6.4
高危
4 个模型检测该样本为恶意！
重新分析
更多

8f8e0fc08ab8fd012827898a4eed0784893fa1a23a312d0cf72aef702f6f69b4

91cbb453404e741a430a572bff192dd9.exe

分析耗时

101s

最近分析

文件大小

9.4MB
静态报毒 动态报毒 CONFIDENCE FCZG QVM11
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Baidu 20190318 1.0.0.2
Avast 20191119 18.4.3895.0
Tencent 20191119 1.0.0.1
Kingsoft 20191119 2013.8.14.323
McAfee 20191119 6.0.6.653
静态指标
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1620816978.227125
IsDebuggerPresent
failed 0 0
1620816978.274125
IsDebuggerPresent
failed 0 0
The executable uses a known packer (1 个事件)
packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
One or more processes crashed (6 个事件)
Time & API Arguments Status Return Repeated
1620816978.274125
__exception__
stacktrace: 
91cbb453404e741a430a572bff192dd9+0x79fd8 @ 0x479fd8
91cbb453404e741a430a572bff192dd9+0x7a1e3 @ 0x47a1e3
91cbb453404e741a430a572bff192dd9+0x8f801 @ 0x48f801
91cbb453404e741a430a572bff192dd9+0x780bf @ 0x4780bf
91cbb453404e741a430a572bff192dd9+0x789cc @ 0x4789cc
91cbb453404e741a430a572bff192dd9+0xa6fe1 @ 0x4a6fe1
91cbb453404e741a430a572bff192dd9+0x3ba3e @ 0x43ba3e
91cbb453404e741a430a572bff192dd9+0x73af1 @ 0x473af1
91cbb453404e741a430a572bff192dd9+0x73747 @ 0x473747
91cbb453404e741a430a572bff192dd9+0x76144 @ 0x476144
91cbb453404e741a430a572bff192dd9+0xd4cc3 @ 0x4d4cc3
91cbb453404e741a430a572bff192dd9+0xd4691 @ 0x4d4691
91cbb453404e741a430a572bff192dd9+0xd8450 @ 0x4d8450
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636764
registers.edi: 4694776
registers.eax: 1636764
registers.ebp: 1636844
registers.edx: 0
registers.ebx: 3
registers.esi: 63866752
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1620816978.274125
__exception__
stacktrace: 
91cbb453404e741a430a572bff192dd9+0x8f290 @ 0x48f290
91cbb453404e741a430a572bff192dd9+0x780bf @ 0x4780bf
91cbb453404e741a430a572bff192dd9+0x789cc @ 0x4789cc
91cbb453404e741a430a572bff192dd9+0xa6fe1 @ 0x4a6fe1
91cbb453404e741a430a572bff192dd9+0x3ba3e @ 0x43ba3e
91cbb453404e741a430a572bff192dd9+0x73af1 @ 0x473af1
91cbb453404e741a430a572bff192dd9+0x73747 @ 0x473747
91cbb453404e741a430a572bff192dd9+0x76144 @ 0x476144
91cbb453404e741a430a572bff192dd9+0xd4cc3 @ 0x4d4cc3
91cbb453404e741a430a572bff192dd9+0xd4691 @ 0x4d4691
91cbb453404e741a430a572bff192dd9+0xd8450 @ 0x4d8450
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634820
registers.edi: 1637500
registers.eax: 1634820
registers.ebp: 1634900
registers.edx: 0
registers.ebx: 4782282
registers.esi: 0
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1620816978.367125
__exception__
stacktrace: 
91cbb453404e741a430a572bff192dd9+0x79fd8 @ 0x479fd8
91cbb453404e741a430a572bff192dd9+0x7a1e3 @ 0x47a1e3
91cbb453404e741a430a572bff192dd9+0x8f801 @ 0x48f801
91cbb453404e741a430a572bff192dd9+0x780bf @ 0x4780bf
91cbb453404e741a430a572bff192dd9+0x789cc @ 0x4789cc
91cbb453404e741a430a572bff192dd9+0x1b22d @ 0x41b22d
91cbb453404e741a430a572bff192dd9+0x1b465 @ 0x41b465
91cbb453404e741a430a572bff192dd9+0x1c5a5 @ 0x41c5a5
91cbb453404e741a430a572bff192dd9+0x1c0a2 @ 0x41c0a2
91cbb453404e741a430a572bff192dd9+0x1dffb @ 0x41dffb
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x775a788a
91cbb453404e741a430a572bff192dd9+0x1a79e @ 0x41a79e
91cbb453404e741a430a572bff192dd9+0xd848d @ 0x4d848d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636760
registers.edi: 4694776
registers.eax: 1636760
registers.ebp: 1636840
registers.edx: 0
registers.ebx: 3
registers.esi: 63866752
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1620816978.367125
__exception__
stacktrace: 
91cbb453404e741a430a572bff192dd9+0x8f290 @ 0x48f290
91cbb453404e741a430a572bff192dd9+0x780bf @ 0x4780bf
91cbb453404e741a430a572bff192dd9+0x789cc @ 0x4789cc
91cbb453404e741a430a572bff192dd9+0x1b22d @ 0x41b22d
91cbb453404e741a430a572bff192dd9+0x1b465 @ 0x41b465
91cbb453404e741a430a572bff192dd9+0x1c5a5 @ 0x41c5a5
91cbb453404e741a430a572bff192dd9+0x1c0a2 @ 0x41c0a2
91cbb453404e741a430a572bff192dd9+0x1dffb @ 0x41dffb
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x775a788a
91cbb453404e741a430a572bff192dd9+0x1a79e @ 0x41a79e
91cbb453404e741a430a572bff192dd9+0xd848d @ 0x4d848d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634816
registers.edi: 1637496
registers.eax: 1634816
registers.ebp: 1634896
registers.edx: 0
registers.ebx: 4782282
registers.esi: 0
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1620816978.492125
__exception__
stacktrace: 
91cbb453404e741a430a572bff192dd9+0x79fd8 @ 0x479fd8
91cbb453404e741a430a572bff192dd9+0x7a1e3 @ 0x47a1e3
91cbb453404e741a430a572bff192dd9+0x8f801 @ 0x48f801
91cbb453404e741a430a572bff192dd9+0x780bf @ 0x4780bf
91cbb453404e741a430a572bff192dd9+0x789cc @ 0x4789cc
91cbb453404e741a430a572bff192dd9+0x1b22d @ 0x41b22d
91cbb453404e741a430a572bff192dd9+0x1b465 @ 0x41b465
91cbb453404e741a430a572bff192dd9+0x1c5a5 @ 0x41c5a5
91cbb453404e741a430a572bff192dd9+0x1c0a2 @ 0x41c0a2
91cbb453404e741a430a572bff192dd9+0x1dffb @ 0x41dffb
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x775a788a
91cbb453404e741a430a572bff192dd9+0x1a79e @ 0x41a79e
91cbb453404e741a430a572bff192dd9+0xd848d @ 0x4d848d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636760
registers.edi: 4694776
registers.eax: 1636760
registers.ebp: 1636840
registers.edx: 0
registers.ebx: 3
registers.esi: 63866752
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
1620816978.492125
__exception__
stacktrace: 
91cbb453404e741a430a572bff192dd9+0x8f290 @ 0x48f290
91cbb453404e741a430a572bff192dd9+0x780bf @ 0x4780bf
91cbb453404e741a430a572bff192dd9+0x789cc @ 0x4789cc
91cbb453404e741a430a572bff192dd9+0x1b22d @ 0x41b22d
91cbb453404e741a430a572bff192dd9+0x1b465 @ 0x41b465
91cbb453404e741a430a572bff192dd9+0x1c5a5 @ 0x41c5a5
91cbb453404e741a430a572bff192dd9+0x1c0a2 @ 0x41c0a2
91cbb453404e741a430a572bff192dd9+0x1dffb @ 0x41dffb
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x775a77c4
DispatchMessageW+0xf GetMessageW-0x58 user32+0x1788a @ 0x775a788a
91cbb453404e741a430a572bff192dd9+0x1a79e @ 0x41a79e
91cbb453404e741a430a572bff192dd9+0xd848d @ 0x4d848d
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1634816
registers.edi: 1637496
registers.eax: 1634816
registers.ebp: 1634896
registers.edx: 0
registers.ebx: 4782282
registers.esi: 0
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3329945605&cup2hreq=aac2cf8f78b32f6b65764a50c756d7ca28c12a222088659a28e10c9faa759afd
Performs some HTTP requests (4 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620787944&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cafe90400ead0d36&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620787944&mv=m&mvi=3
request POST https://update.googleapis.com/service/update2?cup2key=10:3329945605&cup2hreq=aac2cf8f78b32f6b65764a50c756d7ca28c12a222088659a28e10c9faa759afd
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3329945605&cup2hreq=aac2cf8f78b32f6b65764a50c756d7ca28c12a222088659a28e10c9faa759afd
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620816977.649125
NtAllocateVirtualMemory
process_identifier: 196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00760000
success 0 0
1620816977.774125
NtAllocateVirtualMemory
process_identifier: 196
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x025f0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
A process attempted to delay the analysis task. (1 个事件)
description 91cbb453404e741a430a572bff192dd9.exe tried to sleep 179 seconds, actually delayed analysis time by 179 seconds
File has been identified by 4 AntiVirus engines on VirusTotal as malicious (4 个事件)
CrowdStrike win/malicious_confidence_60% (W)
ClamAV Win.Malware.0040eff-6980090-0
Jiangmin Trojan/Generic.fczg
Qihoo-360 HEUR/QVM11.1.6FF3.Malware.Gen
The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)
entropy 7.922193064343693 section {'size_of_data': '0x00057400', 'virtual_address': '0x0028a000', 'entropy': 7.922193064343693, 'name': 'UPX1', 'virtual_size': '0x00058000'} description A section with a high entropy has been found
entropy 7.497445215229142 section {'size_of_data': '0x0000ea00', 'virtual_address': '0x002e2000', 'entropy': 7.497445215229142, 'name': '.rsrc', 'virtual_size': '0x0000f000'} description A section with a high entropy has been found
entropy 1.0 description Overall entropy of this PE file is high
The executable is compressed using UPX (2 个事件)
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library KERNEL32.DLL:
• 0x6f0628 LoadLibraryA
• 0x6f062c GetProcAddress
• 0x6f0630 VirtualProtect
• 0x6f0634 VirtualAlloc
• 0x6f0638 VirtualFree
• 0x6f063c ExitProcess
Library advapi32.dll:
• 0x6f0644 RegCloseKey
Library comctl32.dll:
• 0x6f064c InitCommonControls
Library comdlg32.dll:
• 0x6f0654 PrintDlgA
Library dsound.dll:
• 0x6f065c DirectSoundCreate
Library gdi32.dll:
• 0x6f0664 EndDoc
Library msacm32.dll:
• 0x6f066c acmStreamSize
Library ole32.dll:
• 0x6f0674 CoInitialize
Library oleaut32.dll:
• 0x6f067c SysFreeString
Library shell32.dll:
• 0x6f0684 SHGetMalloc
Library user32.dll:
• 0x6f068c GetDC
Library version.dll:
• 0x6f0694 VerQueryValueW
Library winmm.dll:
• 0x6f069c timeGetTime
Library winspool.drv:
• 0x6f06a4 OpenPrinterA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49233 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49234 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49226 203.208.40.34 update.googleapis.com 443
192.168.56.101 49232 203.208.41.65 redirector.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 54178 114.114.114.114 53
192.168.56.101 54260 114.114.114.114 53
192.168.56.101 54991 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cafe90400ead0d36&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620787944&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=cafe90400ead0d36&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620787944&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620787944&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620787944&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.