageW
• 0x51a4c0 InvalidateRgn
Library GDI32.dll:
• 0x51a074 BitBlt
• 0x51a078 DeleteDC
• 0x51a07c CreateDIBSection
• 0x51a080 CreateSolidBrush
• 0x51a084 SelectObject
• 0x51a08c GetStockObject
• 0x51a090 GetObjectW
• 0x51a094 GetDeviceCaps
• 0x51a098 CreateCompatibleDC
• 0x51a09c DeleteObject
Library ADVAPI32.dll:
• 0x51a000 OpenProcessToken
• 0x51a004 RegOpenKeyExW
• 0x51a008 RegCloseKey
• 0x51a014 GetTokenInformation
• 0x51a018 RegSetValueW
• 0x51a01c RegDeleteKeyW
• 0x51a020 LookupAccountSidW
• 0x51a024 RegEnumKeyExW
• 0x51a028 RegCreateKeyExW
• 0x51a02c RegDeleteValueW
• 0x51a030 RegSetValueExW
• 0x51a034 RegQueryInfoKeyW
• 0x51a03c ReportEventA
• 0x51a044 RegQueryValueExW
Library SHELL32.dll:
• 0x51a334 ExtractIconW
• 0x51a338 SHFileOperationW
• 0x51a33c ShellExecuteW
• 0x51a340 ShellExecuteExW
• 0x51a34c SHBrowseForFolderW
• 0x51a350 SHGetDesktopFolder
Library ole32.dll:
• 0x51a568 CoCreateInstance
• 0x51a56c CoCreateGuid
• 0x51a570 OleLockRunning
• 0x51a574 CLSIDFromProgID
• 0x51a578 CLSIDFromString
• 0x51a580 StringFromGUID2
• 0x51a584 OleInitialize
• 0x51a588 OleUninitialize
• 0x51a58c CoTaskMemFree
• 0x51a590 CoGetClassObject
• 0x51a594 CoTaskMemAlloc
• 0x51a598 CoUninitialize
• 0x51a59c CoTaskMemRealloc
• 0x51a5a0 CoInitialize
Library OLEAUT32.dll:
• 0x51a2f8 SysFreeString
• 0x51a2fc VariantClear
• 0x51a300 VariantCopy
• 0x51a304 SysStringLen
• 0x51a308 VariantInit
• 0x51a30c SysAllocStringLen
• 0x51a310 DispCallFunc
• 0x51a314 LoadTypeLib
• 0x51a31c LoadRegTypeLib
• 0x51a320 VarUI4FromStr
• 0x51a324 SysAllocString
Library SHLWAPI.dll:
• 0x51a358
• 0x51a35c UrlEscapeW
Library COMCTL32.dll:

Hosts

No hosts contacted.

DNS

Name Response Post-Analysis Lookup
cache.download2.casino.com CNAME cache.download2.casino.com.cdnga.net
A 14.0.41.202
A 14.0.41.244 		14.0.41.244
fallback.playtech-installer.com CNAME s3-website-eu-west-1.amazonaws.com
CNAME pt-installer.s3-website-eu-west-1.amazonaws.com
A 52.218.29.228 		52.218.41.124
ocsp.sectigo.com A 151.139.128.14 151.139.128.14
redirector.gvt1.com A 203.208.41.33 113.108.239.161
ocsp.comodoca.com A 151.139.128.14 151.139.128.14
dns.msftncsi.com A 131.107.255.255 131.107.255.255
t8u4n6u7.ssl.hwcdn.net A 205.185.208.154 205.185.208.154
c6m7w2m9.ssl.hwcdn.net A 205.185.208.154 205.185.208.154
time.windows.com A 20.189.79.72
CNAME time.microsoft.akadns.net
clients2.google.com A 172.217.160.110
CNAME clients.l.google.com
A 172.217.160.78 		142.250.66.110
ocsp.usertrust.com A 151.139.128.14 151.139.128.14
www.download.windowsupdate.com A 106.7.64.1
A 116.11.67.6
CNAME k256.gslb.ksyuncdn.com
A 124.229.60.6
A 222.216.123.6
CNAME 2-01-3cf7-0009.cdx.cedexis.net
A 36.25.252.1
A 115.231.33.1
A 119.96.211.1
CNAME www.download.windowsupdate.com.download.ks-cdn.com
A 124.229.53.1
CNAME wu-fg-shim.trafficmanager.net 		205.185.216.42
r1---sn-j5o7dn7e.gvt1.com A 113.108.239.194
CNAME r1.sn-j5o7dn7e.gvt1.com 		113.108.239.194
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255
geo.web-installer-assets.com
update.googleapis.com A 203.208.40.98 113.108.239.162
r3---sn-j5o7dn7e.gvt1.com CNAME r3.sn-j5o7dn7e.gvt1.com
A 113.108.239.196 		113.108.239.196
teredo.ipv6.microsoft.com

TCP

Source Source Port Destination Destination Port
192.168.56.101 49182 106.7.64.1 www.download.windowsupdate.com 80
192.168.56.101 49212 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49213 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49181 116.11.67.6 www.download.windowsupdate.com 80
192.168.56.101 49194 14.0.41.202 cache.download2.casino.com 80
192.168.56.101 49183 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49184 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49185 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49190 151.139.128.14 ocsp.usertrust.com 80
192.168.56.101 49208 203.208.40.98 update.googleapis.com 443
192.168.56.101 49210 203.208.41.33 redirector.gvt1.com 80
192.168.56.101 49176 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49177 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49187 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49192 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49193 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49195 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49196 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49198 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49199 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 50047 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 50849 114.114.114.114 53
192.168.56.101 51137 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 52124 114.114.114.114 53
192.168.56.101 52812 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 58333 114.114.114.114 53
192.168.56.101 59251 114.114.114.114 53
192.168.56.101 59291 114.114.114.114 53
192.168.56.101 59990 114.114.114.114 53
192.168.56.101 60966 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 64874 114.114.114.114 53

HTTP & HTTPS Requests

URI Data
http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom/casino[zh-cn].cab 
GET /playtech_cabs/casino_casinocom/casino[zh-cn].cab HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\815B7C0CBF8446429A10798694A7CC60\pack (2).cab
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache
http://cache.download2.casino.com/download/casino/client_update_urls.php 
GET /download/casino/client_update_urls.php HTTP/1.1
Accept: */*
User-Agent: Playtech WinClient Downloader/1.0
Host: cache.download2.casino.com
Connection: Keep-Alive
Cache-Control: no-cache
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a939bee6462d9526&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620735143&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=a939bee6462d9526&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620735143&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/index.7ze 
GET /playtech_compressed_assets/casino_casinocom/index.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\815B7C0CBF8446429A10798694A7CC60\index.7ze
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze 
GET /playtech_compressed_assets/casino_casinocom/templates/installer/casinocom_new_notif.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\815B7C0CBF8446429A10798694A7CC60\casinocom_new_notif (1).7z
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D 
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sectigo.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab 
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.