7.8
高危
2 个模型检测该样本为恶意！
重新分析
更多

c842d83bcec934fb1532d6735a0bb868e79161c0d3f9aa12c3006bd5fe078d5b

d9eed4768ecaf6fcea2c4d0845a6e631.exe

分析耗时

118s

最近分析

文件大小

426.4KB
静态报毒 动态报毒 MALICIOUS
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Kingsoft 20200801 2013.8.14.323
McAfee 20200801 6.0.6.653
Tencent 20200801 1.0.0.1
Avast 20200806 18.4.3895.0
CrowdStrike 20190702 1.0
静态指标
Queries for the computername (3 个事件)
Time & API Arguments Status Return Repeated
1620829737.514626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620829738.155626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620829740.983374
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620829740.733751
IsDebuggerPresent
failed 0 0
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620829737.280626
GlobalMemoryStatusEx
success 1 0
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620829739.999626
__exception__
stacktrace: 
IsCharAlphaA+0x28f1 EndDialog-0x10b user32+0x3b891 @ 0x775cb891
GetComboBoxInfo+0x321 CreateDialogIndirectParamAorW-0x21f user32+0x40e81 @ 0x775d0e81
GetComboBoxInfo+0x4e1 CreateDialogIndirectParamAorW-0x5f user32+0x41041 @ 0x775d1041
GetComboBoxInfo+0x1e2 CreateDialogIndirectParamAorW-0x35e user32+0x40d42 @ 0x775d0d42
GetComboBoxInfo+0x509 CreateDialogIndirectParamAorW-0x37 user32+0x41069 @ 0x775d1069
DrawTextExA+0xd4 CreateDialogIndirectParamA-0x7d user32+0x2afac @ 0x775bafac
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
GetClientRect+0xc5 CallWindowProcW-0xb user32+0x20d27 @ 0x775b0d27
CallWindowProcA+0x1b GetClassNameA-0x95 user32+0x2794a @ 0x775b794a
dialog+0x88d CheckInstallRequirements-0x94 io+0x260a @ 0x1000260a
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x775a62fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x775a6d3a
GetThreadDesktop+0x185 GetWindowLongW-0x216 user32+0x16de8 @ 0x775a6de8
GetThreadDesktop+0x1e1 GetWindowLongW-0x1ba user32+0x16e44 @ 0x775a6e44
KiUserCallbackDispatcher+0x2e KiUserExceptionDispatcher-0x1a ntdll+0x1011a @ 0x77d4011a
PeekMessageW+0x197 MsgWaitForMultipleObjectsEx-0x143 user32+0x20751 @ 0x775b0751
DialogBoxIndirectParamW+0xfb DialogBoxIndirectParamAorW-0x166 user32+0x3ccee @ 0x775cccee
DialogBoxIndirectParamAorW+0x108 SetDlgItemTextW-0x44 user32+0x3cf5c @ 0x775ccf5c
DialogBoxIndirectParamAorW+0x36 SetDlgItemTextW-0x116 user32+0x3ce8a @ 0x775cce8a
DialogBoxParamA+0x4c GetIconInfoExW-0x20 user32+0x5cb58 @ 0x775ecb58
d9eed4768ecaf6fcea2c4d0845a6e631+0x4cef @ 0x404cef

registers.esp: 1636976
registers.edi: 0
registers.eax: 1076232192
registers.ebp: 1637024
registers.edx: 0
registers.ebx: 0
registers.esi: 1791
registers.ecx: 1076233983
exception.instruction_r: 8a 48 37 80 e1 c0 80 f9 40 0f 85 86 fe ff ff 3b
exception.symbol: GetComboBoxInfo+0x411 CreateDialogIndirectParamAorW-0x12f user32+0x40f71
exception.instruction: mov cl, byte ptr [eax + 0x37]
exception.module: USER32.dll
exception.exception_code: 0xc0000005
exception.offset: 266097
exception.address: 0x775d0f71
success 0 0
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:883026976&cup2hreq=ec9cd98fde53e86f86b762fe8026f309317f4545e6b3cf80d9252785fa24f7b7
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800903&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e2e4fbfabbcd2d54&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800426&mv=m&mvi=3
request GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e2e4fbfabbcd2d54&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800426&mv=m&mvi=3
request POST https://update.googleapis.com/service/update2?cup2key=10:883026976&cup2hreq=ec9cd98fde53e86f86b762fe8026f309317f4545e6b3cf80d9252785fa24f7b7
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:883026976&cup2hreq=ec9cd98fde53e86f86b762fe8026f309317f4545e6b3cf80d9252785fa24f7b7
Allocates read-write-execute memory (usually to unpack itself) (20 个事件)
Time & API Arguments Status Return Repeated
1620829734.436626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x10003000
success 0 0
1620829734.436626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x764c1000
success 0 0
1620829734.467626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77531000
success 0 0
1620829734.467626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a01000
success 0 0
1620829734.467626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75021000
success 0 0
1620829734.467626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750b1000
success 0 0
1620829736.545626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x10003000
success 0 0
1620829736.545626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x764c1000
success 0 0
1620829736.639626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x746a1000
success 0 0
1620829737.202626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1620829737.295626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750a1000
success 0 0
1620829737.295626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76881000
success 0 0
1620829737.452626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75091000
success 0 0
1620829737.483626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74631000
success 0 0
1620829737.483626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74611000
success 0 0
1620829737.514626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x745f1000
success 0 0
1620829738.452626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x10003000
success 0 0
1620829738.452626
NtProtectVirtualMemory
process_identifier: 2852
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x764c1000
success 0 0
1620829806.202374
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00000000045d0000
success 0 0
1620829740.717751
NtProtectVirtualMemory
process_identifier: 2340
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x23005000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 个事件)
Time & API Arguments Status Return Repeated
1620829734.936626
GetDiskFreeSpaceW
root_path: C:\
sectors_per_cluster: 8
number_of_free_clusters: 4787617
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
1620829734.936626
GetDiskFreeSpaceW
root_path: C:\
sectors_per_cluster: 8
number_of_free_clusters: 4787617
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
1620829736.545626
GetDiskFreeSpaceExW
root_path: C:\
free_bytes_available: 19610079232
total_number_of_free_bytes: 19610079232
total_number_of_bytes: 34252779520
success 1 0
1620829745.983374
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer
free_bytes_available: 19541487616
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates executable files on the filesystem (9 个事件)
file C:\Program Files (x86)\NetZero\qs\io.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\io.dll
file C:\Program Files (x86)\NetZero\qs\uninst.exe
file C:\Program Files (x86)\NetZero\qs\appres.dll
file C:\Program Files (x86)\NetZero\qs\comps.dll
file C:\Program Files (x86)\NetZero\qs\exec.exe
file C:\Users\Public\Desktop\NetZero and NZ Platinum.lnk
file C:\Program Files (x86)\NetZero\qs\uires.dll
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetZero Internet\NetZero and NZ Platinum.lnk
Creates a shortcut to an executable file (4 个事件)
file C:\Users\Administrator.Oskar-PC\Desktop\NetZero and NZ Platinum.lnk
file C:\Users\Public\Desktop\NetZero and NZ Platinum.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetZero Internet\NetZero and NZ Platinum.lnk
file C:\Users\Public\Desktop\Google Chrome.lnk
File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)
APEX Malicious
ClamAV Win.Trojan.Agent-1873520
Queries for potentially installed applications (1 个事件)
Time & API Arguments Status Return Repeated
1620829737.077626
RegOpenKeyExA
access: 0x000f003f
base_handle: 0x80000002
key_handle: 0x00000000
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{b4531db2-fb6e-11d3-aa25-0008c7057b33}
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{b4531db2-fb6e-11d3-aa25-0008c7057b33}
options: 0
failed 2 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Appends a known multi-family ransomware file extension to files that have been encrypted (3 个事件)
file C:\Program Files (x86)\NetZero\qs\prop.enc
file C:\Program Files (x86)\NetZero\qs\btcfg.enc
file C:\Program Files (x86)\NetZero\qs\btstrap.enc
Writes a potential ransom message to disk (1 个事件)
Time & API Arguments Status Return Repeated
1620829736.952626
NtWriteFile
file_handle: 0x00000148
filepath: C:\Program Files (x86)\NetZero\qs\help.htm
buffer: ccessful in using the account in the past. <BR><BR> C. Do you have the software set to automatically remember your Password ? <BR><BR> Sometimes, the password has been changed. This can happen due to any number of reasons, such as someone accidentally leaning on the keyboard. Try deleting the password and re-entering it. In this instance, re-entering the information will correct the error. <BR><BR> D. Have you reset your password recently ? <BR><BR> If you have had your password reset recently, ensure that you have entered the new password into the NetZero software. If you aren't sure, re-enter the new password on the NetZero Logon screen before attempting to connect. If you have not requested it to be reset, it will be the same as you configured it most recently. Be certain that you are using the proper upper or lower case as used when establishing it the last time. <BR><BR> If you have forgotten your password: <UL> Click on the <B>Forgot my Password</B> button on the Logon screen <BR><BR> or <BR><BR> Go to <B>http://my.netzero.net/s/resetpassword</B> </UL> E. Have you tried another access number ? <A HREF="#ACCESS"><B>CLICK HERE</B></A> <BR><BR> F. Do you have the latest version of NetZero ? <BR><BR> If you are not sure if you have the latest version of NetZero, go to <B>http://gold.netzero.net/s/signup</B> to download it. <BR><BR> G. Do you have the correct encryption settings? <OL START=1> <LI>Double-click the <B>My Computer</B> icon on your desktop. <LI>Double-click the <B>Dial-Up Networking</B> icon. <LI>Click once on the <B>NetZero</B> icon to highlight it. <LI>From the <B>File</B> menu, select <B>Properties</B>. <LI>Select the <B>Server Types</B> tab. <LI>Ensure that the option labeled <B>Require encrypted password</B> is NOT checked. <LI>Click <B>OK</B>. <LI>Click <B>OK</B>. </OL> If you are still experiencing problems, go to <B>http://www.netzero.net/support/pat/assist_online.html</B> to submit an e-mail ticket to the NetZero Customer Care department. <UL> <B>Note</B>: <B>E-mail support is available for Platinum members only</B>. For a list of alternate support options, please visit <B>http://www.netzero.net/support/support.html</B> </UL> <A HREF="#TOP">TOP</A> <HR> <A NAME=#EZ25></A> <B>Error (PRM2): Unable to contact NetZero, Please try again later.<br> Error (LGN2): Unable to contact NetZero, Please try again later.</B> <BR><BR> These errors can have several causes. Most of the time they can be easily resolved by rebooting your computer. Simply turn your computer off completely and then back on again. If you continue to receive either of these errors, then the information below should help you to identify and resolve this issue. <BR><BR> A. Have you tried another access number ? <A HREF="#ACCESS"><B>CLICK HERE</B></A> <BR><BR> B. Remove the NetZero Dial-Up Networking connectoid <BR><BR> If the steps above did not resolve the issue, please follow the steps below to remove the NetZero Dial-Up Networking connectoid. The connectoid will be recreated the next time you log on to NetZero. <BR><BR> <B>Windows 95/98/ME users:</B> <OL> <LI>Double-click the <B>My Computer</B> icon on your desktop. <LI>Double-click the <B>Dial-Up Networking</B> icon. <LI>Click once on the <B>NetZero</B> icon to highlight it. <LI>From the <B>File</B> menu, select <B>Delete</B>. <LI>Try logging on to NetZero again. </OL> <B>Windows XP users</B>: <OL> <LI>Click the Windows<B> Start </B>button. <LI>Click <B>Connect To</B> and select <B>Show all connections</B>. <LI>Click once on the <B>NetZero</B> icon to highlight it. <LI>From the <B>File</B> menu, select <B>Delete</B>. <LI>Try logging on to NetZero again. </OL> C. Verify network settings <A HREF="#VERIFY"><B>CLICK HERE</B></A> <BR><BR> <A HREF="#TOP">TOP</A> <HR> <A NAME=#EZ26></A> <B>Application Cannot Continue</B> <BR><BR> This error can have several causes. The information below should help you to identify this issue. <BR><BR> A. Interacting with the ZeroPort (NetZero Fre
offset: 0
success 0 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2002-05-09 11:06:38

Imports

Library KERNEL32.dll:
• 0x407074 SearchPathA
• 0x407078 GetFullPathNameA
• 0x40707c MoveFileA
• 0x407080 lstrcatA
• 0x407084 lstrlenA
• 0x407088 lstrcpyA
• 0x40708c SetFileAttributesA
• 0x407090 Sleep
• 0x407094 RemoveDirectoryA
• 0x407098 CopyFileA
• 0x40709c GetFileSize
• 0x4070a0 GetModuleFileNameA
• 0x4070a4 GetModuleHandleA
• 0x4070a8 GetTempPathA
• 0x4070ac GetShortPathNameA
• 0x4070b4 GetDiskFreeSpaceA
• 0x4070b8 CreateThread
• 0x4070bc CreateProcessA
• 0x4070c0 CreateFileA
• 0x4070c4 SetEndOfFile
• 0x4070c8 UnmapViewOfFile
• 0x4070cc MapViewOfFile
• 0x4070d0 CreateFileMappingA
• 0x4070d8 CreateDirectoryA
• 0x4070dc GetSystemDirectoryA
• 0x4070e0 MultiByteToWideChar
• 0x4070e4 CompareFileTime
• 0x4070e8 GetTempFileNameA
• 0x4070ec GetFileAttributesA
• 0x4070f0 FindFirstFileA
• 0x4070f4 SetFileTime
• 0x4070f8 CloseHandle
• 0x4070fc lstrcmpiA
• 0x407100 DeleteFileA
• 0x407104 FindNextFileA
• 0x407108 lstrcpynA
• 0x407110 WaitForSingleObject
• 0x407114 GetProcAddress
• 0x407118 GetExitCodeProcess
• 0x40711c LoadLibraryA
• 0x407120 GetTickCount
• 0x407124 FreeLibrary
• 0x407128 GetCommandLineA
• 0x40712c GlobalFree
• 0x407130 ReadFile
• 0x407134 GlobalAlloc
• 0x407138 MulDiv
• 0x40713c FindClose
• 0x407140 SetFilePointer
• 0x407144 GetCurrentProcess
• 0x407148 WriteFile
• 0x407154 ExitProcess
Library USER32.dll:
• 0x407174 SetWindowPos
• 0x407178 ScreenToClient
• 0x40717c GetWindowRect
• 0x407180 GetDlgItem
• 0x407184 EnableWindow
• 0x407188 SetFocus
• 0x40718c SetClassLongA
• 0x407190 CharPrevA
• 0x407194 GetDlgItemTextA
• 0x407198 SendDlgItemMessageA
• 0x40719c LoadBitmapA
• 0x4071a0 IsWindowVisible
• 0x4071a4 GetParent
• 0x4071a8 DialogBoxParamA
• 0x4071ac ExitWindowsEx
• 0x4071b0 SendMessageA
• 0x4071b4 DefWindowProcA
• 0x4071b8 IsWindowEnabled
• 0x4071bc EndDialog
• 0x4071c0 FillRect
• 0x4071c4 GetWindowTextA
• 0x4071c8 DrawTextA
• 0x4071cc EndPaint
• 0x4071d0 LoadIconA
• 0x4071d4 LoadCursorA
• 0x4071d8 RegisterClassA
• 0x4071e0 GetDesktopWindow
• 0x4071e4 CreateWindowExA
• 0x4071e8 SetWindowTextA
• 0x4071ec SetDlgItemTextA
• 0x4071f0 CharNextA
• 0x4071f4 CreateDialogParamA
• 0x4071f8 DestroyWindow
• 0x4071fc PostQuitMessage
• 0x407200 ShowWindow
• 0x407204 SetForegroundWindow
• 0x407208 MessageBoxA
• 0x40720c wsprintfA
• 0x407210 SetTimer
• 0x407214 SetRect
• 0x407218 IsWindow
• 0x40721c FindWindowExA
• 0x407220 PeekMessageA
• 0x407224 GetClientRect
• 0x407228 BeginPaint
• 0x40722c DispatchMessageA
Library GDI32.dll:
• 0x407030 SelectObject
• 0x407034 SetTextColor
• 0x407038 SetBkMode
• 0x40703c CreateFontA
• 0x407040 DeleteObject
• 0x407044 BitBlt
• 0x407048 CreateCompatibleDC
• 0x40704c CreateSolidBrush
• 0x407050 LineTo
• 0x407054 MoveToEx
• 0x407058 GetTextColor
• 0x40705c GetStockObject
• 0x407060 SetBkColor
• 0x407064 CreatePen
• 0x407068 CreateBrushIndirect
• 0x40706c GetNearestColor
Library ADVAPI32.dll:
• 0x407000 RegCreateKeyA
• 0x407004 RegDeleteKeyA
• 0x407008 RegOpenKeyExA
• 0x40700c RegDeleteValueA
• 0x407010 RegCloseKey
• 0x407014 RegSetValueExA
• 0x407018 RegQueryValueExA
• 0x40701c RegEnumKeyA
• 0x407020 RegEnumValueA
Library SHELL32.dll:
• 0x407160 ShellExecuteA
• 0x407164 SHFileOperationA
• 0x407168 SHGetMalloc
• 0x40716c SHBrowseForFolderA
Library ole32.dll:
• 0x407244 OleInitialize
• 0x407248 OleUninitialize
• 0x40724c CoCreateInstance
Library VERSION.dll:
• 0x407238 VerQueryValueA
• 0x40723c GetFileVersionInfoA
Library COMCTL32.dll:
• 0x407028

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49202 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49203 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49200 203.208.40.66 update.googleapis.com 443
192.168.56.101 49201 203.208.41.65 redirector.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 50568 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 54178 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 58970 114.114.114.114 53
192.168.56.101 60221 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e2e4fbfabbcd2d54&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800426&mv=m&mvi=3 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e2e4fbfabbcd2d54&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800426&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800903&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800903&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e2e4fbfabbcd2d54&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800426&mv=m&mvi=3 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=e2e4fbfabbcd2d54&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1620800426&mv=m&mvi=3 HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-6744
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.