4.0
中危
56 个模型检测该样本为恶意！
重新分析
更多

db15102451ec2b0a01289422a0702725cf911b7c9e44308e010bed37f2acec39

908a9d6a509d987aa6a5fa7e7a139e39.exe

分析耗时

75s

最近分析

文件大小

326.6KB
静态报毒 动态报毒 100% A + MAL AI SCORE=81 AIDETECTVM BSCOPE CONFIDENCE EHLS ELKD ENCPK FGIT GENCIRC GENERICRXKR GENETIC GENKRYPTIK GOZI GRAYWARE HIGH CONFIDENCE KRYPTIK MALICIOUS PE MALWARE1 MALWARE@#539WHZBF9CD0 QAKBOT QVM20 R337622 RAZY REGOTET SCORE SMTHA SQABPK54RZP STATIC AI TROJANBANKER UNSAFE UQ2@A8CP36NI URSNIF YKCXT ZEXAF ZL5CIBWF9TO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee GenericRXKR-BC!908A9D6A509D 20201211 6.0.6.653
Alibaba TrojanSpy:Win32/Ursnif.d551f127 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20201211 2017.9.26.565
Tencent Malware.Win32.Gencirc.10cdcb98 20201211 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619686143.034081
GetComputerNameW
computer_name:
failed 0 0
1619686143.034081
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name IBC
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:1304577963&cup2hreq=150e3b5625059166d0a8f6d9793b3e5b2ae7d8c72d8ed78c6c5b3b0729d32cf7
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2
Performs some HTTP requests (6 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:1304577963&cup2hreq=150e3b5625059166d0a8f6d9793b3e5b2ae7d8c72d8ed78c6c5b3b0729d32cf7
request POST https://update.googleapis.com/service/update2
Sends data using the HTTP POST Method (2 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:1304577963&cup2hreq=150e3b5625059166d0a8f6d9793b3e5b2ae7d8c72d8ed78c6c5b3b0729d32cf7
request POST https://update.googleapis.com/service/update2
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619686132.644081
NtAllocateVirtualMemory
process_identifier: 732
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003d0000
success 0 0
1619686142.800081
NtAllocateVirtualMemory
process_identifier: 732
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00470000
success 0 0
1619686142.800081
NtProtectVirtualMemory
process_identifier: 732
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
DrWeb Trojan.Gozi.683
MicroWorld-eScan Gen:Variant.Razy.671241
FireEye Generic.mg.908a9d6a509d987a
McAfee GenericRXKR-BC!908A9D6A509D
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005673821 )
Alibaba TrojanSpy:Win32/Ursnif.d551f127
K7GW Trojan ( 005673821 )
Cybereason malicious.a509d9
Arcabit Trojan.Razy.DA3E09
BitDefenderTheta Gen:NN.ZexaF.34670.uq2@a8cP36ni
Cyren W32/Trojan.FGIT-7475
Symantec Trojan.Ursnif
ESET-NOD32 Win32/Spy.Ursnif.CZ
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Regotet-7869380-0
Kaspersky HEUR:Trojan-Banker.Win32.Gozi.pef
BitDefender Gen:Variant.Razy.671241
AegisLab Trojan.Win32.Malicious.4!c
Rising Trojan.Kryptik!8.8 (TFE:3:sqabpk54rzP)
Ad-Aware Gen:Variant.Razy.671241
Sophos ML/PE-A + Mal/EncPk-APV
Comodo Malware@#539whzbf9cd0
F-Secure Trojan.TR/Spy.Ursnif.ykcxt
TrendMicro TrojanSpy.Win32.QAKBOT.SMTHA.hp
McAfee-GW-Edition GenericRXKR-BC!908A9D6A509D
Emsisoft Trojan-Spy.Ursnif (A)
Ikarus Trojan-Spy.Agent
Jiangmin Trojan.Banker.Gozi.ant
Avira TR/Spy.Ursnif.ykcxt
MAX malware (ai score=81)
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Gridinsoft Trojan.Win32.Kryptik.dd!s1
Microsoft Trojan:Win32/Ursnif.MK!MSR
ZoneAlarm HEUR:Trojan-Banker.Win32.Gozi.pef
GData Gen:Variant.Razy.671241
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Ursnif.R337622
VBA32 BScope.TrojanBanker.Gozi
ALYac Gen:Variant.Razy.671241
Malwarebytes Trojan.Injector
TrendMicro-HouseCall TrojanSpy.Win32.QAKBOT.SMTHA.hp
Tencent Malware.Win32.Gencirc.10cdcb98
Yandex TrojanSpy.Ursnif!ZL5CibWF9To
SentinelOne Static AI - Malicious PE
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-21 01:22:27

Imports

Library KERNEL32.dll:
• 0x44d320 GetModuleHandleA
• 0x44d324 VirtualAllocEx
• 0x44d328 LoadLibraryA
• 0x44d32c GetProcAddress
Library USER32.dll:
• 0x44d334 LoadIconA
• 0x44d338 IsWindowUnicode
• 0x44d33c GetDesktopWindow
• 0x44d340 GetMenu
• 0x44d348 DestroyWindow
• 0x44d34c GetKBCodePage
• 0x44d350 GetActiveWindow
• 0x44d354 CharNextA
• 0x44d358 EndMenu
• 0x44d35c DestroyCursor
• 0x44d360 CharNextW
• 0x44d364 IsCharLowerW
• 0x44d368 IsCharAlphaNumericW
• 0x44d36c IsMenu
• 0x44d370 GetDlgCtrlID
• 0x44d374 GetListBoxInfo
• 0x44d378 GetDoubleClickTime
• 0x44d380 GetCursor
• 0x44d388 GetKeyboardLayout
• 0x44d38c IsWindowEnabled
• 0x44d390 IsWindow
• 0x44d394 GetTopWindow
• 0x44d398 InSendMessage
• 0x44d3a4 CloseWindowStation
• 0x44d3a8 CharUpperW
• 0x44d3ac GetInputState
Library GDI32.dll:
• 0x44d3b4 EndPage
• 0x44d3b8 GetObjectType
• 0x44d3bc WidenPath
• 0x44d3c0 UnrealizeObject
• 0x44d3c8 EndDoc
• 0x44d3cc GetColorSpace
• 0x44d3d0 CancelDC
• 0x44d3d4 EndPath
• 0x44d3d8 SwapBuffers
• 0x44d3dc FillPath
• 0x44d3e0 CreateMetaFileA
• 0x44d3e4 CloseMetaFile
• 0x44d3e8 PathToRegion
• 0x44d3ec AddFontResourceW
Library COMDLG32.dll:
• 0x44d3f4 GetFileTitleA
Library ADVAPI32.dll:
• 0x44d3fc RegOpenKeyA
• 0x44d400 RegQueryValueExA
• 0x44d404 GetUserNameA
• 0x44d408 RegSetValueW
• 0x44d40c RegQueryValueExW
• 0x44d410 RegOpenKeyW
• 0x44d414 RegDeleteKeyW
• 0x44d418 RegCloseKey
Library ole32.dll:
• 0x44d420 OleUninitialize
• 0x44d424 OleInitialize
• 0x44d428 CoTaskMemFree
• 0x44d42c StringFromCLSID
Library MSVCRT.dll:
• 0x44d434 __p__commode
• 0x44d438 __p__fmode
• 0x44d43c __set_app_type
• 0x44d440 _controlfp
• 0x44d444 _adjust_fdiv
• 0x44d448 __setusermatherr
• 0x44d44c _initterm
• 0x44d450 __getmainargs
• 0x44d454 __initenv
• 0x44d458 exit
• 0x44d45c _cexit
• 0x44d460 _XcptFilter
• 0x44d464 _exit
• 0x44d468 _c_exit
• 0x44d46c _wcsnicmp
• 0x44d470 printf
• 0x44d474 _except_handler3
• 0x44d478 wcscpy
• 0x44d47c wcscat
• 0x44d480 fgetws
• 0x44d484 towupper
• 0x44d488 _iob
• 0x44d48c _putws
• 0x44d490 wcscmp
• 0x44d494 swprintf
• 0x44d498 malloc
• 0x44d49c free
• 0x44d4a0 _wcsicmp
• 0x44d4a4 wcschr
• 0x44d4a8 wcslen
• 0x44d4ac _get_osfhandle

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49180 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49181 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49178 203.208.40.98 update.googleapis.com 443
192.168.56.101 49188 203.208.40.98 update.googleapis.com 443
192.168.56.101 49179 203.208.41.33 redirector.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=299460-445870
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=64294-108200
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=108201-194204
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-7636
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=30146-40820
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=40821-64293
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=7637-18876
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=9fb1ad396be3f434&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619664496&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=1117226-1310831
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.