4.8
中危
46 个模型检测该样本为恶意！
重新分析
更多

ca8194e9a1232e508619269bdf9a9c71c4b76e7852d86ed18f02088229b0f7c7

cdddcbc43905f8a1a12de465a8b4c5e5.exe

分析耗时

75s

最近分析

文件大小

591.7KB
静态报毒 动态报毒 100% AI SCORE=83 ANDROM AURV BAZARLDR BAZARLOADER CONFIDENCE FSFJ GENCBL GENCIRC KRYPTIK MALCERT MDROP QLVWSNTKI9S R + TROJ R066C0DHK20 R353558 SIGGEN9 SUSGEN TRICKSTER TYQX UNSAFE VZJX 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
Alibaba Backdoor:Win32/Bazarldr.a9666513 20190527 0.3.0.5
Avast Win64:Trojan-gen 20201229 21.1.5827.0
Baidu 20190318 1.0.0.2
Kingsoft 20201229 2017.9.26.565
McAfee Trojan-FSFJ!CDDDCBC43905 20201229 6.0.6.653
Tencent Malware.Win32.Gencirc.114b3bc2 20201229 1.0.0.1
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619910422.778729
IsDebuggerPresent
failed 0 0
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path C:\Users\User\Desktop\2010\14.4.20\Test_64\SEED\Release\SEED.pdb
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:3948135970&cup2hreq=69e3f6c861d59b8e3e01a90c693b8032a6bb425022a2ca62dd1fc6eb26da620d
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619902133&mv=u&mvi=1&pl=23&shardbypass=yes
request HEAD http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m
request GET http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:3948135970&cup2hreq=69e3f6c861d59b8e3e01a90c693b8032a6bb425022a2ca62dd1fc6eb26da620d
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:3948135970&cup2hreq=69e3f6c861d59b8e3e01a90c693b8032a6bb425022a2ca62dd1fc6eb26da620d
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619910422.840729
NtAllocateVirtualMemory
process_identifier: 284
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x0000000001d10000
success 0 0
Creates hidden or system file (8 个事件)
Time & API Arguments Status Return Repeated
1619910423.169729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.184729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.200729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.200729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.340729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.356729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.356729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
1619910423.356729
NtCreateFile
create_disposition: 2 (FILE_CREATE)
file_handle: 0x000000000012f382
filepath: C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
desired_access: 0x00100001 (FILE_READ_DATA|FILE_LIST_DIRECTORY|SYNCHRONIZE)
file_attributes: 4 (FILE_ATTRIBUTE_SYSTEM)
filepath_r: \??\C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3154413779-3303930873-3537499701-500
create_options: 16417 (FILE_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_OPEN_FOR_BACKUP_INTENT)
status_info: 4294967295 ()
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
failed -1073741771 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)
DrWeb Trojan.Siggen9.37965
MicroWorld-eScan Gen:Variant.Downloader.279
FireEye Gen:Variant.Downloader.279
ALYac Trojan.Trickster.Gen
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
CrowdStrike win/malicious_confidence_100% (W)
Alibaba Backdoor:Win32/Bazarldr.a9666513
K7GW Riskware ( 0040eff71 )
K7AntiVirus Riskware ( 0040eff71 )
Arcabit Trojan.Downloader.279
Cyren W64/Trojan.VZJX-6675
Symantec Trojan Horse
ESET-NOD32 a variant of Win64/Kryptik.BXI
Avast Win64:Trojan-gen
ClamAV Win.Malware.Agent-7761810-0
Kaspersky Backdoor.Win32.Androm.tyqx
BitDefender Gen:Variant.Downloader.279
Paloalto generic.ml
AegisLab Trojan.Multi.Generic.4!c
Ad-Aware Gen:Variant.Downloader.279
Sophos Mal/Generic-R + Troj/Mdrop-JBQ
TrendMicro TROJ_GEN.R066C0DHK20
McAfee-GW-Edition Trojan-FSFJ!CDDDCBC43905
Emsisoft MalCert-S.BN (A)
Jiangmin Backdoor.Androm.aurv
Antiy-AVL Trojan[Backdoor]/Win32.Androm
Gridinsoft Trojan.Win64.Kryptik.ba
Microsoft Trojan:Win32/Bazarldr.G!MSR
ZoneAlarm Backdoor.Win32.Androm.tyqx
GData Gen:Variant.Downloader.279
AhnLab-V3 Trojan/Win64.BazarLoader.R353558
McAfee Trojan-FSFJ!CDDDCBC43905
MAX malware (ai score=83)
Malwarebytes Trojan.Injector
TrendMicro-HouseCall TROJ_GEN.R066C0DHK20
Tencent Malware.Win32.Gencirc.114b3bc2
Yandex Trojan.Kryptik!qLVWSnTkI9s
Ikarus Trojan.Win32.Gencbl
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W32/Androm.TYQX!tr.bdr
Webroot W32.Trojan.Gen
AVG Win64:Trojan-gen
Cybereason malicious.43905f
Panda Trj/CI.A
Qihoo-360 Win32/Backdoor.c24
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-04-14 23:33:03

Imports

Library KERNEL32.dll:
• 0x1400426b0 SetThreadAffinityMask
• 0x1400426b8 GetCurrentThread
• 0x1400426c0 EnumSystemLocalesA
• 0x1400426c8 GetLocaleInfoA
• 0x1400426d0 GetUserDefaultLCID
• 0x1400426d8 FlushFileBuffers
• 0x1400426e0 CloseHandle
• 0x1400426e8 CreateFileW
• 0x1400426f0 HeapReAlloc
• 0x1400426f8 LoadLibraryW
• 0x140042700 LCMapStringW
• 0x140042708 WriteConsoleW
• 0x140042710 SetStdHandle
• 0x140042718 GetLocaleInfoW
• 0x140042720 FreeLibrary
• 0x140042728 SetConsoleCtrlHandler
• 0x140042730 HeapSize
• 0x140042738 FatalAppExitA
• 0x140042740 MultiByteToWideChar
• 0x140042748 Sleep
• 0x140042750 IsValidCodePage
• 0x140042758 GetOEMCP
• 0x140042760 FindResourceA
• 0x140042768 GetProcAddress
• 0x140042770 LoadResource
• 0x140042778 SizeofResource
• 0x140042780 LockResource
• 0x140042788 GetCurrentProcess
• 0x140042790 GetStringTypeW
• 0x140042798 QueryPerformanceCounter
• 0x1400427a0 RaiseException
• 0x1400427a8 RtlPcToFileHeader
• 0x1400427b0 RtlLookupFunctionEntry
• 0x1400427b8 RtlUnwindEx
• 0x1400427c0 GetCommandLineA
• 0x1400427c8 GetStartupInfoW
• 0x1400427d0 DecodePointer
• 0x1400427d8 UnhandledExceptionFilter
• 0x1400427e8 IsDebuggerPresent
• 0x1400427f0 RtlVirtualUnwind
• 0x1400427f8 RtlCaptureContext
• 0x140042800 EncodePointer
• 0x140042808 TerminateProcess
• 0x140042810 HeapAlloc
• 0x140042818 GetLastError
• 0x140042820 HeapFree
• 0x140042828 FlsGetValue
• 0x140042830 FlsSetValue
• 0x140042838 FlsFree
• 0x140042840 SetLastError
• 0x140042848 GetCurrentThreadId
• 0x140042850 FlsAlloc
• 0x140042858 GetModuleHandleW
• 0x140042860 ExitProcess
• 0x140042868 WriteFile
• 0x140042870 GetStdHandle
• 0x140042878 GetModuleFileNameW
• 0x140042880 GetModuleFileNameA
• 0x140042888 FreeEnvironmentStringsW
• 0x140042890 WideCharToMultiByte
• 0x140042898 GetEnvironmentStringsW
• 0x1400428a0 SetHandleCount
• 0x1400428b0 GetFileType
• 0x1400428b8 DeleteCriticalSection
• 0x1400428c0 HeapSetInformation
• 0x1400428c8 GetVersion
• 0x1400428d0 HeapCreate
• 0x1400428d8 HeapDestroy
• 0x1400428e0 GetTickCount
• 0x1400428e8 GetCurrentProcessId
• 0x1400428f0 GetSystemTimeAsFileTime
• 0x1400428f8 SetFilePointer
• 0x140042900 GetConsoleCP
• 0x140042908 GetConsoleMode
• 0x140042910 EnterCriticalSection
• 0x140042918 LeaveCriticalSection
• 0x140042920 GetCPInfo
• 0x140042928 GetACP
• 0x140042930 IsValidLocale
Library USER32.dll:
• 0x140042a10 GetMessageW
• 0x140042a18 TranslateMessage
• 0x140042a20 DispatchMessageW
• 0x140042a28 LoadIconW
• 0x140042a30 LoadCursorW
• 0x140042a38 RegisterClassExW
• 0x140042a40 CreateWindowExW
• 0x140042a48 ShowWindow
• 0x140042a50 UpdateWindow
• 0x140042a58 BeginPaint
• 0x140042a60 EndPaint
• 0x140042a68 PostQuitMessage
• 0x140042a70 SetTimer
• 0x140042a78 InvalidateRect
• 0x140042a80 GetDesktopWindow
• 0x140042a88 DefWindowProcW
• 0x140042a90 FillRect
• 0x140042a98 DrawTextW
• 0x140042aa0 KillTimer
Library GDI32.dll:
• 0x140042648 GetStockObject
Library ADVAPI32.dll:
• 0x1400425c0 CryptImportKey
• 0x1400425c8 CryptEncrypt
• 0x1400425d0 CryptDestroyKey
• 0x1400425d8 CryptReleaseContext
• 0x1400425e0 CryptAcquireContextW

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49184 113.108.239.130 r1---sn-j5o76n7e.gvt1.com 80
192.168.56.101 49183 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49180 203.208.41.66 update.googleapis.com 443
192.168.56.101 49185 58.63.233.69 r4---sn-j5o76n7l.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702
192.168.56.101 65005 239.255.255.250 3702

HTTP & HTTPS Requests

URI Data
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=358809-703684
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=106861-192358
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-7706
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=19739-34091
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=34092-46998
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=46999-65731
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=7707-19738
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=4bf80e6e97ac35b&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619902337&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=65732-106860
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.