9.4
极危

038156a0422681ab0e4af6fb927700bd7610298b207b9683e5ab7c2745b2dca1

9a65a643bbf3fc9dd5771c40ec77f867.exe

分析耗时

100s

最近分析

文件大小

789.1KB
静态报毒 动态报毒 CGENERIC CLOUD COMPONENT CONFIDENCE CROSSRIDER GRAYWARE HFSADWARE PLAYTECH UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20190501 6.0.6.653
Baidu 20190318 1.0.0.2
Avast 20190501 18.4.3895.0
Alibaba 20190426 0.4.0.6
Tencent 20190501 1.0.0.1
Kingsoft 20190501 2013.8.14.323
CrowdStrike win/malicious_confidence_60% (D) 20190212 1.0
静态指标
This executable is signed
Tries to locate where the browsers are installed (3 个事件)
registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Mozilla Firefox
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620985509.804474
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .ndata
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3135824341&cup2hreq=549f53af9e5658dce9e8942f635c741d55475639ce6c00ed682b5921e64c9582
Performs some HTTP requests (14 个事件)
request GET http://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom_new/index.7ze
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/index.7ze
request GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request GET http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
request GET http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
request GET http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
request GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620962420&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=51923a2d5c25853c&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620962660&mv=m&mvi=3
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=QOMF%2FRPQ0tD63mIg6QuWdum%2FpDpYAniX3O7PpI32nAwvDBks7lU4arQ5R2RH3QTx122mi7TLd%2FTRRmV3TwcfUsXR86xtIMetviemxzJwIWUfB4XneyMZG3C%2FAwYQaZFoFdZkPekZ0vEBokyVzWNTvnTPPCxPdzMGD%2BFOHWFEtlSp8yaIWR%2FN42hHaXR%2Ft4OhVzjGJxlZLr%2BnXnRSFIukoq7%2FE6AHZwptb%2BT%2BsPKG6U4ClKpyob%2FI0R8mDGp%2FPA7sTM7P1K5zjhkNYHug1hgsiPEJnss2PQBYYxjn509ROLau8FMGDN3mvCZbBI40iUApqPKRlkQxQ07b2MvUagdy%2FfMQuKk6W1fExzp17JzTzzPgDWJRR%2BmC9UaMyZaNR6YrruyODmOWcuprgnJVbQaOlP2ALBE65zu3Uc6FgU7%2FwuemU3Hm2iIWyBdi0fvmVpsH09AbxShdUhN4sxz%2FNlBd%2BoERpZ4gERA3sBrP5VZ6HR1wXWC1JF6stcAJ5X%2FXqfL1v6gVAq37d7SYdFVIokOhJ30aYaeIeuCcklztqYgOeevlod%2BKUiqywthFPni1FSdMuAZc1CEq7%2FXnyGKMDAxFp3665zYME7rJCDvkBChh6swHgxkizjzyeRdcEd0Ulpte5lBw%2FUJuYk8hmZJAg9sF6Q29r%2FWQjnT82Rh%2BnWd2Q%2Bs%3D
request GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=cMYpXppTeenAQ2vksb%2FOiRxtEl8I6iWEOTMRnTVg4ulDxdA8wMrz4yP3NW1snXdVdKTwPSLlLdaiRK3I%2BvJEmxxwPX%2FgbdO3jmS84xxj4jsb0zqWirZD1g7Fn2OA%2Bg3RV9ZLmp5itk9Zt9zg4G567I86siZnwN6DYPMbc3GfCEbd8U4Zt0deEoF5rpfobsKjwQ67mDnguto0F51yGWpgZQRatnHf8l0UygrelIvUWWCP9T99Kmit%2BTHlPAPr9eSuiS3yi6oF8HQbl4kd3XgTt63%2FHRVZI%2FCYiq3MYoZN0LOSNi1l8p0fclkMTJ0eum7ukRBv94syGGvfZIGlNsMuMpED1RfHJgYiDUiCEB545a7yxcAoSBxRzr8aXoTJHPPzw2XkpQJfJvThqYYZtdNXXKORxk6bBs4hgd7MOdUuf8Pom8j%2F2Du0DeJKilY53VjKreEAYWjE8B3n%2FUVbi9R4%2BM2T1Kzxu6BKyuDHP7tWFhBkCh%2Bw4DMUDxrZ9AdCQOnE2xcCz64B7a1WmDe%2FqWv9m58wpucIY9TjhHwpYxS4CwXfJK9Zcc%2Ft7LY%2BFcl5RypwuFxmc1BuAzd%2BlU5VyF2qxRP7x7o9SSCVQwH87o3qinELilr0wJmZaEcMfBJD%2B36RDW3dYwzNgVHJx2jEAbLUejFtKtfbM589%2B7fc1YS7S%2BY%3D
request GET https://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze
request POST https://update.googleapis.com/service/update2?cup2key=10:3135824341&cup2hreq=549f53af9e5658dce9e8942f635c741d55475639ce6c00ed682b5921e64c9582
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3135824341&cup2hreq=549f53af9e5658dce9e8942f635c741d55475639ce6c00ed682b5921e64c9582
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620991523.596
NtAllocateVirtualMemory
process_identifier: 880
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x028e0000
success 0 0
1620991163.600021
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000041b0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Steals private information from local Internet browsers (2 个事件)
registry HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Firefox
registry HKEY_CURRENT_USER\Software\Mozilla\Mozilla Firefox
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsn5A71.tmp\StdUtils.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsn5A71.tmp\internal9a65a643bbf3fc9dd5771c40ec77f867.exe
Drops an executable to the user AppData folder (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsn5A71.tmp\internal9a65a643bbf3fc9dd5771c40ec77f867.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nsn5A71.tmp\StdUtils.dll
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 个事件)
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1620991526.096
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Queries for potentially installed applications (6 个事件)
Time & API Arguments Status Return Repeated
1620991522.096
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620991522.096
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x000000dc
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620991558.909
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620991558.909
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000860
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
1620991558.971
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
failed 2 0
1620991558.971
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000860
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
options: 0
success 0 0
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1620991559.112
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Playtech WinClient Downloader/1.0
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 个事件)
Bkav W32.HfsAdware.D664
CAT-QuickHeal Trojan.CGeneric
Cylance Unsafe
K7GW Riskware ( 005475191 )
K7AntiVirus Riskware ( 005475191 )
Invincea heuristic
TrendMicro-HouseCall PUA.Win32.PlayTech.AK.component
TrendMicro PUA.Win32.PlayTech.AK.component
McAfee-GW-Edition BehavesLike.Win32.Suspicious.bc
Antiy-AVL GrayWare[AdWare]/Win32.PlayTech.a
Microsoft PUA:Win32/Playtech
Zoner PUA.Win32.65045
ESET-NOD32 Win32/PlayTech.A potentially unwanted
Rising PUA.CrossRider!8.84 (CLOUD)
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (D)
Attempts to create or modify system certificates (1 个事件)
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)
Time & API Arguments Status Return Repeated
1620991528.659
RegSetValueExA
key_handle: 0x00000530
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620991528.659
RegSetValueExA
key_handle: 0x00000530
value: 0| ±H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620991528.659
RegSetValueExA
key_handle: 0x00000530
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620991528.659
RegSetValueExW
key_handle: 0x00000530
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620991528.659
RegSetValueExA
key_handle: 0x00000548
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620991528.659
RegSetValueExA
key_handle: 0x00000548
value: 0| ±H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620991528.659
RegSetValueExA
key_handle: 0x00000548
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1620991528.705
RegSetValueExW
key_handle: 0x0000052c
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
1620991529.284
RegSetValueExA
key_handle: 0x00000598
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1620991529.284
RegSetValueExA
key_handle: 0x00000598
value: @xÛ ±H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1620991529.284
RegSetValueExA
key_handle: 0x00000598
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1620991529.284
RegSetValueExW
key_handle: 0x00000598
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1620991529.284
RegSetValueExA
key_handle: 0x00000604
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1620991529.284
RegSetValueExA
key_handle: 0x00000604
value: @xÛ ±H×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1620991529.284
RegSetValueExA
key_handle: 0x00000604
value: 0
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 216.58.200.238:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-02-19 23:01:49

Imports

Library ADVAPI32.dll:
0x429340 RegCloseKey
0x429344 RegCreateKeyExA
0x429348 RegDeleteKeyA
0x42934c RegDeleteValueA
0x429350 RegEnumKeyA
0x429354 RegEnumValueA
0x429358 RegOpenKeyExA
0x42935c RegQueryValueExA
0x429360 RegSetValueExA
Library COMCTL32.DLL:
0x429368 ImageList_AddMasked
0x42936c ImageList_Create
0x429370 ImageList_Destroy
0x429374 InitCommonControls
Library GDI32.dll:
0x42937c CreateBrushIndirect
0x429380 CreateFontIndirectA
0x429384 DeleteObject
0x429388 GetDeviceCaps
0x42938c SelectObject
0x429390 SetBkColor
0x429394 SetBkMode
0x429398 SetTextColor
Library KERNEL32.dll:
0x4293a0 CloseHandle
0x4293a4 CompareFileTime
0x4293a8 CopyFileA
0x4293ac CreateDirectoryA
0x4293b0 CreateFileA
0x4293b4 CreateProcessA
0x4293b8 CreateThread
0x4293bc DeleteFileA
0x4293c0 ExitProcess
0x4293c8 FindClose
0x4293cc FindFirstFileA
0x4293d0 FindNextFileA
0x4293d4 FreeLibrary
0x4293d8 GetCommandLineA
0x4293dc GetCurrentProcess
0x4293e0 GetDiskFreeSpaceA
0x4293e4 GetExitCodeProcess
0x4293e8 GetFileAttributesA
0x4293ec GetFileSize
0x4293f0 GetFullPathNameA
0x4293f4 GetLastError
0x4293f8 GetModuleFileNameA
0x4293fc GetModuleHandleA
0x429404 GetProcAddress
0x429408 GetShortPathNameA
0x42940c GetSystemDirectoryA
0x429410 GetTempFileNameA
0x429414 GetTempPathA
0x429418 GetTickCount
0x42941c GetVersion
0x429424 GlobalAlloc
0x429428 GlobalFree
0x42942c GlobalLock
0x429430 GlobalUnlock
0x429434 LoadLibraryA
0x429438 LoadLibraryExA
0x42943c MoveFileA
0x429440 MulDiv
0x429444 MultiByteToWideChar
0x429448 ReadFile
0x42944c RemoveDirectoryA
0x429450 SearchPathA
0x429458 SetErrorMode
0x42945c SetFileAttributesA
0x429460 SetFilePointer
0x429464 SetFileTime
0x429468 Sleep
0x42946c WaitForSingleObject
0x429470 WriteFile
0x429478 lstrcatA
0x42947c lstrcmpA
0x429480 lstrcmpiA
0x429484 lstrcpynA
0x429488 lstrlenA
Library ole32.dll:
0x429490 CoCreateInstance
0x429494 CoTaskMemFree
0x429498 OleInitialize
0x42949c OleUninitialize
Library SHELL32.DLL:
0x4294a4 SHBrowseForFolderA
0x4294a8 SHFileOperationA
0x4294ac SHGetFileInfoA
0x4294b8 ShellExecuteA
Library USER32.dll:
0x4294c0 AppendMenuA
0x4294c4 BeginPaint
0x4294c8 CallWindowProcA
0x4294cc CharNextA
0x4294d0 CharPrevA
0x4294d4 CheckDlgButton
0x4294d8 CloseClipboard
0x4294dc CreateDialogParamA
0x4294e0 CreatePopupMenu
0x4294e4 CreateWindowExA
0x4294e8 DefWindowProcA
0x4294ec DestroyWindow
0x4294f0 DialogBoxParamA
0x4294f4 DispatchMessageA
0x4294f8 DrawTextA
0x4294fc EmptyClipboard
0x429500 EnableMenuItem
0x429504 EnableWindow
0x429508 EndDialog
0x42950c EndPaint
0x429510 ExitWindowsEx
0x429514 FillRect
0x429518 FindWindowExA
0x42951c GetClassInfoA
0x429520 GetClientRect
0x429524 GetDC
0x429528 GetDlgItem
0x42952c GetDlgItemTextA
0x429530 GetMessagePos
0x429534 GetSysColor
0x429538 GetSystemMenu
0x42953c GetSystemMetrics
0x429540 GetWindowLongA
0x429544 GetWindowRect
0x429548 InvalidateRect
0x42954c IsWindow
0x429550 IsWindowEnabled
0x429554 IsWindowVisible
0x429558 LoadBitmapA
0x42955c LoadCursorA
0x429560 LoadImageA
0x429564 MessageBoxIndirectA
0x429568 OpenClipboard
0x42956c PeekMessageA
0x429570 PostQuitMessage
0x429574 RegisterClassA
0x429578 ScreenToClient
0x42957c SendMessageA
0x429580 SendMessageTimeoutA
0x429584 SetClassLongA
0x429588 SetClipboardData
0x42958c SetCursor
0x429590 SetDlgItemTextA
0x429594 SetForegroundWindow
0x429598 SetTimer
0x42959c SetWindowLongA
0x4295a0 SetWindowPos
0x4295a4 SetWindowTextA
0x4295a8 ShowWindow
0x4295b0 TrackPopupMenu
0x4295b4 wsprintfA
Library VERSION.dll:
0x4295bc GetFileVersionInfoA
0x4295c4 VerQueryValueA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49205 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49206 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49185 151.139.128.14 ocsp.comodoca.com 80
192.168.56.101 49186 151.139.128.14 ocsp.comodoca.com 80
192.168.56.101 49187 151.139.128.14 ocsp.comodoca.com 80
192.168.56.101 49188 151.139.128.14 ocsp.comodoca.com 80
192.168.56.101 49189 151.139.128.14 ocsp.comodoca.com 80
192.168.56.101 49190 151.139.128.14 ocsp.comodoca.com 80
192.168.56.101 49204 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49202 203.208.41.66 update.googleapis.com 443
192.168.56.101 49179 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 80
192.168.56.101 49180 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49181 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49192 205.185.208.154 c6m7w2m9.ssl.hwcdn.net 443
192.168.56.101 49184 222.216.123.6 www.download.windowsupdate.com 80
192.168.56.101 49183 36.25.252.1 www.download.windowsupdate.com 80
192.168.56.101 49182 52.218.21.140 fallback.playtech-installer.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 54260 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 58970 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

URI Data
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620962420&mv=m&mvi=1&pl=23&shardbypass=yes
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620962420&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT
If-None-Match: "0d8f4f3f6fd71:0"
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.download.windowsupdate.com

http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.usertrust.com

http://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom_new/index.7ze
GET /playtech_compressed_assets/casino_casinocom_new/index.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\8E516C4D558E43EFA6777CE50C31D076\index.7ze
User-Agent: Playtech WinClient Downloader/1.0
Host: c6m7w2m9.ssl.hwcdn.net
Connection: Keep-Alive
Cache-Control: no-cache

http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze
GET /playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\8E516C4D558E43EFA6777CE50C31D076\casinocom_2016 (1).7z
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache

http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=51923a2d5c25853c&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620962660&mv=m&mvi=3
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=51923a2d5c25853c&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620962660&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/index.7ze
GET /playtech_compressed_assets/casino_casinocom_new/index.7ze HTTP/1.1
Accept: */*
C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\8E516C4D558E43EFA6777CE50C31D076\index.7ze
User-Agent: Playtech WinClient Downloader/1.0
Host: fallback.playtech-installer.com
Connection: Keep-Alive
Cache-Control: no-cache

http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.comodoca.com

http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.sectigo.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.