| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| McAfee | 20210117 | 6.0.6.653 | |
| CrowdStrike | 20190702 | 1.0 | |
| Alibaba | 20190527 | 0.3.0.5 | |
| Baidu | 20190318 | 1.0.0.2 | |
| Avast | 20210117 | 21.1.5827.0 | |
| Kingsoft | 20210117 | 2017.9.26.565 |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1619948410.333436 GetComputerNameW |
computer_name:
OSKAR-PC
|
success | 1 | 0 |
|
1619948417.802436 GetComputerNameW |
computer_name:
OSKAR-PC
|
success | 1 | 0 |
| pdb_path | d:\BuildAgent\work\Trunk2012\Client\Installer\BootstrapperClient\bin\Release\RobloxPlayerLauncher.pdb |
| suspicious_features | GET method with no useragent header, HTTP version 1.0 used | suspicious_request | GET http://setup.roblox.com/version?guid19255 | ||||||
| suspicious_features | GET method with no useragent header, HTTP version 1.0 used | suspicious_request | GET http://setup.roblox.com/version-0658018801724832-RobloxVersion.txt | ||||||
| suspicious_features | GET method with no useragent header, HTTP version 1.0 used | suspicious_request | GET http://setup.roblox.com/cdn.txt | ||||||
| suspicious_features | GET method with no useragent header, HTTP version 1.0 used | suspicious_request | GET http://setup.rbxcdn.com/version-0658018801724832-RobloxPlayerLauncher.exe | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST https://ephemeralcounters.api.roblox.com/v1.1/Counters/BatchIncrement?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F | ||||||
| request | GET http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F |
| request | GET http://setup.roblox.com/version?guid19255 |
| request | GET http://setup.roblox.com/version-0658018801724832-RobloxVersion.txt |
| request | GET http://setup.roblox.com/cdn.txt |
| request | GET http://setup.rbxcdn.com/version-0658018801724832-RobloxPlayerLauncher.exe |
| request | GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D |
| request | GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
| request | GET http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D |
| request | GET http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D |
| request | GET https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper |
| request | POST https://ephemeralcounters.api.roblox.com/v1.1/Counters/BatchIncrement?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F |
| request | POST https://ephemeralcounters.api.roblox.com/v1.1/Counters/BatchIncrement?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F |
| file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\ROBLOX Studio 2.0.lnk |
| file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Play Roblox.lnk |
| file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\ROBLOX Studio Beta.lnk |
| file | C:\Users\Administrator.Oskar-PC\Desktop\ROBLOX Studio 2.0.lnk |
| file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\ROBLOX Studio 2.0 Beta.lnk |
| file | C:\Users\Administrator.Oskar-PC\Desktop\ROBLOX Studio 2.0 Beta.lnk |
| file | C:\Users\Administrator.Oskar-PC\Desktop\Play Roblox.lnk |
| file | C:\Users\Administrator.Oskar-PC\Desktop\ROBLOX Studio Beta.lnk |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RBX-72AAB494.tmp |
| file | C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RBX-72AAB494.tmp |
| DrWeb | Trojan.DownLoader26.12515 |
| VBA32 | BScope.Trojan.Downloader |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1619948411.833436 GetAdaptersAddresses |
flags:
0
family: 0 |
failed | 111 | 0 |
| host | 172.217.24.14 | |||
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob |
No hosts contacted.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49203 | 124.225.105.97 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49179 | 128.116.120.3 clientsettings.api.roblox.com | 80 |
| 192.168.56.101 | 49196 | 128.116.120.3 clientsettings.api.roblox.com | 443 |
| 192.168.56.101 | 49200 | 128.116.120.3 clientsettings.api.roblox.com | 443 |
| 192.168.56.101 | 49204 | 192.124.249.36 ocsp.godaddy.com | 80 |
| 192.168.56.101 | 49186 | 205.234.175.102 setup-cfly.rbxcdn.com | 80 |
| 192.168.56.101 | 49193 | 23.5.253.254 clientsettingscdn.roblox.com | 443 |
| 192.168.56.101 | 49198 | 23.5.253.254 clientsettingscdn.roblox.com | 443 |
| 192.168.56.101 | 49181 | 52.217.160.0 setup.roblox.com | 80 |
| 192.168.56.101 | 49183 | 52.217.160.0 setup.roblox.com | 80 |
| 192.168.56.101 | 49184 | 52.217.160.0 setup.roblox.com | 80 |
| 192.168.56.101 | 49194 | 93.184.220.29 ocsp.digicert.com | 80 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49713 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50002 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53237 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53657 | 114.114.114.114 | 53 |
| 192.168.56.101 | 54178 | 114.114.114.114 | 53 |
| 192.168.56.101 | 54991 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56743 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58070 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58970 | 114.114.114.114 | 53 |
| 192.168.56.101 | 60088 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61680 | 114.114.114.114 | 53 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 49235 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 50534 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 50568 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51808 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51963 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 56804 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 57874 | 224.0.0.252 | 5355 |
| URI | Data |
|---|---|
| http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT If-None-Match: "0d8f4f3f6fd71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com |
| http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D | GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com |
| http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.com |
| http://setup.roblox.com/version?guid19255 | GET /version?guid19255 HTTP/1.0 Host: setup.roblox.com Accept: */* Connection: close |
| http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com |
| http://setup.rbxcdn.com/version-0658018801724832-RobloxPlayerLauncher.exe | GET /version-0658018801724832-RobloxPlayerLauncher.exe HTTP/1.0 Host: setup.rbxcdn.com Accept: */* Connection: close |
| http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 900 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT If-None-Match: "0d8f4f3f6fd71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com |
| http://setup.roblox.com/cdn.txt | GET /cdn.txt HTTP/1.0 Host: setup.roblox.com Accept: */* Connection: close |
| http://setup.roblox.com/version-0658018801724832-RobloxVersion.txt | GET /version-0658018801724832-RobloxVersion.txt HTTP/1.0 Host: setup.roblox.com Accept: */* Connection: close |
| http://clientsettings.api.roblox.com/Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F | GET /Setting/QuietGet/WindowsBootstrapperSettings/?apiKey=76E5A40C-3AE1-4028-9F10-7C62520BD94F HTTP/1.1 User-Agent: Roblox/WinInet Host: clientsettings.api.roblox.com |
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts