7.8
高危
46 个模型检测该样本为恶意！
重新分析
更多

379e5a50296568f9f1642e63fcb2f4d349c81c2ce9febad3b305f67d6edd59f6

c3c0747d76fffd84ba75aabed2580630.exe

分析耗时

60s

最近分析

文件大小

170.7KB
静态报毒 动态报毒 100% AI SCORE=74 APPL BSCOPE CMRTAZOJ8DNQK5SMCLKNTSRJPFHL CONFIDENCE ELDORADO ET#87% FDUKAZ GRAYWARE HIGH CONFIDENCE LOADMONEY M@7OHO6U MACHAER MAIL MAILRU R232581 RDMK RU DOWNLOADER SCORE SUSPICIOUS PE TOOL UNSAFE 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee PUP-HAI 20200809 6.0.6.653
Alibaba 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Baidu 20190318 1.0.0.2
Kingsoft 20200809 2013.8.14.323
Tencent 20200809 1.0.0.1
Avast Win32:PUP-gen [PUP] 20200809 18.4.3895.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path D:\Build\desktop_apps\_out\launcher.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619890354.150499
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Encryption keys have been identified in this analysis
HTTP traffic contains suspicious features which may be indicative of malware related traffic (5 个事件)
suspicious_features GET method with no useragent header suspicious_request GET http://mrds.mail.ru/update/2/version.txt?type=swparams&raw=--bpl%3D%22eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D%22&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=10&elapsed_time=0&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13
suspicious_features GET method with no useragent header suspicious_request GET http://mrds.mail.ru/update/2/version.txt?type=swfinish&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=11&elapsed_time=1&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13
suspicious_features GET method with no useragent header suspicious_request GET https://conserv.go.mail.ru/app/switcher_c/v1?bpl=eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&ver=3.13.4.101&os=win6.1
suspicious_features GET method with no useragent header suspicious_request GET https://conserv.go.mail.ru/app/switcher/v1?bpl=eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D&default_br=ch&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&ver=3.13.4.101&os=win6.1
suspicious_features GET method with no useragent header suspicious_request GET https://mrds.mail.ru/update/2/version.txt?type=user&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=11&elapsed_time=1&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13
Performs some HTTP requests (6 个事件)
request GET http://mrds.mail.ru/update/2/version.txt?type=swparams&raw=--bpl%3D%22eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D%22&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=10&elapsed_time=0&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13
request GET http://mrds.mail.ru/update/2/version.txt?type=swfinish&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=11&elapsed_time=1&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13
request GET https://gosoftdl.mail.ru/switcher_pd_3_9.exe?masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&osver=6.1
request GET https://conserv.go.mail.ru/app/switcher_c/v1?bpl=eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&ver=3.13.4.101&os=win6.1
request GET https://conserv.go.mail.ru/app/switcher/v1?bpl=eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D&default_br=ch&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&ver=3.13.4.101&os=win6.1
request GET https://mrds.mail.ru/update/2/version.txt?type=user&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=11&elapsed_time=1&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13
Resolves a suspicious Top Level Domain (TLD) (3 个事件)
domain mrds.mail.ru description Russian Federation domain TLD
domain conserv.go.mail.ru description Russian Federation domain TLD
domain gosoftdl.mail.ru description Russian Federation domain TLD
Steals private information from local Internet browsers (7 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cookies
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cookies-wal
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default
file C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file C:\Users\Administrator.Oskar-PC\AppData\Local\Nichrome\User Data\Local State
file C:\Users\Administrator.Oskar-PC\AppData\Local\Yandex\YandexBrowser\User Data\Local State
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ln22896500\lrunner.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\ln22896500\lrunner.exe
网络通信
Communicates with host for which no DNS query was performed (2 个事件)
host 172.217.24.14
host 203.208.40.34
Generates some ICMP traffic
File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)
MicroWorld-eScan Gen:Variant.Application.Agent.6
FireEye Generic.mg.c3c0747d76fffd84
CAT-QuickHeal Trojan.Loadmoney
McAfee PUP-HAI
Zillya Tool.Agent.Win32.26977
K7AntiVirus Adware ( 0054652b1 )
K7GW Adware ( 0054652b1 )
CrowdStrike win/malicious_confidence_100% (D)
Arcabit Trojan.Application.Agent.6
F-Prot W32/S-2773094c!Eldorado
Symantec SMG.Heur!gen
APEX Malicious
ClamAV Win.Malware.Mailru-6804164-0
Kaspersky not-a-virus:HEUR:AdWare.Win32.Machaer.gen
BitDefender Gen:Variant.Application.Agent.6
NANO-Antivirus Riskware.Win32.MailRu.fdukaz
Rising Malware.Heuristic!ET#87% (RDMK:cmRtazoJ8DNqK5SMcLKNtSRJPFHl)
Ad-Aware Gen:Variant.Application.Agent.6
Emsisoft Application.Downloader (A)
Comodo Application.Win32.MailRu.M@7oho6u
F-Secure Program.APPL/MailRu.B
DrWeb Adware.Downware.19192
VIPRE Trojan.Win32.Generic!BT
Invincea heuristic
Sophos Mail.ru Downloader (PUA)
SentinelOne DFI - Suspicious PE
Cyren W32/S-2773094c!Eldorado
Jiangmin AdWare.Machaer.ad
Avira APPL/MailRu.B
MAX malware (ai score=74)
Antiy-AVL GrayWare[Adware]/Win32.Mailru.m
Microsoft PUA:Win32/LoadMoney
Endgame malicious (high confidence)
ZoneAlarm not-a-virus:HEUR:AdWare.Win32.Machaer.gen
GData Gen:Variant.Application.Agent.6
Cynet Malicious (score: 100)
AhnLab-V3 PUP/Win32.MailRu.R232581
VBA32 BScope.Adware.Machaer
Malwarebytes RiskWare.Agent
ESET-NOD32 a variant of Win32/MailRu.M potentially unwanted
Yandex Riskware.Agent!
Ikarus PUA.MailRu
eGambit Unsafe.AI_Score_99%
Fortinet W32/MailRu.M!tr
AVG Win32:PUP-gen [PUP]
Avast Win32:PUP-gen [PUP]
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)
dead_host 172.217.27.142:443
dead_host 172.217.24.14:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-04-02 22:25:18

Imports

Library KERNEL32.dll:
• 0x41c020 WriteFile
• 0x41c024 ReadFile
• 0x41c028 CreateDirectoryW
• 0x41c02c CreateFileW
• 0x41c030 GetLastError
• 0x41c034 GetTickCount
• 0x41c038 GetTempPathW
• 0x41c03c GetTempFileNameW
• 0x41c040 RemoveDirectoryW
• 0x41c044 DeleteFileW
• 0x41c048 GetModuleFileNameW
• 0x41c04c GetFileSize
• 0x41c050 LockFileEx
• 0x41c054 UnlockFile
• 0x41c058 GetVersionExW
• 0x41c05c MultiByteToWideChar
• 0x41c060 WideCharToMultiByte
• 0x41c064 LocalFree
• 0x41c068 SetEvent
• 0x41c06c Sleep
• 0x41c070 CreateEventW
• 0x41c074 HeapAlloc
• 0x41c078 HeapReAlloc
• 0x41c07c HeapFree
• 0x41c080 HeapSize
• 0x41c084 GetProcessHeap
• 0x41c088 DecodePointer
• 0x41c08c RaiseException
• 0x41c098 GetACP
• 0x41c09c GetModuleHandleW
• 0x41c0ac GetStringTypeW
• 0x41c0b0 EncodePointer
• 0x41c0b4 RtlUnwind
• 0x41c0b8 GetStdHandle
• 0x41c0bc GetFileType
• 0x41c0c0 GetModuleHandleExW
• 0x41c0c4 WriteConsoleW
• 0x41c0c8 GetCommandLineW
• 0x41c0cc GetConsoleCP
• 0x41c0d0 GetConsoleMode
• 0x41c0d4 GetCPInfo
• 0x41c0d8 CreateProcessW
• 0x41c0e0 SetLastError
• 0x41c0e4 GetCurrentProcess
• 0x41c0e8 TerminateProcess
• 0x41c0ec TlsAlloc
• 0x41c0f0 TlsGetValue
• 0x41c0f4 TlsSetValue
• 0x41c0f8 TlsFree
• 0x41c0fc GetStartupInfoW
• 0x41c104 LCMapStringW
• 0x41c108 ExitProcess
• 0x41c10c IsDebuggerPresent
• 0x41c110 GetCurrentThreadId
• 0x41c114 OutputDebugStringW
• 0x41c118 LoadLibraryExW
• 0x41c120 GetCurrentProcessId
• 0x41c130 FlushFileBuffers
• 0x41c134 SetFilePointerEx
• 0x41c138 IsValidCodePage
• 0x41c13c GetOEMCP
• 0x41c140 SetStdHandle
• 0x41c144 FreeLibrary
• 0x41c148 FormatMessageA
• 0x41c14c GetModuleHandleA
• 0x41c150 LoadLibraryW
• 0x41c154 CloseHandle
• 0x41c158 WaitForSingleObject
• 0x41c160 GetProcAddress
• 0x41c164 LoadLibraryExA
Library SHELL32.dll:
• 0x41c16c SHGetFolderPathW
Library WS2_32.dll:
• 0x41c174 ntohl
Library ADVAPI32.dll:
• 0x41c000 CryptDestroyKey
• 0x41c008 CryptCreateHash
• 0x41c00c CryptHashData
• 0x41c010 CryptReleaseContext
• 0x41c014 CryptDestroyHash
Library ole32.dll:
• 0x41c17c CoTaskMemFree
• 0x41c180 StringFromCLSID
• 0x41c184 CoCreateGuid

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49176 217.69.139.122 conserv.go.mail.ru 443
192.168.56.101 49177 217.69.139.122 conserv.go.mail.ru 443
192.168.56.101 49178 217.69.139.245 mrds.mail.ru 80
192.168.56.101 49179 217.69.139.245 mrds.mail.ru 443
192.168.56.101 49180 217.69.139.245 mrds.mail.ru 80
192.168.56.101 49173 94.100.180.110 gosoftdl.mail.ru 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://mrds.mail.ru/update/2/version.txt?type=swparams&raw=--bpl%3D%22eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D%22&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=10&elapsed_time=0&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13 
GET /update/2/version.txt?type=swparams&raw=--bpl%3D%22eyJjbGlfdmVyIjogMiwgImluc3RhbGxfdXJsIjogImh0dHBzOi8vZ29zb2Z0ZGwubWFpbC5ydS9zd2l0Y2hlcl9wZF8zXzkuZXhlIiwgImxvY2F0aW9uX2lkIjogImxhbmRfYm5kbCIsICJxdWVyeV9zdHJpbmciOiAiYW1fZGVmYXVsdD0xJm9jbF9pbnN0YWxsPTEmdmJtX2luc3RhbGw9MSZocF9pbnN0YWxsPTEmZHNlX2luc3RhbGw9MSZhdHRyPTkwMDMxMGNoJnJmcj05MDAzMTAmZXh0X3BhcmFtcz1vbGRfbXIxbGFkJTNENWQyN2NhMTgxNTk0OGNiNS0wLTAtIiwgInRzIjogMTU5NjY0MjU4OH0%3D%22&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=10&elapsed_time=0&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13 HTTP/1.1
Connection: Close
Host: mrds.mail.ru
http://mrds.mail.ru/update/2/version.txt?type=swfinish&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=11&elapsed_time=1&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13 
GET /update/2/version.txt?type=swfinish&masterid=%7BAF6EC118-D372-4C57-A0A8-EEEC31E8D3C5%7D&user_id=%7BB80C313F-869F-4FFE-B227-75C0647C9E26%7D&osver=7&osbit=64&osvernum=6.1&ossp=ServicePack1&uac=0&admin=1&ver=3.13.4.101&mailru_guard=0&mailru_updater=0&comp_mem=4095&tool_mem=11&elapsed_time=1&mr_service=0&os=win6.1&install_id=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&GUID=%7B7735516E-29EA-40A1-9464-2B26B94DA6E3%7D&tool=switcher&common_rfr=&conserv=1&loc_id=land_bndl&old_bin=1&rfr_rules=&split=13 HTTP/1.1
Connection: Close
Host: mrds.mail.ru

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.