10.4
0-day
48 个模型检测该样本为恶意！
重新分析
更多

37a3e14a1ba0cf46d3a152d603be07310b5739bbd9569ad1f7160cde0b7456bc

c55fcd53dfc31e498a4298a12b2c89cf.exe

分析耗时

138s

最近分析

文件大小

308.1KB
静态报毒 动态报毒 3TSK2DAAYGU AI SCORE=89 ATTRIBUTE BKSNP CONFIDENCE DOWNLOADER34 ELDORADO EMOTET GENCIRC GENERICKDZ HCEJ HIGH CONFIDENCE HIGHCONFIDENCE HSEJQL KRYPTIK MALWARE@#1HPL7KSVKLKGB PHORPIEXUPO R + TROJ R348891 TRTJ UNSAFE VY4TLVLX5U8 WACATAC 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Emotet-FRV!C55FCD53DFC3 20201024 6.0.6.653
Alibaba Trojan:Win32/Emotet.bd097160 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Trojan-gen 20201024 18.4.3895.0
Tencent Malware.Win32.Gencirc.10cdeb6a 20201024 1.0.0.1
Kingsoft 20201024 2013.8.14.323
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619932303.651875
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
Uses Windows APIs to generate a cryptographic key (7 个事件)
Time & API Arguments Status Return Repeated
1619932292.026875
CryptGenKey
crypto_handle: 0x00874c48
algorithm_identifier: 0x0000660e ()
provider_handle: 0x00873f30
flags: 1
key: ff]|ÂÛMDƼڐ ¿¥=
success 1 0
1619932303.651875
CryptExportKey
crypto_handle: 0x00874c48
crypto_export_handle: 0x00874c08
buffer: f¤âÿu´Õ[*WÈKøGnÑ#Ýá»5 ô“ {§6mï@.v³%ï%ÛÝÅ~­=4ȸJrÙ4–“ÙÜ×<ÁÄÇ0dg¹Ø-[ِøMã˕Va>ªIngï?ý+´ÊWŠ
blob_type: 1
flags: 64
success 1 0
1619932331.339875
CryptExportKey
crypto_handle: 0x00874c48
crypto_export_handle: 0x00874c08
buffer: f¤Mäí¶ë•üV Î{'§ÿ|€`­¡äàpû×Y1Úž ®¢ôËn ¡1do( ‘جÄQëUՄ›ú}>póØm/g:õéªG@Ò+2gŒˆù1š'ÆPpÊ;Ӛ«
blob_type: 1
flags: 64
success 1 0
1619932342.026875
CryptExportKey
crypto_handle: 0x00874c48
crypto_export_handle: 0x00874c08
buffer: f¤2éå®e(ÂùoiRÝç½d‰VºÐ“a}jÐdJTã‹ô{Ðpwrx¨‹·©eÙ=OkB±,ÎÃÕ14r†jy‘„ݱ_»¡ÄÝʼþNÚc–YüZÛ.&°ÍEÆYUÂ
blob_type: 1
flags: 64
success 1 0
1619932346.698875
CryptExportKey
crypto_handle: 0x00874c48
crypto_export_handle: 0x00874c08
buffer: f¤&øüûÂÈ;3…¦É>,®x_ùTÕ ]-b ¹ÍÁ¦Ä‘DÚy~ñTâÓý@g [{¶<Æ!H0›f^‚ç˜ ¸J^gugâµ7-ï©W¤›)³ëOè9¦Ò´#'èq½
blob_type: 1
flags: 64
success 1 0
1619932351.339875
CryptExportKey
crypto_handle: 0x00874c48
crypto_export_handle: 0x00874c08
buffer: f¤E‰Ê%bðù¹\ ŒPXõw²äfrÓ5ÝìªcåòĂ@HçCMR¸ö§Pј-àâqۇGÉMˆ8]àãSÚ)“A:ۑ±—£ƒÕÝ÷Ó_ÍRS*îtXË2U™S
blob_type: 1
flags: 64
success 1 0
1619932376.292875
CryptExportKey
crypto_handle: 0x00874c48
crypto_export_handle: 0x00874c08
buffer: f¤cš œ,±HØéóþ Ê*N4·ѺòÅUÖyÓXøøUVÊÌÆ*`Uz õ="Vd½ö͙6˜ªw”™žI tԙƒÎµâw™ÏtË7>) 1­ÜEèÇYN
blob_type: 1
flags: 64
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:54156711&cup2hreq=d1b1219198559bce3781499a440b655007a56589716dc7f8db1fc256ed25e8a9
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619902708&mv=u&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=90bcc9e254edac43&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619903295&mv=m
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=90bcc9e254edac43&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619903295&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:54156711&cup2hreq=d1b1219198559bce3781499a440b655007a56589716dc7f8db1fc256ed25e8a9
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:54156711&cup2hreq=d1b1219198559bce3781499a440b655007a56589716dc7f8db1fc256ed25e8a9
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619932287.151625
NtAllocateVirtualMemory
process_identifier: 624
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x004e0000
success 0 0
1619931915.998396
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000041a0000
success 0 0
1619932291.667875
NtAllocateVirtualMemory
process_identifier: 2520
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x003a0000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
Moves the original executable to a new location (1 个事件)
Time & API Arguments Status Return Repeated
1619932289.245625
MoveFileWithProgressW
oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c55fcd53dfc31e498a4298a12b2c89cf.exe
newfilepath: C:\Windows\SysWOW64\api-ms-win-service-core-l1-1-0\imapi.exe
newfilepath_r: C:\Windows\SysWOW64\api-ms-win-service-core-l1-1-0\imapi.exe
flags: 3
oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\c55fcd53dfc31e498a4298a12b2c89cf.exe
success 1 0
Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)
Time & API Arguments Status Return Repeated
1619932305.292875
GetAdaptersAddresses
flags: 0
family: 0
failed 111 0
Expresses interest in specific running processes (1 个事件)
process imapi.exe
Reads the systems User Agent and subsequently performs requests (1 个事件)
Time & API Arguments Status Return Repeated
1619932304.042875
InternetOpenW
proxy_bypass:
access_type: 0
proxy_name:
flags: 0
user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
success 13369348 0
网络通信
Communicates with host for which no DNS query was performed (10 个事件)
host 157.7.164.178
host 172.217.24.14
host 173.94.215.84
host 178.128.14.92
host 181.126.54.234
host 60.125.114.64
host 85.25.207.108
host 203.208.40.66
host 203.208.41.65
host 203.208.41.98
Installs itself for autorun at Windows startup (1 个事件)
service_name imapi service_path C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\api-ms-win-service-core-l1-1-0\imapi.exe"
Created a service where a service was also not started (1 个事件)
Time & API Arguments Status Return Repeated
1619932290.432625
CreateServiceW
service_start_name:
start_type: 2
service_handle: 0x02b788d0
display_name: imapi
error_control: 0
service_name: imapi
filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\api-ms-win-service-core-l1-1-0\imapi.exe"
filepath_r: "C:\Windows\SysWOW64\api-ms-win-service-core-l1-1-0\imapi.exe"
service_manager_handle: 0x02b8b6e0
desired_access: 2
service_type: 16
password:
success 45582544 0
Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)
Time & API Arguments Status Return Repeated
1619932307.901875
RegSetValueExA
key_handle: 0x000003b8
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason
success 0 0
1619932307.901875
RegSetValueExA
key_handle: 0x000003b8
value: ÐX/Ô>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime
success 0 0
1619932307.901875
RegSetValueExA
key_handle: 0x000003b8
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision
success 0 0
1619932307.901875
RegSetValueExW
key_handle: 0x000003b8
value: 网络 2
regkey_r: WpadNetworkName
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName
success 0 0
1619932307.917875
RegSetValueExA
key_handle: 0x000003d0
value: 1
regkey_r: WpadDecisionReason
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason
success 0 0
1619932307.917875
RegSetValueExA
key_handle: 0x000003d0
value: ÐX/Ô>×
regkey_r: WpadDecisionTime
reg_type: 3 (REG_BINARY)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime
success 0 0
1619932307.917875
RegSetValueExA
key_handle: 0x000003d0
value: 3
regkey_r: WpadDecision
reg_type: 4 (REG_DWORD)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision
success 0 0
1619932307.932875
RegSetValueExW
key_handle: 0x000003b4
value: {40112ABE-63B3-43C3-BE93-1440EE3AF106}
regkey_r: WpadLastNetwork
reg_type: 1 (REG_SZ)
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork
success 0 0
Attempts to remove evidence of file being downloaded from the Internet (1 个事件)
file C:\Windows\SysWOW64\api-ms-win-service-core-l1-1-0\imapi.exe:Zone.Identifier
File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)
Bkav W32.PhorpiexUPO.Trojan
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.69604
FireEye Trojan.GenericKDZ.69604
McAfee Emotet-FRV!C55FCD53DFC3
Cylance Unsafe
K7AntiVirus Trojan ( 005600f21 )
Alibaba Trojan:Win32/Emotet.bd097160
K7GW Trojan ( 005600f21 )
Arcabit Trojan.Generic.D10FE4
Cyren W32/Emotet.AQT.gen!Eldorado
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Packed.Generickdz-9481059-0
Kaspersky HEUR:Backdoor.Win32.Emotet.vho
BitDefender Trojan.GenericKDZ.69604
NANO-Antivirus Trojan.Win32.Emotet.hsejql
Paloalto generic.ml
ViRobot Trojan.Win32.Emotet.315392.B
Tencent Malware.Win32.Gencirc.10cdeb6a
Ad-Aware Trojan.GenericKDZ.69604
Comodo Malware@#1hpl7ksvklkgb
DrWeb Trojan.DownLoader34.26342
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-R + Troj/Emotet-CLN
McAfee-GW-Edition BehavesLike.Win32.Emotet.fh
Sophos Troj/Emotet-CLN
Jiangmin Backdoor.Emotet.sa
Avira TR/AD.Emotet.bksnp
MAX malware (ai score=89)
Microsoft Trojan:Win32/Emotet.PED!MTB
AegisLab Trojan.Win32.Emotet.trtJ
ZoneAlarm HEUR:Backdoor.Win32.Emotet.vho
GData Trojan.GenericKDZ.69604
AhnLab-V3 Trojan/Win32.Emotet.R348891
VBA32 Trojan.Wacatac
ALYac Trojan.Agent.Emotet
TACHYON Trojan/W32.Agent.315486.D
ESET-NOD32 Win32/Emotet.CD
Rising Trojan.Kryptik!8.8 (TFE:5:3tSk2dAaYGU)
Yandex Trojan.Emotet!vy4TLVLx5u8
Ikarus Trojan-Banker.Emotet
Fortinet W32/Kryptik.HCEJ!tr
AVG Win32:Trojan-gen
Panda Trj/Agent.AJS
CrowdStrike win/malicious_confidence_60% (W)
Qihoo-360 Generic/Trojan.952
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (11 个事件)
dead_host 181.126.54.234:80
dead_host 173.94.215.84:80
dead_host 192.168.56.101:49190
dead_host 60.125.114.64:443
dead_host 172.217.24.14:443
dead_host 178.128.14.92:8080
dead_host 192.168.56.101:49189
dead_host 157.7.164.178:8081
dead_host 85.25.207.108:8080
dead_host 172.217.160.78:443
dead_host 203.208.41.65:80
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-08-21 02:03:49

Imports

Library KERNEL32.dll:
• 0x42e158 CreateEventA
• 0x42e15c lstrlenA
• 0x42e160 LoadResource
• 0x42e164 FindResourceA
• 0x42e168 LockResource
• 0x42e16c GlobalFree
• 0x42e170 GlobalUnlock
• 0x42e174 lstrcpyA
• 0x42e178 GlobalFindAtomA
• 0x42e17c GlobalAddAtomA
• 0x42e180 GlobalGetAtomNameA
• 0x42e184 lstrcatA
• 0x42e188 FreeLibrary
• 0x42e18c MulDiv
• 0x42e190 lstrcpynA
• 0x42e194 LocalFree
• 0x42e198 FormatMessageA
• 0x42e19c LocalAlloc
• 0x42e1a0 GlobalHandle
• 0x42e1a4 GlobalReAlloc
• 0x42e1a8 LocalReAlloc
• 0x42e1ac GlobalFlags
• 0x42e1c0 GetProcessVersion
• 0x42e1c4 SizeofResource
• 0x42e1c8 SetErrorMode
• 0x42e1cc SuspendThread
• 0x42e1d0 CreateFileA
• 0x42e1d4 LockFile
• 0x42e1d8 UnlockFile
• 0x42e1dc SetEndOfFile
• 0x42e1e0 MoveFileA
• 0x42e1e4 DeleteFileA
• 0x42e1e8 FindClose
• 0x42e1ec FindFirstFileA
• 0x42e1f4 GetFullPathNameA
• 0x42e1f8 GetStringTypeExA
• 0x42e1fc GetThreadLocale
• 0x42e200 GetShortPathNameA
• 0x42e204 GetFileAttributesA
• 0x42e208 GetFileSize
• 0x42e20c GetFileTime
• 0x42e218 SetFileTime
• 0x42e21c SetFileAttributesA
• 0x42e228 SetThreadPriority
• 0x42e22c ResumeThread
• 0x42e230 SetEvent
• 0x42e234 WaitForSingleObject
• 0x42e238 GetLocalTime
• 0x42e23c GetSystemTime
• 0x42e240 ExitThread
• 0x42e244 CreateThread
• 0x42e248 GetProfileStringA
• 0x42e24c GlobalLock
• 0x42e250 GlobalAlloc
• 0x42e254 GlobalDeleteAtom
• 0x42e258 lstrcmpA
• 0x42e25c lstrcmpiA
• 0x42e264 CompareStringW
• 0x42e268 CompareStringA
• 0x42e26c GetLocaleInfoW
• 0x42e278 GetStringTypeW
• 0x42e27c GetStringTypeA
• 0x42e280 ReadFile
• 0x42e284 SetStdHandle
• 0x42e288 LoadLibraryA
• 0x42e28c GetProcAddress
• 0x42e290 GetOEMCP
• 0x42e294 GetACP
• 0x42e298 IsBadCodePtr
• 0x42e29c IsBadReadPtr
• 0x42e2a0 GetVersionExA
• 0x42e2a4 GetUserDefaultLCID
• 0x42e2a8 EnumSystemLocalesA
• 0x42e2ac GetLocaleInfoA
• 0x42e2b0 IsValidCodePage
• 0x42e2b4 IsValidLocale
• 0x42e2b8 GetCPInfo
• 0x42e2bc CloseHandle
• 0x42e2c0 FlushFileBuffers
• 0x42e2c4 SetFilePointer
• 0x42e2cc WriteFile
• 0x42e2d0 GetFileType
• 0x42e2d4 GetStdHandle
• 0x42e2d8 SetHandleCount
• 0x42e2ec GetModuleFileNameA
• 0x42e2f4 IsBadWritePtr
• 0x42e2f8 VirtualAlloc
• 0x42e2fc VirtualFree
• 0x42e300 HeapCreate
• 0x42e304 HeapDestroy
• 0x42e308 ExitProcess
• 0x42e30c LCMapStringW
• 0x42e310 LCMapStringA
• 0x42e314 WideCharToMultiByte
• 0x42e318 GetCurrentThread
• 0x42e31c GetLastError
• 0x42e320 TlsGetValue
• 0x42e324 SetLastError
• 0x42e328 TlsFree
• 0x42e32c TlsAlloc
• 0x42e330 TlsSetValue
• 0x42e334 GetCurrentThreadId
• 0x42e338 HeapSize
• 0x42e33c HeapReAlloc
• 0x42e340 GetCurrentProcess
• 0x42e344 TerminateProcess
• 0x42e348 FatalAppExitA
• 0x42e34c RaiseException
• 0x42e350 HeapFree
• 0x42e354 GetVersion
• 0x42e358 GetCommandLineA
• 0x42e35c GetStartupInfoA
• 0x42e360 GetModuleHandleA
• 0x42e364 HeapAlloc
• 0x42e368 RtlUnwind
• 0x42e36c MultiByteToWideChar
• 0x42e380 InterlockedExchange
• 0x42e388 Sleep
• 0x42e390 DuplicateHandle
Library USER32.dll:
• 0x42e3a4 EndDeferWindowPos
• 0x42e3a8 CopyRect
• 0x42e3ac BeginDeferWindowPos
• 0x42e3b0 DeferWindowPos
• 0x42e3b4 EqualRect
• 0x42e3b8 ScreenToClient
• 0x42e3bc AdjustWindowRectEx
• 0x42e3c0 SetFocus
• 0x42e3c4 GetSysColor
• 0x42e3c8 MapWindowPoints
• 0x42e3cc SendDlgItemMessageA
• 0x42e3d0 UpdateWindow
• 0x42e3d4 CheckDlgButton
• 0x42e3d8 CheckRadioButton
• 0x42e3dc GetDlgItemInt
• 0x42e3e0 GetDlgItemTextA
• 0x42e3e4 SetDlgItemInt
• 0x42e3e8 SetDlgItemTextA
• 0x42e3ec IsDlgButtonChecked
• 0x42e3f0 ScrollWindowEx
• 0x42e3f4 IsDialogMessageA
• 0x42e3f8 SetWindowTextA
• 0x42e3fc MoveWindow
• 0x42e400 wvsprintfA
• 0x42e404 LoadStringA
• 0x42e408 DestroyMenu
• 0x42e40c ClientToScreen
• 0x42e410 GetDC
• 0x42e414 ReleaseDC
• 0x42e418 GetWindowDC
• 0x42e41c BeginPaint
• 0x42e420 EndPaint
• 0x42e424 TabbedTextOutA
• 0x42e428 DrawTextA
• 0x42e42c GrayStringA
• 0x42e430 GetClassNameA
• 0x42e434 PtInRect
• 0x42e438 GetDesktopWindow
• 0x42e43c InsertMenuA
• 0x42e440 DeleteMenu
• 0x42e444 GetMenuStringA
• 0x42e448 LoadCursorA
• 0x42e44c GetSysColorBrush
• 0x42e450 GetDialogBaseUnits
• 0x42e454 CharUpperA
• 0x42e458 UnregisterClassA
• 0x42e45c ShowScrollBar
• 0x42e460 GetScrollRange
• 0x42e464 SetScrollRange
• 0x42e468 GetScrollPos
• 0x42e46c SetScrollPos
• 0x42e470 GetTopWindow
• 0x42e474 IsChild
• 0x42e478 GetCapture
• 0x42e47c WinHelpA
• 0x42e480 wsprintfA
• 0x42e484 GetClassInfoA
• 0x42e488 RegisterClassA
• 0x42e48c GetMenu
• 0x42e490 GetMenuItemCount
• 0x42e494 GetSubMenu
• 0x42e498 GetMenuItemID
• 0x42e49c TrackPopupMenu
• 0x42e4a0 SetWindowPlacement
• 0x42e4a8 ScrollWindow
• 0x42e4ac GetDlgCtrlID
• 0x42e4b0 DefWindowProcA
• 0x42e4b4 CreateWindowExA
• 0x42e4b8 GetClassLongA
• 0x42e4bc SetPropA
• 0x42e4c0 UnhookWindowsHookEx
• 0x42e4c4 GetPropA
• 0x42e4c8 CallWindowProcA
• 0x42e4cc RemovePropA
• 0x42e4d0 GetMessageTime
• 0x42e4d4 GetMessagePos
• 0x42e4d8 GetForegroundWindow
• 0x42e4dc SetForegroundWindow
• 0x42e4e0 GetWindow
• 0x42e4e4 SetWindowPos
• 0x42e4ec OffsetRect
• 0x42e4f0 IntersectRect
• 0x42e4f8 GetWindowPlacement
• 0x42e4fc EndDialog
• 0x42e500 SetActiveWindow
• 0x42e504 IsWindow
• 0x42e50c DestroyWindow
• 0x42e510 GetDlgItem
• 0x42e514 OemToCharA
• 0x42e518 CharToOemA
• 0x42e520 LoadBitmapA
• 0x42e524 GetMenuState
• 0x42e528 ModifyMenuA
• 0x42e52c SetMenuItemBitmaps
• 0x42e530 CheckMenuItem
• 0x42e534 EnableMenuItem
• 0x42e538 GetFocus
• 0x42e53c GetNextDlgTabItem
• 0x42e540 GetMessageA
• 0x42e544 TranslateMessage
• 0x42e548 DispatchMessageA
• 0x42e54c GetActiveWindow
• 0x42e550 GetKeyState
• 0x42e554 CallNextHookEx
• 0x42e558 ValidateRect
• 0x42e55c IsWindowVisible
• 0x42e560 PeekMessageA
• 0x42e564 GetCursorPos
• 0x42e568 SetWindowsHookExA
• 0x42e56c GetParent
• 0x42e570 GetLastActivePopup
• 0x42e574 LoadIconA
• 0x42e578 ShowWindow
• 0x42e57c SendMessageA
• 0x42e580 AppendMenuA
• 0x42e584 HideCaret
• 0x42e588 ShowCaret
• 0x42e58c ExcludeUpdateRgn
• 0x42e590 DrawFocusRect
• 0x42e594 IsWindowEnabled
• 0x42e598 GetWindowLongA
• 0x42e59c MessageBoxA
• 0x42e5a0 SetCursor
• 0x42e5a4 ShowOwnedPopups
• 0x42e5a8 PostMessageA
• 0x42e5ac PostQuitMessage
• 0x42e5b0 EnableWindow
• 0x42e5b4 InvalidateRect
• 0x42e5b8 GetScrollInfo
• 0x42e5bc GetWindowTextA
• 0x42e5c0 SetScrollInfo
• 0x42e5c4 IsRectEmpty
• 0x42e5c8 GetWindowRect
• 0x42e5cc IsIconic
• 0x42e5d0 GetSystemMetrics
• 0x42e5d4 GetClientRect
• 0x42e5d8 DrawIcon
• 0x42e5dc GetSystemMenu
• 0x42e5e0 IsWindowUnicode
• 0x42e5e4 CharNextA
• 0x42e5e8 InflateRect
• 0x42e5ec DefDlgProcA
• 0x42e5f0 SetWindowLongA
Library GDI32.dll:
• 0x42e02c GetStockObject
• 0x42e030 SelectPalette
• 0x42e034 SetBkMode
• 0x42e038 SetPolyFillMode
• 0x42e03c SetROP2
• 0x42e040 SetStretchBltMode
• 0x42e044 SetMapMode
• 0x42e048 SetViewportOrgEx
• 0x42e04c OffsetViewportOrgEx
• 0x42e050 SetViewportExtEx
• 0x42e054 ScaleViewportExtEx
• 0x42e058 SetWindowOrgEx
• 0x42e05c OffsetWindowOrgEx
• 0x42e060 SetWindowExtEx
• 0x42e064 ScaleWindowExtEx
• 0x42e068 SelectClipRgn
• 0x42e06c ExcludeClipRect
• 0x42e070 IntersectClipRect
• 0x42e074 OffsetClipRgn
• 0x42e078 MoveToEx
• 0x42e07c LineTo
• 0x42e080 SetTextAlign
• 0x42e08c SetMapperFlags
• 0x42e094 ArcTo
• 0x42e098 SetArcDirection
• 0x42e09c PolyDraw
• 0x42e0a0 SelectObject
• 0x42e0a4 SetColorAdjustment
• 0x42e0a8 PolyBezierTo
• 0x42e0ac DeleteObject
• 0x42e0b0 GetClipRgn
• 0x42e0b4 CreateRectRgn
• 0x42e0b8 SelectClipPath
• 0x42e0bc ExtSelectClipRgn
• 0x42e0c0 PlayMetaFileRecord
• 0x42e0c4 GetObjectType
• 0x42e0c8 EnumMetaFile
• 0x42e0cc PlayMetaFile
• 0x42e0d0 GetDeviceCaps
• 0x42e0d4 GetViewportExtEx
• 0x42e0d8 GetWindowExtEx
• 0x42e0dc CreatePen
• 0x42e0e0 ExtCreatePen
• 0x42e0e4 CreateSolidBrush
• 0x42e0e8 CreateHatchBrush
• 0x42e0ec CreatePatternBrush
• 0x42e0f4 PtVisible
• 0x42e0f8 RectVisible
• 0x42e0fc TextOutA
• 0x42e100 ExtTextOutA
• 0x42e104 Escape
• 0x42e10c GetTextMetricsA
• 0x42e110 CreateFontIndirectA
• 0x42e114 RestoreDC
• 0x42e118 SaveDC
• 0x42e11c StartDocA
• 0x42e120 DeleteDC
• 0x42e124 GetObjectA
• 0x42e128 SetBkColor
• 0x42e12c SetTextColor
• 0x42e130 GetClipBox
• 0x42e134 GetDCOrgEx
• 0x42e138 PolylineTo
• 0x42e13c CreateDIBitmap
• 0x42e140 PatBlt
• 0x42e144 GetTextExtentPointA
• 0x42e148 BitBlt
• 0x42e14c CreateCompatibleDC
• 0x42e150 CreateBitmap
Library comdlg32.dll:
• 0x42e608 GetOpenFileNameA
• 0x42e60c GetSaveFileNameA
• 0x42e610 GetFileTitleA
Library WINSPOOL.DRV:
• 0x42e5f8 OpenPrinterA
• 0x42e5fc DocumentPropertiesA
• 0x42e600 ClosePrinter
Library ADVAPI32.dll:
• 0x42e000 RegSetValueExA
• 0x42e004 RegOpenKeyA
• 0x42e008 RegDeleteKeyA
• 0x42e00c RegDeleteValueA
• 0x42e010 RegCloseKey
• 0x42e014 RegQueryValueExA
• 0x42e018 RegOpenKeyExA
• 0x42e01c RegCreateKeyExA
Library SHELL32.dll:
• 0x42e398 DragAcceptFiles
• 0x42e39c SHGetFileInfoA
Library COMCTL32.dll:
• 0x42e024

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49197 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49196 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49194 203.208.40.34 update.googleapis.com 443
192.168.56.101 49195 203.208.41.33 redirector.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53500 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56743 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 60088 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 60384 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 54991 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619902708&mv=u&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619902708&mv=u&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=90bcc9e254edac43&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619903295&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=90bcc9e254edac43&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619903295&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=90bcc9e254edac43&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619903295&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=90bcc9e254edac43&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619903295&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6786
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.