4.8
中危
55 个模型检测该样本为恶意！
重新分析
更多

8696336221daa87cc4c82b725a6ce9bd82d30e075e7292bb99e79e826904aa76

e01c9b67905ac0cc182e80b355d62ed1.exe

分析耗时

128s

最近分析

文件大小

462.1KB
静态报毒 动态报毒 100% 3FI1GS AFQY AI SCORE=81 AIDETECTVM BEVV CLOUD CM2@AW@NVLEI CONFIDENCE EHLS ELDORADO GENERICKD GENERIK GENETIC GOZI GRAYWARE HDWA HIGH CONFIDENCE HLSATH HNFUKZC JQROW KRYPTIK MALICIOUS PE MALWARE2 MALWARE@#14ZFVCNSLOGPY QVM20 R339508 SCORE THFOEBO TROJANBANKER TROJANX UNSAFE URSNIF URSNIFDROPPER WACATAC ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Packed-GCB!E01C9B67905A 20200818 6.0.6.653
Alibaba TrojanBanker:Win32/Kryptik.158c75cf 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Avast Win32:TrojanX-gen [Trj] 20200818 18.4.3895.0
Tencent Win32.Trojan-banker.Gozi.Afqy 20200818 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft 20200818 2013.8.14.323
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619948424.839812
GetComputerNameW
computer_name:
failed 0 0
1619948424.839812
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:2986399014&cup2hreq=3c429dc5ca77eff1dc7d4234932f6eb001e790e32c5cf9fc5146da03dad20ed7
Performs some HTTP requests (5 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619948175&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m
request GET http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:2986399014&cup2hreq=3c429dc5ca77eff1dc7d4234932f6eb001e790e32c5cf9fc5146da03dad20ed7
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:2986399014&cup2hreq=3c429dc5ca77eff1dc7d4234932f6eb001e790e32c5cf9fc5146da03dad20ed7
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619948418.777812
NtAllocateVirtualMemory
process_identifier: 912
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00680000
success 0 0
1619948424.433812
NtAllocateVirtualMemory
process_identifier: 912
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x006b0000
success 0 0
1619948424.433812
NtProtectVirtualMemory
process_identifier: 912
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.78:443
File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 个事件)
Bkav W32.AIDetectVM.malware2
Elastic malicious (high confidence)
DrWeb Trojan.Gozi.690
MicroWorld-eScan Trojan.GenericKD.33967952
FireEye Generic.mg.e01c9b67905ac0cc
CAT-QuickHeal Trojan.Gozi
McAfee Packed-GCB!E01C9B67905A
Cylance Unsafe
Zillya Trojan.Gozi.Win32.2840
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanBanker:Win32/Kryptik.158c75cf
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_100% (D)
Invincea heuristic
BitDefenderTheta Gen:NN.ZexaF.34152.Cm2@aW@Nvlei
F-Prot W32/Trojan.DZZ.gen!Eldorado
Symantec Packed.Generic.459
ESET-NOD32 a variant of Win32/Kryptik.HDWA
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
GData Trojan.GenericKD.33967952
Kaspersky HEUR:Trojan-Banker.Win32.Gozi.pef
BitDefender Trojan.GenericKD.33967952
NANO-Antivirus Trojan.Win32.Gozi.hlsath
Paloalto generic.ml
Tencent Win32.Trojan-banker.Gozi.Afqy
Ad-Aware Trojan.GenericKD.33967952
Comodo Malware@#14zfvcnslogpy
VIPRE Trojan.Win32.Generic!BT
TrendMicro Trojan.Win32.WACATAC.THFOEBO
Sophos Troj/Agent-BEVV
Ikarus Trojan.Win32.Crypt
Cyren W32/Trojan.DZZ.gen!Eldorado
Jiangmin Trojan.Banker.Gozi.aoy
Avira TR/AD.UrsnifDropper.jqrow
MAX malware (ai score=81)
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Arcabit Trojan.Generic.D2064F50
AegisLab Trojan.Win32.Gozi.7!c
ZoneAlarm HEUR:Trojan-Banker.Win32.Gozi.pef
Microsoft Trojan:Win32/Gozi.RA!MTB
Cynet Malicious (score: 90)
AhnLab-V3 Trojan/Win32.Ursnif.R339508
VBA32 Trojan.Wacatac
ALYac Trojan.GenericKD.33967952
Malwarebytes Trojan.Ursnif
TrendMicro-HouseCall Trojan.Win32.WACATAC.THFOEBO
Rising Trojan.Kryptik!1.C778 (CLOUD)
Yandex Trojan.Kryptik!3Fi1gS/gq/I
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-05 00:49:55

Imports

Library KERNEL32.dll:
• 0x470b60 CloseHandle
• 0x470b64 lstrcpyA
• 0x470b68 lstrcatA
• 0x470b6c lstrlenA
• 0x470b70 GetModuleFileNameA
• 0x470b7c SearchPathA
• 0x470b80 GetFileAttributesA
• 0x470b84 GetLastError
• 0x470b88 CopyFileA
• 0x470b8c GetFileSize
• 0x470b90 LoadLibraryA
• 0x470b94 lstrcmpA
• 0x470b98 lstrcpynA
• 0x470b9c DeleteFileA
• 0x470ba0 TerminateProcess
• 0x470ba4 WaitForSingleObject
• 0x470ba8 GetExitCodeProcess
• 0x470bac CreateProcessA
• 0x470bb0 GetVersionExA
• 0x470bb4 GetModuleHandleA
• 0x470bb8 GetStartupInfoA
• 0x470bbc CreateFileA
• 0x470bc0 GetShortPathNameA
• 0x470bc4 GetTempFileNameA
• 0x470bc8 GetTempPathA
• 0x470bcc CreateDirectoryA
• 0x470bd0 GetProcAddress
• 0x470bd4 FreeLibrary
• 0x470bdc MoveFileExA
• 0x470be4 IsDebuggerPresent
• 0x470bec HeapDestroy
• 0x470bf0 SetFileTime
• 0x470bf4 _llseek
• 0x470bfc CreateHardLinkA
• 0x470c00 WriteProcessMemory
• 0x470c08 QueueUserAPC
• 0x470c0c GetOEMCP
• 0x470c10 HeapCreate
• 0x470c14 MoveFileA
• 0x470c1c SetWaitableTimer
• 0x470c24 Sleep
• 0x470c28 SetFilePointerEx
• 0x470c2c Process32Next
• 0x470c30 SetConsoleMode
• 0x470c34 VirtualAlloc
Library USER32.dll:
• 0x470c3c wsprintfA
• 0x470c40 MessageBoxA
• 0x470c44 LoadIconA
• 0x470c48 GetSystemMetrics
• 0x470c4c EnableWindow
• 0x470c50 IsIconic
• 0x470c54 GetClientRect
• 0x470c58 SendMessageA
• 0x470c5c DrawIcon
• 0x470c60 PackDDElParam
• 0x470c64 OpenIcon
• 0x470c68 OemToCharW
• 0x470c6c EditWndProc
• 0x470c70 CallWindowProcA
• 0x470c74 IntersectRect
• 0x470c78 EnumWindowStationsA
• 0x470c7c ToUnicode
• 0x470c80 EnumPropsW
• 0x470c84 LoadIconW
• 0x470c88 GetThreadDesktop
• 0x470c8c GetDialogBaseUnits
• 0x470c90 LoadCursorFromFileA
• 0x470c94 CharUpperW
• 0x470c98 DestroyCursor
• 0x470c9c VkKeyScanA
• 0x470ca0 DestroyMenu
• 0x470ca4 CharUpperA
• 0x470ca8 DrawMenuBar
• 0x470cac LoadCursorFromFileW
• 0x470cb0 GetListBoxInfo
• 0x470cb4 GetMenuItemCount
• 0x470cb8 IsWindow
• 0x470cbc WindowFromDC
Library GDI32.dll:
• 0x470cc4 GetEnhMetaFileA
• 0x470cc8 CreateMetaFileA
• 0x470ccc SwapBuffers
• 0x470cd0 GetSystemPaletteUse
• 0x470cd4 FillPath
• 0x470cd8 GetMapMode
• 0x470cdc CloseMetaFile
• 0x470ce0 UpdateColors
• 0x470ce4 CancelDC
• 0x470ce8 GetTextAlign
• 0x470cec GetLayout
• 0x470cf0 RealizePalette
Library ADVAPI32.dll:
• 0x470cf8 RegSetValueExA
• 0x470cfc RegEnumKeyA
• 0x470d00 RegOpenKeyExA
• 0x470d04 RegCloseKey
• 0x470d08 RegQueryValueExA
• 0x470d0c RegCreateKeyExA
• 0x470d10 RegQueryValueExW
• 0x470d14 GetUserNameA
Library SHELL32.dll:
• 0x470d1c ShellExecuteExA
• 0x470d20 SHGetFolderPathA
• 0x470d28 ShellExecuteA
Library ole32.dll:
• 0x470d30 CoCreateInstance
• 0x470d34 CLSIDFromProgID

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49185 113.108.239.130 r1---sn-j5o76n7e.gvt1.com 80
192.168.56.101 49184 203.208.41.65 redirector.gvt1.com 80
192.168.56.101 49183 203.208.41.66 update.googleapis.com 443
192.168.56.101 49186 58.63.233.69 r4---sn-j5o76n7l.gvt1.com 80

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 61680 114.114.114.114 53
192.168.56.101 62912 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=32712-51966
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=7254-20066
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=0-7253
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r1---sn-j5o76n7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619948175&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.105&mm=28&mn=sn-j5o76n7e&ms=nvh&mt=1619948175&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o76n7e.gvt1.com
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=20067-32711
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com
http://r4---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m 
GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=4&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5oe7e&req_id=dfc708f8025a6a48&cms_redirect=yes&ipbypass=yes&mip=59.50.85.28&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1619948175&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT
Range: bytes=51967-70891
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r4---sn-j5o76n7l.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.