Edit tour

Windows Analysis Report
https://mm24cr2kr.vip/rss

Overview

General Information

Sample URL:https://mm24cr2kr.vip/rss
Analysis ID:1675043
Infos:

Detection

Score:0
Range:0 - 100
Confidence:80%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
  • System is w10x64
  • chrome.exe (PID: 5912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)
    • chrome.exe (PID: 2168 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2472,i,14853986110056534718,15321724152257142679,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2504 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • chrome.exe (PID: 6808 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mm24cr2kr.vip/rss" MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Suricata rule has matched

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://mm24cr2kr.vip/rssHTTP Parser: No favicon
Source: unknownHTTPS traffic detected: 142.250.72.164:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknownTCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.72.163
Source: unknownTCP traffic detected without corresponding DNS query: 142.250.72.163
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /rss HTTP/1.1Host: mm24cr2kr.vipConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: mm24cr2kr.vipConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mm24cr2kr.vip/rssAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global trafficDNS traffic detected: DNS query: www.google.com
Source: global trafficDNS traffic detected: DNS query: mm24cr2kr.vip
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 26 Apr 2025 17:57:30 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeServer: cloudflareCf-Cache-Status: DYNAMICCF-RAY: 9367f67f1b7ef7d7-LAXalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 26 Apr 2025 17:57:30 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeServer: cloudflareCache-Control: max-age=14400Cf-Cache-Status: MISSCF-RAY: 9367f6823faedba2-LAXalt-svc: h3=":443"; ma=86400
Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
Source: unknownHTTPS traffic detected: 142.250.72.164:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknownHTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknownHTTPS traffic detected: 131.253.33.254:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: classification engineClassification label: clean0.win@21/4@4/5
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2472,i,14853986110056534718,15321724152257142679,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2504 /prefetch:3
Source: unknownProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mm24cr2kr.vip/rss"
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2472,i,14853986110056534718,15321724152257142679,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2504 /prefetch:3Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception1
Process Injection
1
Process Injection
OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local System1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media3
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive4
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
Ingress Tool Transfer
Traffic DuplicationData Destruction
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1675043 URL: https://mm24cr2kr.vip/rss Startdate: 26/04/2025 Architecture: WINDOWS Score: 0 5 chrome.exe 2 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.13 unknown unknown 5->13 15 192.168.2.15 unknown unknown 5->15 17 192.168.2.4, 138, 443, 49708 unknown unknown 5->17 10 chrome.exe 5->10         started        process4 dnsIp5 19 www.google.com 142.250.72.164, 443, 49727, 49740 GOOGLEUS United States 10->19 21 mm24cr2kr.vip 104.21.16.1, 443, 49729, 49730 CLOUDFLARENETUS United States 10->21

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
https://mm24cr2kr.vip/rss0%Avira URL Cloudsafe
No Antivirus matches
No Antivirus matches
No Antivirus matches
SourceDetectionScannerLabelLink
https://mm24cr2kr.vip/favicon.ico0%Avira URL Cloudsafe

Download Network PCAP: filteredfull

NameIPActiveMaliciousAntivirus DetectionReputation
www.google.com
142.250.72.164
truefalse
    high
    mm24cr2kr.vip
    104.21.16.1
    truefalse
      unknown
      NameMaliciousAntivirus DetectionReputation
      https://mm24cr2kr.vip/rssfalse
        unknown
        https://mm24cr2kr.vip/favicon.icofalse
        • Avira URL Cloud: safe
        unknown
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        104.21.16.1
        mm24cr2kr.vipUnited States
        13335CLOUDFLARENETUSfalse
        142.250.72.164
        www.google.comUnited States
        15169GOOGLEUSfalse
        IP
        192.168.2.13
        192.168.2.15
        192.168.2.4
        Joe Sandbox version:42.0.0 Malachite
        Analysis ID:1675043
        Start date and time:2025-04-26 19:56:23 +02:00
        Joe Sandbox product:CloudBasic
        Overall analysis duration:0h 3m 1s
        Hypervisor based Inspection enabled:false
        Report type:full
        Cookbook file name:browseurl.jbs
        Sample URL:https://mm24cr2kr.vip/rss
        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
        Number of analysed new started processes analysed:20
        Number of new started drivers analysed:0
        Number of existing processes analysed:0
        Number of existing drivers analysed:0
        Number of injected processes analysed:0
        Technologies:
        • HCA enabled
        • EGA enabled
        • AMSI enabled
        Analysis Mode:default
        Analysis stop reason:Timeout
        Detection:CLEAN
        Classification:clean0.win@21/4@4/5
        EGA Information:Failed
        HCA Information:
        • Successful, ratio: 100%
        • Number of executed functions: 0
        • Number of non-executed functions: 0
        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
        • Excluded IPs from analysis (whitelisted): 142.250.68.227, 142.250.72.142, 142.250.101.84, 142.250.72.174, 142.250.189.14, 192.178.49.206, 199.232.214.172, 142.251.40.46, 142.250.188.238, 192.178.49.163, 69.192.44.226, 52.149.20.212
        • Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fs.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, ctldl.windowsupdate.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
        • Not all processes where analyzed, report is missing behavior information
        • Report size getting too big, too many NtOpenFile calls found.
        • VT rate limit hit for: https://mm24cr2kr.vip/rss
        No simulations
        No context
        No context
        No context
        No context
        No context
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:HTML document, ASCII text
        Category:downloaded
        Size (bytes):315
        Entropy (8bit):5.0572271090563765
        Encrypted:false
        SSDEEP:6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
        MD5:A34AC19F4AFAE63ADC5D2F7BC970C07F
        SHA1:A82190FC530C265AA40A045C21770D967F4767B8
        SHA-256:D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
        SHA-512:42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
        Malicious:false
        Reputation:low
        URL:https://mm24cr2kr.vip/favicon.ico
        Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.
        Process:C:\Program Files\Google\Chrome\Application\chrome.exe
        File Type:HTML document, ASCII text
        Category:downloaded
        Size (bytes):315
        Entropy (8bit):5.0572271090563765
        Encrypted:false
        SSDEEP:6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
        MD5:A34AC19F4AFAE63ADC5D2F7BC970C07F
        SHA1:A82190FC530C265AA40A045C21770D967F4767B8
        SHA-256:D5A89E26BEAE0BC03AD18A0B0D1D3D75F87C32047879D25DA11970CB5C4662A3
        SHA-512:42E53D96E5961E95B7A984D9C9778A1D3BD8EE0C87B8B3B515FA31F67C2D073C8565AFC2F4B962C43668C4EFA1E478DA9BB0ECFFA79479C7E880731BC4C55765
        Malicious:false
        Reputation:low
        URL:https://mm24cr2kr.vip/rss
        Preview:<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>404 Not Found</title>.</head><body>.<h1>Not Found</h1>.<p>The requested URL was not found on this server.</p>.<p>Additionally, a 404 Not Found.error was encountered while trying to use an ErrorDocument to handle the request.</p>.</body></html>.
        No static file info

        Download Network PCAP: filteredfull

        • Total Packets: 58
        • 443 (HTTPS)
        • 80 (HTTP)
        • 53 (DNS)
        TimestampSource PortDest PortSource IPDest IP
        Apr 26, 2025 19:57:14.959453106 CEST4968180192.168.2.42.17.190.73
        Apr 26, 2025 19:57:23.346098900 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:23.664664984 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:24.318625927 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:24.662358999 CEST4968180192.168.2.42.17.190.73
        Apr 26, 2025 19:57:25.615159988 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:27.736923933 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:27.736954927 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:27.737078905 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:27.737392902 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:27.737407923 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:28.021142006 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:28.047907114 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:28.048108101 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:28.049561024 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:28.049587965 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:28.049840927 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:28.099282026 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:29.524822950 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.524853945 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.524946928 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.525300026 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.525310040 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.539238930 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.539277077 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.539335966 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.539499044 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.539510965 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.839318991 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.839464903 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.840712070 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.840718985 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.841137886 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.841516972 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.852569103 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.852670908 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.855185986 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:29.855196953 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.855434895 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.884313107 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:29.896699905 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:30.388895988 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:30.389072895 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:30.389127970 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:30.392139912 CEST49729443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:30.392152071 CEST44349729104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:30.522965908 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:30.568280935 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:30.898992062 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:30.899095058 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:30.899193048 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:31.021585941 CEST49730443192.168.2.4104.21.16.1
        Apr 26, 2025 19:57:31.021610022 CEST44349730104.21.16.1192.168.2.4
        Apr 26, 2025 19:57:31.974762917 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:57:32.286813021 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:57:32.833704948 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:32.896214008 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:57:34.099345922 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:57:34.330311060 CEST49708443192.168.2.452.113.196.254
        Apr 26, 2025 19:57:34.470351934 CEST4434970852.113.196.254192.168.2.4
        Apr 26, 2025 19:57:34.511373043 CEST49734443192.168.2.4131.253.33.254
        Apr 26, 2025 19:57:34.511409998 CEST44349734131.253.33.254192.168.2.4
        Apr 26, 2025 19:57:34.511549950 CEST49734443192.168.2.4131.253.33.254
        Apr 26, 2025 19:57:34.511933088 CEST49734443192.168.2.4131.253.33.254
        Apr 26, 2025 19:57:34.511946917 CEST44349734131.253.33.254192.168.2.4
        Apr 26, 2025 19:57:34.999449015 CEST44349734131.253.33.254192.168.2.4
        Apr 26, 2025 19:57:34.999527931 CEST49734443192.168.2.4131.253.33.254
        Apr 26, 2025 19:57:36.508011103 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:57:38.044640064 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:38.044699907 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:38.044894934 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:38.635314941 CEST49727443192.168.2.4142.250.72.164
        Apr 26, 2025 19:57:38.635335922 CEST44349727142.250.72.164192.168.2.4
        Apr 26, 2025 19:57:41.318800926 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:57:42.443891048 CEST49671443192.168.2.4204.79.197.203
        Apr 26, 2025 19:57:50.923015118 CEST49678443192.168.2.420.189.173.27
        Apr 26, 2025 19:58:07.603655100 CEST4971180192.168.2.4142.250.72.163
        Apr 26, 2025 19:58:07.753724098 CEST8049711142.250.72.163192.168.2.4
        Apr 26, 2025 19:58:07.753859043 CEST4971180192.168.2.4142.250.72.163
        Apr 26, 2025 19:58:27.648654938 CEST49740443192.168.2.4142.250.72.164
        Apr 26, 2025 19:58:27.648680925 CEST44349740142.250.72.164192.168.2.4
        Apr 26, 2025 19:58:27.648752928 CEST49740443192.168.2.4142.250.72.164
        Apr 26, 2025 19:58:27.649005890 CEST49740443192.168.2.4142.250.72.164
        Apr 26, 2025 19:58:27.649022102 CEST44349740142.250.72.164192.168.2.4
        Apr 26, 2025 19:58:27.955693007 CEST44349740142.250.72.164192.168.2.4
        Apr 26, 2025 19:58:27.956037045 CEST49740443192.168.2.4142.250.72.164
        Apr 26, 2025 19:58:27.956058979 CEST44349740142.250.72.164192.168.2.4
        Apr 26, 2025 19:58:37.950850010 CEST44349740142.250.72.164192.168.2.4
        Apr 26, 2025 19:58:37.950906038 CEST44349740142.250.72.164192.168.2.4
        Apr 26, 2025 19:58:37.950970888 CEST49740443192.168.2.4142.250.72.164
        Apr 26, 2025 19:58:38.633913040 CEST49740443192.168.2.4142.250.72.164
        Apr 26, 2025 19:58:38.633944035 CEST44349740142.250.72.164192.168.2.4
        TimestampSource PortDest PortSource IPDest IP
        Apr 26, 2025 19:57:23.786840916 CEST53592381.1.1.1192.168.2.4
        Apr 26, 2025 19:57:23.834780931 CEST53591071.1.1.1192.168.2.4
        Apr 26, 2025 19:57:24.951436043 CEST53647081.1.1.1192.168.2.4
        Apr 26, 2025 19:57:27.585199118 CEST6169753192.168.2.41.1.1.1
        Apr 26, 2025 19:57:27.585325003 CEST6543653192.168.2.41.1.1.1
        Apr 26, 2025 19:57:27.725656033 CEST53654361.1.1.1192.168.2.4
        Apr 26, 2025 19:57:27.735469103 CEST53616971.1.1.1192.168.2.4
        Apr 26, 2025 19:57:29.327032089 CEST5947153192.168.2.41.1.1.1
        Apr 26, 2025 19:57:29.327249050 CEST6343253192.168.2.41.1.1.1
        Apr 26, 2025 19:57:29.487917900 CEST53594711.1.1.1192.168.2.4
        Apr 26, 2025 19:57:29.528640985 CEST53634321.1.1.1192.168.2.4
        Apr 26, 2025 19:57:41.867096901 CEST53617961.1.1.1192.168.2.4
        Apr 26, 2025 19:58:00.855854988 CEST53632291.1.1.1192.168.2.4
        Apr 26, 2025 19:58:22.995718956 CEST53575621.1.1.1192.168.2.4
        Apr 26, 2025 19:58:23.225090027 CEST53631051.1.1.1192.168.2.4
        Apr 26, 2025 19:58:25.976514101 CEST53529281.1.1.1192.168.2.4
        Apr 26, 2025 19:58:31.437361002 CEST138138192.168.2.4192.168.2.255
        TimestampSource IPDest IPChecksumCodeType
        Apr 26, 2025 19:57:29.529635906 CEST192.168.2.41.1.1.1c2db(Port unreachable)Destination Unreachable
        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
        Apr 26, 2025 19:57:27.585199118 CEST192.168.2.41.1.1.10x211fStandard query (0)www.google.comA (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:27.585325003 CEST192.168.2.41.1.1.10xb04aStandard query (0)www.google.com65IN (0x0001)false
        Apr 26, 2025 19:57:29.327032089 CEST192.168.2.41.1.1.10x5473Standard query (0)mm24cr2kr.vipA (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.327249050 CEST192.168.2.41.1.1.10xf88eStandard query (0)mm24cr2kr.vip65IN (0x0001)false
        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
        Apr 26, 2025 19:57:27.725656033 CEST1.1.1.1192.168.2.40xb04aNo error (0)www.google.com65IN (0x0001)false
        Apr 26, 2025 19:57:27.735469103 CEST1.1.1.1192.168.2.40x211fNo error (0)www.google.com142.250.72.164A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.16.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.80.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.112.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.32.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.64.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.48.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.487917900 CEST1.1.1.1192.168.2.40x5473No error (0)mm24cr2kr.vip104.21.96.1A (IP address)IN (0x0001)false
        Apr 26, 2025 19:57:29.528640985 CEST1.1.1.1192.168.2.40xf88eNo error (0)mm24cr2kr.vip65IN (0x0001)false
        • mm24cr2kr.vip
        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        0192.168.2.449729104.21.16.14432168C:\Program Files\Google\Chrome\Application\chrome.exe
        TimestampBytes transferredDirectionData
        2025-04-26 17:57:29 UTC666OUTGET /rss HTTP/1.1
        Host: mm24cr2kr.vip
        Connection: keep-alive
        sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"
        sec-ch-ua-mobile: ?0
        sec-ch-ua-platform: "Windows"
        Upgrade-Insecure-Requests: 1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
        Sec-Fetch-Site: none
        Sec-Fetch-Mode: navigate
        Sec-Fetch-User: ?1
        Sec-Fetch-Dest: document
        Accept-Encoding: gzip, deflate, br, zstd
        Accept-Language: en-US,en;q=0.9
        2025-04-26 17:57:30 UTC261INHTTP/1.1 404 Not Found
        Date: Sat, 26 Apr 2025 17:57:30 GMT
        Content-Type: text/html; charset=iso-8859-1
        Transfer-Encoding: chunked
        Connection: close
        Server: cloudflare
        Cf-Cache-Status: DYNAMIC
        CF-RAY: 9367f67f1b7ef7d7-LAX
        alt-svc: h3=":443"; ma=86400
        2025-04-26 17:57:30 UTC322INData Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74
        Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying t
        2025-04-26 17:57:30 UTC5INData Raw: 30 0d 0a 0d 0a
        Data Ascii: 0


        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
        1192.168.2.449730104.21.16.14432168C:\Program Files\Google\Chrome\Application\chrome.exe
        TimestampBytes transferredDirectionData
        2025-04-26 17:57:30 UTC592OUTGET /favicon.ico HTTP/1.1
        Host: mm24cr2kr.vip
        Connection: keep-alive
        sec-ch-ua-platform: "Windows"
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
        sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"
        sec-ch-ua-mobile: ?0
        Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
        Sec-Fetch-Site: same-origin
        Sec-Fetch-Mode: no-cors
        Sec-Fetch-Dest: image
        Referer: https://mm24cr2kr.vip/rss
        Accept-Encoding: gzip, deflate, br, zstd
        Accept-Language: en-US,en;q=0.9
        2025-04-26 17:57:30 UTC288INHTTP/1.1 404 Not Found
        Date: Sat, 26 Apr 2025 17:57:30 GMT
        Content-Type: text/html; charset=iso-8859-1
        Transfer-Encoding: chunked
        Connection: close
        Server: cloudflare
        Cache-Control: max-age=14400
        Cf-Cache-Status: MISS
        CF-RAY: 9367f6823faedba2-LAX
        alt-svc: h3=":443"; ma=86400
        2025-04-26 17:57:30 UTC322INData Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74
        Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying t
        2025-04-26 17:57:30 UTC5INData Raw: 30 0d 0a 0d 0a
        Data Ascii: 0


        020406080s020406080100

        Click to jump to process

        020406080s0.0050100MB

        Click to jump to process

        Target ID:1
        Start time:13:57:18
        Start date:26/04/2025
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
        Imagebase:0x7ff786830000
        File size:3'388'000 bytes
        MD5 hash:E81F54E6C1129887AEA47E7D092680BF
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Target ID:2
        Start time:13:57:22
        Start date:26/04/2025
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2472,i,14853986110056534718,15321724152257142679,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2504 /prefetch:3
        Imagebase:0x7ff786830000
        File size:3'388'000 bytes
        MD5 hash:E81F54E6C1129887AEA47E7D092680BF
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:false

        Target ID:4
        Start time:13:57:28
        Start date:26/04/2025
        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
        Wow64 process (32bit):false
        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mm24cr2kr.vip/rss"
        Imagebase:0x7ff786830000
        File size:3'388'000 bytes
        MD5 hash:E81F54E6C1129887AEA47E7D092680BF
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low
        Has exited:true
        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
        There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

        No disassembly