14.0
0-day
54 个模型检测该样本为恶意！
重新分析
更多

55a76065d21c38903975a13389ccaf0d6785db41981cd9a96312f9c703013f2c

886e36a777b5565c6d36a639ef311b25.exe

分析耗时

141s

最近分析

文件大小

575.5KB
静态报毒 动态报毒 AGENSLA AI SCORE=83 ATTRIBUTE AVEMARIA CONFIDENCE EQCG FAREIT GENERICKD GENKRYPTIK HEAPOVERRIDE HIGH CONFIDENCE HIGHCONFIDENCE HRPUSP JM0@AINXV1K JSAMQEBMFHA KJYHM KRYPTIK MALICIOUS PE MALWARE@#U0KS2MGYSXKX MALWAREX PACKEDNET R002C0PHC20 SCORE TROJANPSW TROJANPWS UNSAFE YMACCO ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FXH!886E36A777B5 20200924 6.0.6.653
Alibaba TrojanPSW:MSIL/Kryptik.8ebf92cb 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_80% (W) 20190702 1.0
Avast Win32:MalwareX-gen [Trj] 20200925 18.4.3895.0
Tencent 20200925 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200925 2013.8.14.323
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619716503.770625
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (14 个事件)
Time & API Arguments Status Return Repeated
1619716454.770375
IsDebuggerPresent
failed 0 0
1619716454.770375
IsDebuggerPresent
failed 0 0
1619716502.864375
IsDebuggerPresent
failed 0 0
1619716503.364375
IsDebuggerPresent
failed 0 0
1619716503.911375
IsDebuggerPresent
failed 0 0
1619716504.364375
IsDebuggerPresent
failed 0 0
1619716504.911375
IsDebuggerPresent
failed 0 0
1619716505.364375
IsDebuggerPresent
failed 0 0
1619716505.911375
IsDebuggerPresent
failed 0 0
1619716506.364375
IsDebuggerPresent
failed 0 0
1619716506.911375
IsDebuggerPresent
failed 0 0
1619716507.364375
IsDebuggerPresent
failed 0 0
1619716507.911375
IsDebuggerPresent
failed 0 0
1619716508.364375
IsDebuggerPresent
failed 0 0
Command line console output was observed (1 个事件)
Time & API Arguments Status Return Repeated
1619716507.442625
WriteConsoleW
buffer: 成功: 成功创建计划任务 "Updates\kbDQfFVbznNO"。
console_handle: 0x00000007
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619716454.786375
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619716510.5525
__exception__
stacktrace: 
886e36a777b5565c6d36a639ef311b25+0x3556 @ 0x403556
886e36a777b5565c6d36a639ef311b25+0x111a0 @ 0x4111a0
886e36a777b5565c6d36a639ef311b25+0x13321 @ 0x413321
886e36a777b5565c6d36a639ef311b25+0x5abc @ 0x405abc
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 3864040
registers.edi: 3864180
registers.eax: 3864064
registers.ebp: 3864080
registers.edx: 43843584
registers.ebx: 3864320
registers.esi: 3864336
registers.ecx: 0
exception.instruction_r: 0f b7 01 66 89 02 41 41 42 42 66 85 c0 75 f1 c7
exception.symbol: lstrcpyW+0x16 IsBadStringPtrA-0x5b kernel32+0x33118
exception.instruction: movzx eax, word ptr [ecx]
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 209176
exception.address: 0x76373118
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:949407164&cup2hreq=1fbfac382546744ae2f8c6bf9198dfd10c69d49bc15f14bf0299607e15999764
Performs some HTTP requests (4 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619687295&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f9000d98b673ba9c&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619687295&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:949407164&cup2hreq=1fbfac382546744ae2f8c6bf9198dfd10c69d49bc15f14bf0299607e15999764
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:949407164&cup2hreq=1fbfac382546744ae2f8c6bf9198dfd10c69d49bc15f14bf0299607e15999764
Allocates read-write-execute memory (usually to unpack itself) (50 out of 95 个事件)
Time & API Arguments Status Return Repeated
1619716450.083375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00760000
success 0 0
1619716450.083375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00840000
success 0 0
1619716454.599375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x021e0000
success 0 0
1619716454.599375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02350000
success 0 0
1619716454.661375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b91000
success 0 0
1619716454.770375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00480000
success 0 0
1619716454.770375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00480000
success 0 0
1619716454.770375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0032a000
success 0 0
1619716454.770375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73b92000
success 0 0
1619716454.770375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00322000
success 0 0
1619716455.036375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00332000
success 0 0
1619716455.114375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00355000
success 0 0
1619716455.130375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0035b000
success 0 0
1619716455.130375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00357000
success 0 0
1619716455.270375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00333000
success 0 0
1619716455.286375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0033c000
success 0 0
1619716455.349375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00730000
success 0 0
1619716455.974375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00334000
success 0 0
1619716455.974375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00336000
success 0 0
1619716456.099375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00337000
success 0 0
1619716456.270375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0034a000
success 0 0
1619716456.270375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00347000
success 0 0
1619716456.442375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00731000
success 0 0
1619716456.770375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00346000
success 0 0
1619716456.770375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0033a000
success 0 0
1619716456.849375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00734000
success 0 0
1619716456.927375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00735000
success 0 0
1619716457.849375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00338000
success 0 0
1619716498.895375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00736000
success 0 0
1619716498.942375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02351000
success 0 0
1619716499.083375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00737000
success 0 0
1619716499.192375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0032c000
success 0 0
1619716499.192375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00738000
success 0 0
1619716499.255375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00739000
success 0 0
1619716499.270375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00339000
success 0 0
1619716499.286375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0073a000
success 0 0
1619716499.427375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 164864
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x05120400
failed 3221225550 0
1619716501.192375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0073b000
success 0 0
1619716501.192375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x023e0000
success 0 0
1619716501.192375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0073c000
success 0 0
1619716501.224375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0073d000
success 0 0
1619716501.302375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0073e000
success 0 0
1619716501.317375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0073f000
success 0 0
1619716501.395375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x023e1000
success 0 0
1619716501.536375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00650000
success 0 0
1619716501.583375
NtAllocateVirtualMemory
process_identifier: 1396
region_size: 12288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00651000
success 0 0
1619716501.583375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x05120178
failed 3221225550 0
1619716501.614375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x051201a0
failed 3221225550 0
1619716501.614375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x051201c8
failed 3221225550 0
1619716501.614375
NtProtectVirtualMemory
process_identifier: 1396
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x051201f0
failed 3221225550 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates a suspicious process (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kbDQfFVbznNO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp"
cmdline schtasks.exe /Create /TN "Updates\kbDQfFVbznNO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp"
A process created a hidden window (1 个事件)
Time & API Arguments Status Return Repeated
1619716503.489375
ShellExecuteExW
parameters: /Create /TN "Updates\kbDQfFVbznNO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp"
filepath: schtasks.exe
filepath_r: schtasks.exe
show_type: 0
success 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.745377800539693 section {'size_of_data': '0x00054e00', 'virtual_address': '0x00002000', 'entropy': 7.745377800539693, 'name': '.text', 'virtual_size': '0x00054d44'} description A section with a high entropy has been found
entropy 0.5904347826086956 description Overall entropy of this PE file is high
Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)
Time & API Arguments Status Return Repeated
1619716499.427375
LookupPrivilegeValueW
system_name:
privilege_name: SeDebugPrivilege
success 1 0
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kbDQfFVbznNO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp"
cmdline schtasks.exe /Create /TN "Updates\kbDQfFVbznNO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp"
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 185.140.53.45
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619716508.552375
NtAllocateVirtualMemory
process_identifier: 3108
region_size: 1392640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000c710
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
Deletes executed files from disk (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp
Potential code injection by writing to the memory of another process (4 个事件)
Time & API Arguments Status Return Repeated
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $3š $wûcwwûcwwûcw´ô<wvûcw~ƒçwvûcw´ô>wuûcwP=wvûcwP= wtûcwr÷lwvûcw~ƒàwsûcw~ƒðwhûcwwûbwûcwä’jvûcw䒜wvûcwä’avvûcwRichwûcwPELUžï^à ,Ú=Z@@@@…wðp, ˆ u@p.textƒ+, `.rdataÎI@J0@@.dataØPz@À.rsrcp,ð.€@@.relocˆ ®@B.bss0¾@@
process_handle: 0x0000c710
base_address: 0x00400000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: Í@ï@þ@ @@+@:@\@k@€@™TÍ<¨‡K¢`ˆˆÝ;UBÄôKŠ› A³€ÝJpMÛ(P‘AP‘AU‹ì‹U‹E‹È…Òt ÆAƒêu÷]ÃU‹ìd¡0ƒì‹@ SVW‹x 駋G03ö‹_,‹?‰Eø‹B<‰}ô‹Dx‰Eð…À„…Áë3ɅÛt-‹}ø¾ÁÎ €<a‰Uø| ‹ÂƒÀàðëuøA;ËrߋUü‹}ô‹Eð‹L3ۋD ‰Mì…Ét<‹3ÿʃÀ‰Mø‹Ñ‰EèŠ ÁÏ ¾ÁøB„Éuñ‹Uü‰}ø‹Eø‹}ôÆ;Et ‹EèC;]ìrċW‰Uü…Ò…Kÿÿÿ3À_^[É‹uð‹D$X· ‹Dˆ‹ÂëÝU‹ìì¼‹ESVW‹XhLw&‰M ‰]¸èèþÿÿ‹ðÇEÄkern3ÀÇEÈel32ˆEЈEލEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿ֍EàPÿ֍EÔPÿÖhX¤SåèyþÿÿhyÌ?†‰EèlþÿÿhEƒV‰Eôè_þÿÿhDð5à‰EÀèRþÿÿhP‰E¤èEþÿÿhƖ‡R‰Eœè8þÿÿh_xTî‰Eðè+þÿÿhÚöÚO‰E˜èþÿÿ‹øhÆp‰}´èþÿÿh­ž_»‹ðèþÿÿh-W®[‰E¼èöýÿÿ‰E¬3ÀPh€jPPh€S‰E¨ÿ×j‰EìPÿ֋]‹ø‰}°jh0WjÿӋð…ötîjE¨PW‹}ìVWÿU¼WÿUð€>M‹]¸t jEøPPjÿUÀÆE hà.ÿU¤3À}ˆ«jDj«««…DÿÿÿPèTýÿÿƒÄ ÿu jhÿÿÿUœ‰E¼…ÀuOEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…À…¯PPjPPh@S‰E¸ÿU´‹øjƒÿÿtE¸ë^EüPPjÿUÀ鄃eìMìQPÿU˜}ìtoEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…ÀuOPPjPPh@S‰EÿU´‹øjƒÿÿt*EPÿu°VWÿU¬WÿUðEˆP…DÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆE ÿu¼ÿUð€} „åþÿÿ_^[ÉÃ,mAd
process_handle: 0x0000c710
base_address: 0x00419000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: 2ÏðM°•«¨è 6˜ëp^]{'Àæœ}MÃxqœÎqE}TzʶÏbVøÞ&‡ƒmîâð‹in8àúRVû…ë UÞR‹,}\ í™ð׈YòHÍ£p‚"§"É9Åe%Y©5"/WȋáÔ´]ŒãbãÌ4­iG«#´ :e
process_handle: 0x0000c710
base_address: 0x00553000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: @
process_handle: 0x0000c710
base_address: 0x7efde008
success 1 0
Code injection by writing an executable or DLL to the memory of another process (1 个事件)
Time & API Arguments Status Return Repeated
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $3š $wûcwwûcwwûcw´ô<wvûcw~ƒçwvûcw´ô>wuûcwP=wvûcwP= wtûcwr÷lwvûcw~ƒàwsûcw~ƒðwhûcwwûbwûcwä’jvûcw䒜wvûcwä’avvûcwRichwûcwPELUžï^à ,Ú=Z@@@@…wðp, ˆ u@p.textƒ+, `.rdataÎI@J0@@.dataØPz@À.rsrcp,ð.€@@.relocˆ ®@B.bss0¾@@
process_handle: 0x0000c710
base_address: 0x00400000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 1396 called NtSetContextThread to modify thread in remote process 3108
Time & API Arguments Status Return Repeated
1619716508.552375
NtSetContextThread
thread_handle: 0x0000f4b0
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4217405
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3108
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\:Zone.Identifier
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 1396 resumed a thread in remote process 3108
Time & API Arguments Status Return Repeated
1619716508.599375
NtResumeThread
thread_handle: 0x0000f4b0
suspend_count: 1
process_identifier: 3108
success 0 0
Executed a process and injected code into it, probably while unpacking (23 个事件)
Time & API Arguments Status Return Repeated
1619716454.770375
NtResumeThread
thread_handle: 0x000000d8
suspend_count: 1
process_identifier: 1396
success 0 0
1619716454.786375
NtResumeThread
thread_handle: 0x00000128
suspend_count: 1
process_identifier: 1396
success 0 0
1619716454.802375
NtResumeThread
thread_handle: 0x0000016c
suspend_count: 1
process_identifier: 1396
success 0 0
1619716502.833375
NtResumeThread
thread_handle: 0x00002550
suspend_count: 1
process_identifier: 1396
success 0 0
1619716502.833375
NtResumeThread
thread_handle: 0x0000187c
suspend_count: 1
process_identifier: 1396
success 0 0
1619716503.489375
CreateProcessInternalW
thread_identifier: 1304
thread_handle: 0x00010aa0
process_identifier: 2484
current_directory: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kbDQfFVbznNO" /XML "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\tmp5FAA.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
process_handle: 0x000106c8
inherit_handles: 0
success 1 0
1619716508.536375
CreateProcessInternalW
thread_identifier: 3112
thread_handle: 0x0000f4b0
process_identifier: 3108
current_directory:
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\886e36a777b5565c6d36a639ef311b25.exe
track: 1
command_line: "{path}"
filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\886e36a777b5565c6d36a639ef311b25.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x0000c710
inherit_handles: 0
success 1 0
1619716508.552375
NtGetContextThread
thread_handle: 0x0000f4b0
success 0 0
1619716508.552375
NtAllocateVirtualMemory
process_identifier: 3108
region_size: 1392640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x0000c710
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00400000
success 0 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $3š $wûcwwûcwwûcw´ô<wvûcw~ƒçwvûcw´ô>wuûcwP=wvûcwP= wtûcwr÷lwvûcw~ƒàwsûcw~ƒðwhûcwwûbwûcwä’jvûcw䒜wvûcwä’avvûcwRichwûcwPELUžï^à ,Ú=Z@@@@…wðp, ˆ u@p.textƒ+, `.rdataÎI@J0@@.dataØPz@À.rsrcp,ð.€@@.relocˆ ®@B.bss0¾@@
process_handle: 0x0000c710
base_address: 0x00400000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer:
process_handle: 0x0000c710
base_address: 0x00401000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer:
process_handle: 0x0000c710
base_address: 0x00414000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: Í@ï@þ@ @@+@:@\@k@€@™TÍ<¨‡K¢`ˆˆÝ;UBÄôKŠ› A³€ÝJpMÛ(P‘AP‘AU‹ì‹U‹E‹È…Òt ÆAƒêu÷]ÃU‹ìd¡0ƒì‹@ SVW‹x 駋G03ö‹_,‹?‰Eø‹B<‰}ô‹Dx‰Eð…À„…Áë3ɅÛt-‹}ø¾ÁÎ €<a‰Uø| ‹ÂƒÀàðëuøA;ËrߋUü‹}ô‹Eð‹L3ۋD ‰Mì…Ét<‹3ÿʃÀ‰Mø‹Ñ‰EèŠ ÁÏ ¾ÁøB„Éuñ‹Uü‰}ø‹Eø‹}ôÆ;Et ‹EèC;]ìrċW‰Uü…Ò…Kÿÿÿ3À_^[É‹uð‹D$X· ‹Dˆ‹ÂëÝU‹ìì¼‹ESVW‹XhLw&‰M ‰]¸èèþÿÿ‹ðÇEÄkern3ÀÇEÈel32ˆEЈEލEÄPÇEÌ.dllÇEàntdlÇEäl.dlfÇEèlÇEÔuserÇEØ32.dfÇEÜllfÇEø1fÇEü2ÿ֍EàPÿ֍EÔPÿÖhX¤SåèyþÿÿhyÌ?†‰EèlþÿÿhEƒV‰Eôè_þÿÿhDð5à‰EÀèRþÿÿhP‰E¤èEþÿÿhƖ‡R‰Eœè8þÿÿh_xTî‰Eðè+þÿÿhÚöÚO‰E˜èþÿÿ‹øhÆp‰}´èþÿÿh­ž_»‹ðèþÿÿh-W®[‰E¼èöýÿÿ‰E¬3ÀPh€jPPh€S‰E¨ÿ×j‰EìPÿ֋]‹ø‰}°jh0WjÿӋð…ötîjE¨PW‹}ìVWÿU¼WÿUð€>M‹]¸t jEøPPjÿUÀÆE hà.ÿU¤3À}ˆ«jDj«««…DÿÿÿPèTýÿÿƒÄ ÿu jhÿÿÿUœ‰E¼…ÀuOEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…À…¯PPjPPh@S‰E¸ÿU´‹øjƒÿÿtE¸ë^EüPPjÿUÀ鄃eìMìQPÿU˜}ìtoEˆP…DÿÿÿP3ÀPPPPPPPSÿUô…ÀuOPPjPPh@S‰EÿU´‹øjƒÿÿt*EPÿu°VWÿU¬WÿUðEˆP…DÿÿÿP3ÀPPPPPPPSÿUôë EüPPjÿUÀÆE ÿu¼ÿUð€} „åþÿÿ_^[ÉÃ,mAd
process_handle: 0x0000c710
base_address: 0x00419000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer:
process_handle: 0x0000c710
base_address: 0x0054f000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer:
process_handle: 0x0000c710
base_address: 0x00552000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: 2ÏðM°•«¨è 6˜ëp^]{'Àæœ}MÃxqœÎqE}TzʶÏbVøÞ&‡ƒmîâð‹in8àúRVû…ë UÞR‹,}\ í™ð׈YòHÍ£p‚"§"É9Åe%Y©5"/WȋáÔ´]ŒãbãÌ4­iG«#´ :e
process_handle: 0x0000c710
base_address: 0x00553000
success 1 0
1619716508.552375
WriteProcessMemory
process_identifier: 3108
buffer: @
process_handle: 0x0000c710
base_address: 0x7efde008
success 1 0
1619716508.552375
NtSetContextThread
thread_handle: 0x0000f4b0
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4217405
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 3108
success 0 0
1619716508.599375
NtResumeThread
thread_handle: 0x0000f4b0
suspend_count: 1
process_identifier: 3108
success 0 0
1619716508.599375
NtResumeThread
thread_handle: 0x00010ee0
suspend_count: 1
process_identifier: 1396
success 0 0
1619716508.661375
NtGetContextThread
thread_handle: 0x00010ee0
success 0 0
1619716508.661375
NtGetContextThread
thread_handle: 0x00010ee0
success 0 0
1619716508.661375
NtResumeThread
thread_handle: 0x00010ee0
suspend_count: 1
process_identifier: 1396
success 0 0
File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 个事件)
Elastic malicious (high confidence)
DrWeb Trojan.PackedNET.405
MicroWorld-eScan Trojan.GenericKD.43644740
FireEye Generic.mg.886e36a777b5565c
CAT-QuickHeal Trojanpws.Msil
McAfee Fareit-FXH!886E36A777B5
Cylance Unsafe
Zillya Trojan.Kryptik.Win32.2363276
Sangfor Malware
K7AntiVirus Trojan ( 0056c4e21 )
Alibaba TrojanPSW:MSIL/Kryptik.8ebf92cb
K7GW Trojan ( 0056c4e21 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Trojan.Generic.D299F744
TrendMicro TROJ_GEN.R002C0PHC20
BitDefenderTheta Gen:NN.ZemsilF.34254.Jm0@aiNXv1k
Symantec ML.Attribute.HighConfidence
TrendMicro-HouseCall TROJ_GEN.R002C0PHC20
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender Trojan.GenericKD.43644740
NANO-Antivirus Trojan.Win32.Agensla.hrpusp
ViRobot Trojan.Win32.Z.Agent.589312.Y
Avast Win32:MalwareX-gen [Trj]
Ad-Aware Trojan.GenericKD.43644740
Emsisoft Trojan.GenericKD.43644740 (B)
Comodo Malware@#u0ks2mgysxkx
F-Secure Trojan.TR/Kryptik.kjyhm
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-S
McAfee-GW-Edition Fareit-FXH!886E36A777B5
Sophos Mal/Generic-S
Ikarus Trojan.MSIL.Crypt
eGambit Unsafe.AI_Score_99%
Avira TR/Kryptik.kjyhm
Antiy-AVL Trojan[PSW]/MSIL.Agensla
Microsoft Trojan:Win32/Ymacco.AA55
AegisLab Trojan.MSIL.Agensla.i!c
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Trojan.GenericKD.43644740
Cynet Malicious (score: 85)
ALYac Trojan.PSW.AveMaria
MAX malware (ai score=83)
VBA32 CIL.HeapOverride.Heur
Malwarebytes Trojan.Dropper.MSIL
APEX Malicious
ESET-NOD32 a variant of MSIL/Kryptik.XIA
Yandex Trojan.Kryptik!jsAMQebmfHA
SentinelOne DFI - Malicious PE
Fortinet MSIL/GenKryptik.EQCG!tr
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 个事件)
dead_host 192.168.56.101:49213
dead_host 192.168.56.101:49190
dead_host 192.168.56.101:49192
dead_host 172.217.24.14:443
dead_host 192.168.56.101:49199
dead_host 185.140.53.45:5200
dead_host 192.168.56.101:49210
dead_host 192.168.56.101:49206
dead_host 172.217.160.78:443
dead_host 192.168.56.101:49204
dead_host 192.168.56.101:49195
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-11 22:20:21

Imports

Library mscoree.dll:
• 0x402000 _CorExeMain

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49208 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49209 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49207 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49205 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f9000d98b673ba9c&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619687295&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=f9000d98b673ba9c&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619687295&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619687295&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619687295&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.