8.4
高危
59 个模型检测该样本为恶意！
重新分析
更多

2467572968320c67ea46c765d9cdae94d3887e44d7af7e29b88f1b0e51fa4c01

9815a4eeaf97076ed028f1000e70a67a.exe

分析耗时

99s

最近分析

文件大小

623.1KB
静态报毒 动态报毒 AI SCORE=86 AIDETECTVM ATTRIBUTE B+GZ2NMKWRI BSCOPE CLASSIC CONFIDENCE DAPATO DELF ENNY FAREIT FORMBOOK FUERBOOS GAGBE GDSDA GENCIRC HIGH CONFIDENCE HIGHCONFIDENCE HUMATX INJECTS INVALIDSIG JACARD MALICIOUS PE MALREP MALWARE2 MALWARE@#TGZJ2P2CCZUM MGY@AK13NYIO OGVL REDCAP REMCOS REMCOSCRYPT SCORE SUSGEN THIAGBO UNSAFE ZELPHIF ZUSY 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Fareit-FZO!9815A4EEAF97 20201022 6.0.6.653
Alibaba Trojan:Win32/Remcos.9eec1173 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201022 18.4.3895.0
Tencent Malware.Win32.Gencirc.11ae8122 20201022 1.0.0.1
Kingsoft 20201022 2013.8.14.323
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
This executable is signed
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620808827.96875
__exception__
stacktrace: 
0x55047f
0x5505e4
DriverCallback+0x4e waveOutOpen-0xa2e winmm+0x3af0 @ 0x74543af0
timeEndPeriod+0x54a timeKillEvent-0x57 winmm+0xa535 @ 0x7454a535
timeEndPeriod+0x449 timeKillEvent-0x158 winmm+0xa434 @ 0x7454a434
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 55246320
registers.edi: 5571952
registers.eax: 0
registers.ebp: 55246400
registers.edx: 0
registers.ebx: 0
registers.esi: 16
registers.ecx: 0
exception.instruction_r: 8b 40 3c 99 03 04 24 13 54 24 04 83 c4 08 89 45
exception.instruction: mov eax, dword ptr [eax + 0x3c]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x53d308
success 0 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3191730406&cup2hreq=784ce0f2cf94ee32081ed5be2d36a70eeb6b58e8efca1d0de78c65203ae27e8d
Performs some HTTP requests (4 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620799229&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=510fb2812adee112&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620799229&mv=m&mvi=3
request POST https://update.googleapis.com/service/update2?cup2key=10:3191730406&cup2hreq=784ce0f2cf94ee32081ed5be2d36a70eeb6b58e8efca1d0de78c65203ae27e8d
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3191730406&cup2hreq=784ce0f2cf94ee32081ed5be2d36a70eeb6b58e8efca1d0de78c65203ae27e8d
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620808773.95375
NtAllocateVirtualMemory
process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x003f0000
success 0 0
Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)
Time & API Arguments Status Return Repeated
1620808792.06275
NtProtectVirtualMemory
process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 131072
protection: 32 (PAGE_EXECUTE_READ)
process_handle: 0xffffffff
base_address: 0x00531000
success 0 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620808802.87575
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Disables proxy possibly for traffic interception (1 个事件)
Time & API Arguments Status Return Repeated
1620808802.59375
RegSetValueExA
key_handle: 0x000002b4
value: 0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
success 0 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620808805.75075
RegSetValueExA
key_handle: 0x0000039c
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620808805.75075
RegSetValueExA
key_handle: 0x0000039c
value: Р™HG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620808805.75075
RegSetValueExA
key_handle: 0x0000039c
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620808805.75075
RegSetValueExW
key_handle: 0x0000039c
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620808805.75075
RegSetValueExA
key_handle: 0x000003b8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620808805.75075
RegSetValueExA
key_handle: 0x000003b8
value: Р™HG×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620808805.75075
RegSetValueExA
key_handle: 0x000003b8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620808805.95375
RegSetValueExW
key_handle: 0x00000398
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Network activity contains more than one unique useragent (2 个事件)
process 9815a4eeaf97076ed028f1000e70a67a.exe useragent Internal
process 9815a4eeaf97076ed028f1000e70a67a.exe useragent 9815a4eeaf97076ed028f1000e70a67a.exe
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Generic.mg.9815a4eeaf97076e
CAT-QuickHeal Trojan.Injects
McAfee Fareit-FZO!9815A4EEAF97
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win32/Remcos.9eec1173
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Zusy.D4C5FF
TrendMicro Trojan.Win32.MALREP.THIAGBO
Cyren W32/Trojan.OGVL-2111
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
Kaspersky HEUR:Trojan.Win32.Injects.gen
BitDefender Gen:Variant.Zusy.312831
NANO-Antivirus Trojan.Win32.Injects.humatx
Paloalto generic.ml
AegisLab Trojan.Win32.Injects.4!c
MicroWorld-eScan Gen:Variant.Zusy.312831
Tencent Malware.Win32.Gencirc.11ae8122
Ad-Aware Gen:Variant.Zusy.312831
Sophos Mal/Generic-S
Comodo Malware@#tgzj2p2cczum
F-Secure Trojan.TR/Redcap.gagbe
Zillya Trojan.Injector.Win32.769551
Invincea Mal/Generic-S
McAfee-GW-Edition Fareit-FZO!9815A4EEAF97
Emsisoft Gen:Variant.Zusy.312831 (B)
Ikarus Trojan.Win32.Injector
Jiangmin Trojan.Injects.mn
eGambit PE.Heur.InvalidSig
Avira TR/Redcap.gagbe
Antiy-AVL Trojan/Win32.Injects
Microsoft Trojan:Win32/RemcosCrypt.ACH!MTB
ViRobot Trojan.Win32.Z.Jacard.638105
ZoneAlarm HEUR:Trojan.Win32.Injects.gen
GData Win32.Trojan-Downloader.Delf.AC
AhnLab-V3 Trojan/Win32.Injector.C4194655
BitDefenderTheta Gen:NN.ZelphiF.34570.MGY@aK13NYiO
ALYac Trojan.Agent.FormBook
MAX malware (ai score=86)
VBA32 BScope.Trojan.Fuerboos
Malwarebytes Trojan.MalPack.DLF
ESET-NOD32 a variant of Win32/Injector.ENNY
TrendMicro-HouseCall Trojan.Win32.MALREP.THIAGBO
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)
dead_host 172.217.160.110:443
dead_host 172.217.24.14:443
dead_host 74.86.226.234:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x48d13c VirtualFree
• 0x48d140 VirtualAlloc
• 0x48d144 LocalFree
• 0x48d148 LocalAlloc
• 0x48d14c GetTickCount
• 0x48d154 GetVersion
• 0x48d158 GetCurrentThreadId
• 0x48d164 VirtualQuery
• 0x48d168 WideCharToMultiByte
• 0x48d16c MultiByteToWideChar
• 0x48d170 lstrlenA
• 0x48d174 lstrcpynA
• 0x48d178 LoadLibraryExA
• 0x48d17c GetThreadLocale
• 0x48d180 GetStartupInfoA
• 0x48d184 GetProcAddress
• 0x48d188 GetModuleHandleA
• 0x48d18c GetModuleFileNameA
• 0x48d190 GetLocaleInfoA
• 0x48d194 GetCommandLineA
• 0x48d198 FreeLibrary
• 0x48d19c FindFirstFileA
• 0x48d1a0 FindClose
• 0x48d1a4 ExitProcess
• 0x48d1a8 WriteFile
• 0x48d1b0 RtlUnwind
• 0x48d1b4 RaiseException
• 0x48d1b8 GetStdHandle
Library user32.dll:
• 0x48d1c0 GetKeyboardType
• 0x48d1c4 LoadStringA
• 0x48d1c8 MessageBoxA
• 0x48d1cc CharNextA
Library advapi32.dll:
• 0x48d1d4 RegQueryValueExA
• 0x48d1d8 RegOpenKeyExA
• 0x48d1dc RegCloseKey
Library oleaut32.dll:
• 0x48d1e4 SysFreeString
• 0x48d1e8 SysReAllocStringLen
• 0x48d1ec SysAllocStringLen
Library kernel32.dll:
• 0x48d1f4 TlsSetValue
• 0x48d1f8 TlsGetValue
• 0x48d1fc LocalAlloc
• 0x48d200 GetModuleHandleA
Library advapi32.dll:
• 0x48d208 RegQueryValueExA
• 0x48d20c RegOpenKeyExA
• 0x48d210 RegCloseKey
Library kernel32.dll:
• 0x48d218 lstrcpyA
• 0x48d21c lstrcmpiA
• 0x48d220 WriteFile
• 0x48d224 WaitForSingleObject
• 0x48d228 VirtualQuery
• 0x48d22c VirtualProtect
• 0x48d230 VirtualAlloc
• 0x48d234 Sleep
• 0x48d238 SizeofResource
• 0x48d23c SetThreadLocale
• 0x48d240 SetFilePointer
• 0x48d244 SetEvent
• 0x48d248 SetErrorMode
• 0x48d24c SetEndOfFile
• 0x48d250 ResetEvent
• 0x48d254 ReadFile
• 0x48d258 MulDiv
• 0x48d25c LockResource
• 0x48d260 LoadResource
• 0x48d264 LoadLibraryA
• 0x48d270 GlobalUnlock
• 0x48d274 GlobalReAlloc
• 0x48d278 GlobalHandle
• 0x48d27c GlobalLock
• 0x48d280 GlobalFree
• 0x48d284 GlobalFindAtomA
• 0x48d288 GlobalDeleteAtom
• 0x48d28c GlobalAlloc
• 0x48d290 GlobalAddAtomA
• 0x48d294 GetVersionExA
• 0x48d298 GetVersion
• 0x48d29c GetTickCount
• 0x48d2a0 GetThreadLocale
• 0x48d2a4 GetSystemInfo
• 0x48d2a8 GetStringTypeExA
• 0x48d2ac GetStdHandle
• 0x48d2b0 GetProcAddress
• 0x48d2b4 GetModuleHandleA
• 0x48d2b8 GetModuleFileNameA
• 0x48d2bc GetLocaleInfoA
• 0x48d2c0 GetLocalTime
• 0x48d2c4 GetLastError
• 0x48d2c8 GetFullPathNameA
• 0x48d2cc GetDiskFreeSpaceA
• 0x48d2d0 GetDateFormatA
• 0x48d2d4 GetCurrentThreadId
• 0x48d2d8 GetCurrentProcessId
• 0x48d2dc GetCPInfo
• 0x48d2e0 GetACP
• 0x48d2e4 FreeResource
• 0x48d2e8 InterlockedExchange
• 0x48d2ec FreeLibrary
• 0x48d2f0 FormatMessageA
• 0x48d2f4 FindResourceA
• 0x48d2f8 EnumCalendarInfoA
• 0x48d304 CreateThread
• 0x48d308 CreateFileA
• 0x48d30c CreateEventA
• 0x48d310 CompareStringA
• 0x48d314 CloseHandle
Library version.dll:
• 0x48d31c VerQueryValueA
• 0x48d324 GetFileVersionInfoA
Library gdi32.dll:
• 0x48d32c UnrealizeObject
• 0x48d330 StretchBlt
• 0x48d334 SetWindowOrgEx
• 0x48d338 SetWinMetaFileBits
• 0x48d33c SetViewportOrgEx
• 0x48d340 SetTextColor
• 0x48d344 SetStretchBltMode
• 0x48d348 SetROP2
• 0x48d34c SetPixel
• 0x48d350 SetEnhMetaFileBits
• 0x48d354 SetDIBColorTable
• 0x48d358 SetBrushOrgEx
• 0x48d35c SetBkMode
• 0x48d360 SetBkColor
• 0x48d364 SelectPalette
• 0x48d368 SelectObject
• 0x48d36c SaveDC
• 0x48d370 RestoreDC
• 0x48d374 RectVisible
• 0x48d378 RealizePalette
• 0x48d37c PlayEnhMetaFile
• 0x48d380 PatBlt
• 0x48d384 MoveToEx
• 0x48d388 MaskBlt
• 0x48d38c LineTo
• 0x48d390 IntersectClipRect
• 0x48d394 GetWindowOrgEx
• 0x48d398 GetWinMetaFileBits
• 0x48d39c GetTextMetricsA
• 0x48d3a8 GetStockObject
• 0x48d3ac GetPixel
• 0x48d3b0 GetPaletteEntries
• 0x48d3b4 GetObjectA
• 0x48d3b8 GetMapMode
• 0x48d3c4 GetEnhMetaFileBits
• 0x48d3c8 GetDeviceCaps
• 0x48d3cc GetDIBits
• 0x48d3d0 GetDIBColorTable
• 0x48d3d4 GetDCOrgEx
• 0x48d3dc GetClipBox
• 0x48d3e0 GetBrushOrgEx
• 0x48d3e4 GetBkMode
• 0x48d3e8 GetBitmapBits
• 0x48d3ec GdiFlush
• 0x48d3f0 ExcludeClipRect
• 0x48d3f4 DeleteObject
• 0x48d3f8 DeleteEnhMetaFile
• 0x48d3fc DeleteDC
• 0x48d400 CreateSolidBrush
• 0x48d404 CreatePenIndirect
• 0x48d408 CreatePalette
• 0x48d410 CreateFontIndirectA
• 0x48d414 CreateDIBitmap
• 0x48d418 CreateDIBSection
• 0x48d41c CreateCompatibleDC
• 0x48d424 CreateBrushIndirect
• 0x48d428 CreateBitmap
• 0x48d42c CopyEnhMetaFileA
• 0x48d430 BitBlt
Library user32.dll:
• 0x48d438 CreateWindowExA
• 0x48d43c WindowFromPoint
• 0x48d440 WinHelpA
• 0x48d444 WaitMessage
• 0x48d448 UpdateWindow
• 0x48d44c UnregisterClassA
• 0x48d450 UnhookWindowsHookEx
• 0x48d454 TranslateMessage
• 0x48d45c TrackPopupMenu
• 0x48d464 ShowWindow
• 0x48d468 ShowScrollBar
• 0x48d46c ShowOwnedPopups
• 0x48d470 ShowCursor
• 0x48d474 SetWindowsHookExA
• 0x48d478 SetWindowPos
• 0x48d47c SetWindowPlacement
• 0x48d480 SetWindowLongA
• 0x48d484 SetTimer
• 0x48d488 SetScrollRange
• 0x48d48c SetScrollPos
• 0x48d490 SetScrollInfo
• 0x48d494 SetRect
• 0x48d498 SetPropA
• 0x48d49c SetParent
• 0x48d4a0 SetMenuItemInfoA
• 0x48d4a4 SetMenu
• 0x48d4a8 SetForegroundWindow
• 0x48d4ac SetFocus
• 0x48d4b0 SetCursor
• 0x48d4b4 SetClassLongA
• 0x48d4b8 SetCapture
• 0x48d4bc SetActiveWindow
• 0x48d4c0 SendMessageA
• 0x48d4c4 ScrollWindow
• 0x48d4c8 ScreenToClient
• 0x48d4cc RemovePropA
• 0x48d4d0 RemoveMenu
• 0x48d4d4 ReleaseDC
• 0x48d4d8 ReleaseCapture
• 0x48d4e4 RegisterClassA
• 0x48d4e8 RedrawWindow
• 0x48d4ec PtInRect
• 0x48d4f0 PostQuitMessage
• 0x48d4f4 PostMessageA
• 0x48d4f8 PeekMessageA
• 0x48d4fc OffsetRect
• 0x48d500 OemToCharA
• 0x48d504 MessageBoxA
• 0x48d508 MapWindowPoints
• 0x48d50c MapVirtualKeyA
• 0x48d510 LoadStringA
• 0x48d514 LoadKeyboardLayoutA
• 0x48d518 LoadIconA
• 0x48d51c LoadCursorA
• 0x48d520 LoadBitmapA
• 0x48d524 KillTimer
• 0x48d528 IsZoomed
• 0x48d52c IsWindowVisible
• 0x48d530 IsWindowEnabled
• 0x48d534 IsWindow
• 0x48d538 IsRectEmpty
• 0x48d53c IsIconic
• 0x48d540 IsDialogMessageA
• 0x48d544 IsChild
• 0x48d548 InvalidateRect
• 0x48d54c IntersectRect
• 0x48d550 InsertMenuItemA
• 0x48d554 InsertMenuA
• 0x48d558 InflateRect
• 0x48d560 GetWindowTextA
• 0x48d564 GetWindowRect
• 0x48d568 GetWindowPlacement
• 0x48d56c GetWindowLongA
• 0x48d570 GetWindowDC
• 0x48d574 GetTopWindow
• 0x48d578 GetSystemMetrics
• 0x48d57c GetSystemMenu
• 0x48d580 GetSysColorBrush
• 0x48d584 GetSysColor
• 0x48d588 GetSubMenu
• 0x48d58c GetScrollRange
• 0x48d590 GetScrollPos
• 0x48d594 GetScrollInfo
• 0x48d598 GetPropA
• 0x48d59c GetParent
• 0x48d5a0 GetWindow
• 0x48d5a4 GetMenuStringA
• 0x48d5a8 GetMenuState
• 0x48d5ac GetMenuItemInfoA
• 0x48d5b0 GetMenuItemID
• 0x48d5b4 GetMenuItemCount
• 0x48d5b8 GetMenu
• 0x48d5bc GetLastActivePopup
• 0x48d5c0 GetKeyboardState
• 0x48d5c8 GetKeyboardLayout
• 0x48d5cc GetKeyState
• 0x48d5d0 GetKeyNameTextA
• 0x48d5d4 GetIconInfo
• 0x48d5d8 GetForegroundWindow
• 0x48d5dc GetFocus
• 0x48d5e0 GetDesktopWindow
• 0x48d5e4 GetDCEx
• 0x48d5e8 GetDC
• 0x48d5ec GetCursorPos
• 0x48d5f0 GetCursor
• 0x48d5f4 GetClipboardData
• 0x48d5f8 GetClientRect
• 0x48d5fc GetClassNameA
• 0x48d600 GetClassInfoA
• 0x48d604 GetCapture
• 0x48d608 GetActiveWindow
• 0x48d60c FrameRect
• 0x48d610 FindWindowA
• 0x48d614 FillRect
• 0x48d618 EqualRect
• 0x48d61c EnumWindows
• 0x48d620 EnumThreadWindows
• 0x48d624 EndPaint
• 0x48d628 EnableWindow
• 0x48d62c EnableScrollBar
• 0x48d630 EnableMenuItem
• 0x48d634 DrawTextA
• 0x48d638 DrawMenuBar
• 0x48d63c DrawIconEx
• 0x48d640 DrawIcon
• 0x48d644 DrawFrameControl
• 0x48d648 DrawEdge
• 0x48d64c DispatchMessageA
• 0x48d650 DestroyWindow
• 0x48d654 DestroyMenu
• 0x48d658 DestroyIcon
• 0x48d65c DestroyCursor
• 0x48d660 DeleteMenu
• 0x48d664 DefWindowProcA
• 0x48d668 DefMDIChildProcA
• 0x48d66c DefFrameProcA
• 0x48d670 CreatePopupMenu
• 0x48d674 CreateMenu
• 0x48d678 CreateIcon
• 0x48d67c ClientToScreen
• 0x48d680 CheckMenuItem
• 0x48d684 CallWindowProcA
• 0x48d688 CallNextHookEx
• 0x48d68c BeginPaint
• 0x48d690 CharNextA
• 0x48d694 CharLowerBuffA
• 0x48d698 CharLowerA
• 0x48d69c CharToOemA
• 0x48d6a0 AdjustWindowRectEx
Library kernel32.dll:
• 0x48d6ac Sleep
Library oleaut32.dll:
• 0x48d6b4 SafeArrayPtrOfIndex
• 0x48d6b8 SafeArrayGetUBound
• 0x48d6bc SafeArrayGetLBound
• 0x48d6c0 SafeArrayCreate
• 0x48d6c4 VariantChangeType
• 0x48d6c8 VariantCopy
• 0x48d6cc VariantClear
• 0x48d6d0 VariantInit
Library comctl32.dll:
• 0x48d6e0 ImageList_Write
• 0x48d6e4 ImageList_Read
• 0x48d6f4 ImageList_DragMove
• 0x48d6f8 ImageList_DragLeave
• 0x48d6fc ImageList_DragEnter
• 0x48d700 ImageList_EndDrag
• 0x48d704 ImageList_BeginDrag
• 0x48d708 ImageList_Remove
• 0x48d70c ImageList_DrawEx
• 0x48d710 ImageList_Draw
• 0x48d720 ImageList_Add
• 0x48d72c ImageList_Destroy
• 0x48d730 ImageList_Create
Library advapi32.dll:
• 0x48d738 QueryServiceStatus
• 0x48d73c OpenServiceA
• 0x48d740 OpenSCManagerA
• 0x48d744 CloseServiceHandle

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49185 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49186 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49184 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49183 203.208.41.66 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 54260 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60911 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620799229&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620799229&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=510fb2812adee112&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620799229&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=510fb2812adee112&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620799229&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.